---
title: "Restore a database's root branch to a time"
description: "The root branch restored in place (Neon's form, slices DB8 and DB5) to the moment `at`: to the newest version of its Drive's window at or before it (one every 30 seconds in which it was written; a day at the most), where `at` is a whole minute or that version's own moment; otherwise (further back than the window holds, to the second, or with `exact`) to `at` itself, to the millisecond, by its WAL archive: the newest base before it forked, its WAL replayed to it and promoted to a timeline of its own before the root mounts it (seconds to minutes: the call waits). Its endpoint and its connection strings are what they were, its owner's password too; its PostgreSQL starts again on a fork of its Drive at that version, which it recovers as after a power cut (or which its archive's replay left at the moment), and the connections it had drop. Its state before is kept as a branch of its own, `main_old_<the restore's moment>` (UTC, to the second), which is deleted as any branch: the Drive it had, forked once its server has let go of it, so that the branch holds every write that server answered, those answered while the restore was under way too. The call answers once the database serves on the restored Drive; where it does not within five minutes (its node refused the version of its app on it; that version did not come up and the app's instance was put back; or the instance runs the version on the Drive it had, a minute after the version was ready), or where its state before cannot be kept as that branch, the restore is undone, its Drive of before never let go: the app on the version it had, the database on its Drive, no `main_old_` branch, and the call refused saying why. With an `Idempotency-Key`, the same call again while the first runs waits for it (fifteen minutes at the most) and is given its answer, whatever it is, with `Idempotent-Replayed`: nothing is restored twice; with another body it is refused at once (409 `idempotency_key_reused`). Its 200 is kept for a day, and given to the same call again; after a refusal the same call again is made anew. Takes `write`."
---

> Documentation Index
> Fetch the complete documentation index at: https://glac.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

Path: Glac API › Other › Databases

`POST /v1/databases/{id}/branches/{branch}/restore`

The root branch restored in place (Neon's form, slices DB8 and DB5) to the moment `at`: to the newest version of its Drive's window at or before it (one every 30 seconds in which it was written; a day at the most), where `at` is a whole minute or that version's own moment; otherwise (further back than the window holds, to the second, or with `exact`) to `at` itself, to the millisecond, by its WAL archive: the newest base before it forked, its WAL replayed to it and promoted to a timeline of its own before the root mounts it (seconds to minutes: the call waits). Its endpoint and its connection strings are what they were, its owner's password too; its PostgreSQL starts again on a fork of its Drive at that version, which it recovers as after a power cut (or which its archive's replay left at the moment), and the connections it had drop. Its state before is kept as a branch of its own, `main_old_<the restore's moment>` (UTC, to the second), which is deleted as any branch: the Drive it had, forked once its server has let go of it, so that the branch holds every write that server answered, those answered while the restore was under way too. The call answers once the database serves on the restored Drive; where it does not within five minutes (its node refused the version of its app on it; that version did not come up and the app's instance was put back; or the instance runs the version on the Drive it had, a minute after the version was ready), or where its state before cannot be kept as that branch, the restore is undone, its Drive of before never let go: the app on the version it had, the database on its Drive, no `main_old_` branch, and the call refused saying why. With an `Idempotency-Key`, the same call again while the first runs waits for it (fifteen minutes at the most) and is given its answer, whatever it is, with `Idempotent-Replayed`: nothing is restored twice; with another body it is refused at once (409 `idempotency_key_reused`). Its 200 is kept for a day, and given to the same call again; after a refusal the same call again is made anew. Takes `write`.

## Authentication

- `apiKey`, http, header `Authorization`, scopes: `write`

## Path parameters

- `id` (`restoreDatabaseBranch.path.id`; string, required) — The database's id (`db-…`) or its name.
- `branch` (`restoreDatabaseBranch.path.branch`; string, required) — The branch, by its name or its id: the root branch, `main`, alone.

## Header parameters

- `Idempotency-Key` (`restoreDatabaseBranch.header.Idempotency-Key`; string, optional) — 1 to 255 characters: the same key and body again gets the same answer, and nothing is made twice.
  - minLength 1; maxLength 255

## Request body

_Required._

- `at` (`restoreDatabaseBranch.at`; string, required) — A time within its history (`history_seconds`). A whole minute, or a version's own moment (`GET /v1/drives/{id}/versions`), within its root branch's Drive's window (a day at the most): that window's newest version at or before it, one every 30 seconds in which it was written. Further back than the window holds, or to the second: the moment itself, to the millisecond, by its WAL archive (slice DB5: the newest base before it, its WAL replayed to it), or refused where the archive does not reach it (400 `invalid_history`; 503 `database_archive_unavailable` while its store refuses its segments), the refusal saying the window's version at or before it: never that version in its place.
  - format `date-time`
- `exact` (`restoreDatabaseBranch.exact`; boolean, optional) — true: the moment `at` itself, to the millisecond, by the WAL archive, whatever its precision (a whole minute too). false or none: as `at` says.

## Example request

```json
{
  "at": "2019-08-24T14:15:22Z",
  "exact": true
}
```

## Code samples

### cURL

```bash
curl --request POST \
  --url 'https://api.glac.ai/v1/databases/<id>/branches/<branch>/restore' \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "at": "2019-08-24T14:15:22Z",
  "exact": true
}
'
```

### TypeScript

```typescript
const url = 'https://api.glac.ai/v1/databases/<id>/branches/<branch>/restore';
const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json', Authorization: 'Bearer <token>'},
  body: JSON.stringify({at: '2019-08-24T14:15:22Z', exact: true})
};

fetch(url, options)
  .then(res => res.json())
  .then(json => console.log(json))
  .catch(err => console.error(err));
```

### Python

```python
import requests

url = "https://api.glac.ai/v1/databases/<id>/branches/<branch>/restore"

payload = {
    "at": "2019-08-24T14:15:22Z",
    "exact": True
}
headers = {
    "Content-Type": "application/json",
    "Authorization": "Bearer <token>"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)
```

## Responses

### 200

The database, its root branch restored.

#### Example

```json
{
  "object": "database",
  "id": "string",
  "name": "string",
  "engine": "postgres",
  "version": "16",
  "region": "na",
  "status": "creating",
  "error": "string",
  "default_branch": {
    "object": "branch",
    "id": "string",
    "name": "string",
    "parent": "string",
    "endpoint": "string",
    "state": "creating",
    "host": "string",
    "pooler_host": "string",
    "connection_uri": "string",
    "pooled_uri": "string",
    "private_host": "string",
    "private_uri": "string",
    "size": {
      "vcpus": 0,
      "memory_bytes": 0
    },
    "storage": {
      "drive_id": "string",
      "size_bytes": 0,
      "durability": "strict",
      "used_bytes": 0,
      "billed_bytes": 0
    },
    "app_id": "string",
    "instance_id": "string",
    "start_command": {
      "status": "string",
      "restarts": 0,
      "last_exit": {
        "status": 0,
        "signal": 0,
        "at": "2019-08-24T14:15:22Z"
      },
      "restarting_at": "2019-08-24T14:15:22Z"
    },
    "expires_at": "2019-08-24T14:15:22Z",
    "created_at": "2019-08-24T14:15:22Z"
  },
  "database_name": "string",
  "role": "string",
  "password": "string",
  "sleep_after_seconds": 0,
  "suspend_after_seconds": 0,
  "wake_daily_at": "string",
  "metadata": {
    "property1": "string",
    "property2": "string"
  },
  "final_snapshot": {
    "id": "string",
    "expires_at": "string"
  },
  "created_at": "2019-08-24T14:15:22Z",
  "tiering": {
    "enabled": true,
    "tiered_bytes": 0
  },
  "history_seconds": 2592000,
  "history": {
    "from": "2019-08-24T14:15:22Z",
    "stored_bytes": 0,
    "gaps": [
      {
        "from": "2019-08-24T14:15:22Z",
        "to": "2019-08-24T14:15:22Z",
        "from_lsn": "string",
        "to_lsn": "string"
      }
    ]
  }
}
```

- `object` (`restoreDatabaseBranch.response.200.object`; string, required)
- `id` (`restoreDatabaseBranch.response.200.id`; string, required)
  - pattern `^db-[0-9a-hjkmnp-tv-z]{16}$`
- `name` (`restoreDatabaseBranch.response.200.name`; string, required) — The project's one database of the name; its name on the project's network.
- `engine` (`restoreDatabaseBranch.response.200.engine`; string, required)
  - one of `"postgres"`
- `version` (`restoreDatabaseBranch.response.200.version`; string, required) — PostgreSQL's major version.
  - one of `"16"`, `"17"`, `"18"`
- `region` (`restoreDatabaseBranch.response.200.region`; string | null, required) — As the create named it; null: the project's home.
  - one of `"na"`, `"eu"`, `"ap"`, `null`
- `status` (`restoreDatabaseBranch.response.200.status`; string, required)
  - one of `"creating"`, `"ready"`, `"failed"`, `"deleting"`, `"deleted"`
- `error` (`restoreDatabaseBranch.response.200.error`; string | null, required) — Why its first start failed, of a `failed` one.
- `default_branch` (`restoreDatabaseBranch.response.200.default_branch`; object, required) — A branch of a database: a stateful instance and a Drive. The root branch, `main`, or one of the database's own (slice DB6): a fork of its parent's Drive.
  - `object` (`restoreDatabaseBranch.response.200.default_branch.object`; string, required)
  - `id` (`restoreDatabaseBranch.response.200.default_branch.id`; string, required)
    - pattern `^br-[0-9a-hjkmnp-tv-z]{16}$`
  - `name` (`restoreDatabaseBranch.response.200.default_branch.name`; string, required)
  - `parent` (`restoreDatabaseBranch.response.200.default_branch.parent`; string | null, required) — The branch it was made from, by its id: none, of the root branch.
  - `endpoint` (`restoreDatabaseBranch.response.200.default_branch.endpoint`; string, required) — Its endpoint's name, as Neon names one: random, so that no name of the database's or the project's is in an address.
    - pattern `^ep-[a-z]+-[a-z]+-[0-9a-f]{8}$`
  - `state` (`restoreDatabaseBranch.response.200.default_branch.state`; string, required) — Its instance's: `awake` while it runs, `paused` while the pause tier holds it in memory, `asleep` while it is saved; `unavailable` where its node cannot be reached (or it has no instance); `creating` and `failed` while the database has none yet, or failed to make one. `deleting` and `deleted` while it is deleted, and once it is.
    - one of `"creating"`, `"failed"`, `"awake"`, `"paused"`, `"asleep"`, `"unavailable"`, `"deleting"`, `"deleted"`
  - `host` (`restoreDatabaseBranch.response.200.default_branch.host`; string | null, required) — Its public address, its endpoint under its database's region and the zone: `<endpoint>.<region>.<zone>` (`ep-calm-river-1a2b3c4d.na.db.glac.run`), port 5432, TLS alone; where an edge serves PostgreSQL (the control plane's `--database-zone`), null where none does or the database has no region to be named under.
  - `pooler_host` (`restoreDatabaseBranch.response.200.default_branch.pooler_host`; string | null, required) — Its pooler's public address (PgBouncer in its instance): `<endpoint>-pooler.<region>.<zone>`, port 5432; where an edge serves PostgreSQL (the control plane's `--database-zone`), null where none does or the database has no region to be named under.
  - `connection_uri` (`restoreDatabaseBranch.response.200.default_branch.connection_uri`; string | null, required) — How a client connects at its public address: `postgresql://<owner>@<host>/<database>?sslmode=require`, with the owner's password in the answers that give it (a create, a reset) alone; a branch of its own has its parent's password; where an edge serves PostgreSQL (the control plane's `--database-zone`), null where none does or the database has no region to be named under.
  - `pooled_uri` (`restoreDatabaseBranch.response.200.default_branch.pooled_uri`; string | null, required) — The same at its pooler: `postgresql://<owner>@<pooler_host>/<database>?sslmode=require`; where an edge serves PostgreSQL (the control plane's `--database-zone`), null where none does or the database has no region to be named under.
  - `private_host` (`restoreDatabaseBranch.response.200.default_branch.private_host`; string, required) — Its name on the project's network: the database's name, of the root branch; `<database>-<branch>` of a branch of its own.
  - `private_uri` (`restoreDatabaseBranch.response.200.default_branch.private_uri`; string, required) — How the project's sandboxes and services connect: `postgresql://<owner>@<private_host>:5432/<database>`, with the owner's password in the answers that give it (a create, a reset) alone. A branch of its own has its parent's roles and passwords.
  - `size` (`restoreDatabaseBranch.response.200.default_branch.size`; object, required) — Its instance's upper bounds; what it uses is billed.
    - `vcpus` (`restoreDatabaseBranch.response.200.default_branch.size.vcpus`; integer, required)
    - `memory_bytes` (`restoreDatabaseBranch.response.200.default_branch.size.memory_bytes`; integer, required)
  - `storage` (`restoreDatabaseBranch.response.200.default_branch.storage`; object, required) — Its Drive (`GET /v1/drives/{drive_id}`).
    - `drive_id` (`restoreDatabaseBranch.response.200.default_branch.storage.drive_id`; string | null, required)
    - `size_bytes` (`restoreDatabaseBranch.response.200.default_branch.storage.size_bytes`; integer | null, required) — As the create gave it; null: the Drive's default.
    - `durability` (`restoreDatabaseBranch.response.200.default_branch.storage.durability`; string, required) — Its Drive's tier, as its node says it: `strict` (a commit returns once the object store has it) or `standard`.
      - one of `"strict"`, `"standard"`
    - `used_bytes` (`restoreDatabaseBranch.response.200.default_branch.storage.used_bytes`; integer | null, required) — What its Drive holds, as its node said last; null before it said.
    - `billed_bytes` (`restoreDatabaseBranch.response.200.default_branch.storage.billed_bytes`; integer | null, required) — What its Drive is billed for keeping: what it holds, of the root branch; of a branch of its own, what it changed since the fork (what its newest version reads from objects of its own in the store, as the collector last worked it out), never more than what it holds: 0 until the collector said. Null before anything was said.
  - `app_id` (`restoreDatabaseBranch.response.200.default_branch.app_id`; string | null, required) — Its app (`GET /v1/apps/{app_id}`), once made.
  - `instance_id` (`restoreDatabaseBranch.response.200.default_branch.instance_id`; string | null, required) — Its instance, a sandbox (`/v1/sandboxes/{instance_id}`: read it, run a command in it), where it has one.
  - `start_command` (`restoreDatabaseBranch.response.200.default_branch.start_command`; any of, required) — How its server runs, as its instance's node says (the instance's `start_command`, `SandboxStartCommand` in `sandboxd/openapi/openapi.json`): `status` (`running`; `restarting`: it ended, and is started again at `restarting_at`; `exited`), `restarts` (how often it was started again in its machine after it ended, with its data as it was: PostgreSQL recovers by its WAL), `last_exit` (`status`, `signal`, `at`), `restarting_at`. Each start is also an event `instance.restarted`. Null where it has no instance, or its node said nothing of it yet.
    - any of: `InstanceStartCommand`, `null`
  - `expires_at` (`restoreDatabaseBranch.response.200.default_branch.expires_at`; string | null, required) — When it is deleted by itself (once no branch made of it is there): never, of the root branch, and of one made without it.
    - format `date-time`
  - `created_at` (`restoreDatabaseBranch.response.200.default_branch.created_at`; string, required)
    - format `date-time`
- `database_name` (`restoreDatabaseBranch.response.200.database_name`; string, required) — The database in the cluster (`glacdb` unless the create named another).
- `role` (`restoreDatabaseBranch.response.200.role`; string, required) — Its owner, `<database_name>_owner`: a member of `glac_superuser`, no superuser.
- `password` (`restoreDatabaseBranch.response.200.password`; string | null, required) — The owner's password, in the answers to a create and a reset alone; null otherwise. Kept nowhere.
- `sleep_after_seconds` (`restoreDatabaseBranch.response.200.sleep_after_seconds`; integer, required) — After how long without anything asked of it its instance sleeps.
- `suspend_after_seconds` (`restoreDatabaseBranch.response.200.suspend_after_seconds`; integer | null, required) — After how long paused its instance (and each branch's) has its memory saved and sleeps (its node holds it to ten minutes). Null for a database made before it: its node's longest.
- `wake_daily_at` (`restoreDatabaseBranch.response.200.wake_daily_at`; string | null, required) — The time of day in UTC at which it is woken every day while it rests (each branch too); null: none.
- `metadata` (`restoreDatabaseBranch.response.200.metadata`; map<string>, required)
- `final_snapshot` (`restoreDatabaseBranch.response.200.final_snapshot`; object | null, required) — Of a deleted one: the snapshot of its Drive kept, a Drive snapshot of the project's, and when it is deleted.
  - `id` (`restoreDatabaseBranch.response.200.final_snapshot.id`; string, required)
  - `expires_at` (`restoreDatabaseBranch.response.200.final_snapshot.expires_at`; string | null, required)
- `created_at` (`restoreDatabaseBranch.response.200.created_at`; string, required)
  - format `date-time`
- `tiering` (`restoreDatabaseBranch.response.200.tiering`; object, required) — Tiered storage: whether it is on, and what it bills by now.
  - `enabled` (`restoreDatabaseBranch.response.200.tiering.enabled`; boolean, required)
  - `tiered_bytes` (`restoreDatabaseBranch.response.200.tiering.tiered_bytes`; integer, required) — What tiered storage bills by now: the sizes before the moves (`pg_table_size` of each partition as it was swapped) of the files its branches point at as tiered, each file once however many branches point at it, and never less than what its prefix holds in the object store. 0 while nothing is tiered.
- `history_seconds` (`restoreDatabaseBranch.response.200.history_seconds`; integer, required) — How far back its root branch can be restored, or branched from, by a time (slice DB8): a day unless the create said (`history_seconds`), 0 (none) to 30 days on a paid plan, a day on Free (fixed, with a GB of old data at the most: its oldest versions go past it). The last day of it is its root branch's Drive's own window of versions, one every 30 seconds in which it was written (`POST /v1/databases/{id}/branches/{branch}/restore` with `at`); further back, and to the second, is its WAL archive's (slice DB5: `exact`). Not billed: the history of a database's last day is free.
  - min 0; max 2592000
- `history` (`restoreDatabaseBranch.response.200.history`; object, required) — Its history as it stands.
  - `from` (`restoreDatabaseBranch.response.200.history.from`; string | null, required) — The earliest time its root branch can be restored to now, by its Drive's window or its WAL archive, whichever reaches further back (within `history_seconds`); its making, where its WAL is archived (its archive's first base is the image's seed it started from); otherwise null until its Drive's window has a version (about three minutes after the database is ready).
    - format `date-time`
  - `stored_bytes` (`restoreDatabaseBranch.response.200.history.stored_bytes`; integer, required) — What the versions of its root branch's window keep that its newest version does not (not billed: its last day is free).
    - format `int64`; min 0
  - `gaps` (`restoreDatabaseBranch.response.200.history.gaps`; array<object>, required) — The gaps of its WAL archive within its history, the oldest first: where its archive's gateway refused its WAL so long that more of it waited than its Drive keeps for the log, and the WAL was given up so that the database stayed up. A time in one is restored only from its root branch's Drive's window (a whole minute, or a version's own time, while the window holds it); to the second or `exact`, it is refused (400 `invalid_history`), never taken from a version before it. Empty: none.
    - `from` (`restoreDatabaseBranch.response.200.history.gaps.from`; string, required) — When the WAL given up began.
      - format `date-time`
    - `to` (`restoreDatabaseBranch.response.200.history.gaps.to`; string | null, required) — Until when the archive restores no time: the end of the first base taken after the gap (taken as soon as the archive takes the WAL again, while the database is awake); null until there is one.
      - format `date-time`
    - `from_lsn` (`restoreDatabaseBranch.response.200.history.gaps.from_lsn`; string, required) — Where in the log the WAL given up begins (`0/5000000`).
    - `to_lsn` (`restoreDatabaseBranch.response.200.history.gaps.to_lsn`; string, required) — Where it ends: the archive holds the WAL again from there.

### 400

`invalid_json`, `unknown_parameter`; `unknown_field`: a field it does not take; `missing_field`: no `at`; `invalid_field`: `at` is no time, `exact` no boolean; `invalid_history` (`param` `at`): a time its history does not hold: outside `history_seconds`, after now, a whole minute out of reach of both its Drive's window and its WAL archive, or a time to the second (or `exact`) out of the archive's reach (before its oldest base, in a gap of it, `history.gaps`; a database made where no object gateway serves keeps none): the message says from when each reaches, and the window's version at or before the time, whose own moment it may be restored to; `invalid_idempotency_key`: an `Idempotency-Key` that is not 1 to 255 characters.

#### Example

```json
{
  "move_id": "string",
  "upgrade_id": "string",
  "move": {
    "object": "move",
    "id": "string",
    "sandbox_id": "string",
    "project_id": "string",
    "from": {
      "id": "string",
      "name": "string"
    },
    "to": {
      "id": "string",
      "name": "string"
    },
    "epoch": 1,
    "step": "string",
    "why": "string",
    "wake": true,
    "from_store": true,
    "release": {},
    "takeover": {},
    "error": {
      "code": "string",
      "message": "string",
      "status": 0,
      "takeover_refused": {
        "code": "string",
        "message": "string",
        "status": 0
      },
      "image": "string",
      "holder": "string",
      "holder_says": "has"
    },
    "attempts": 0,
    "next_attempt_at": "2019-08-24T14:15:22Z",
    "batch": "string",
    "created_at": "2019-08-24T14:15:22Z",
    "updated_at": "2019-08-24T14:15:22Z",
    "ended_at": "2019-08-24T14:15:22Z"
  },
  "lease_until": "2019-08-24T14:15:22Z",
  "active": {
    "name": "string",
    "url": "string",
    "term": 1
  },
  "allowed_hosts": [
    "string"
  ],
  "problems": [
    {
      "at": "string",
      "message": "string"
    }
  ],
  "report": {
    "object": "compose_import",
    "name": "string",
    "dry_run": true,
    "strict": true,
    "profiles": [
      "string"
    ],
    "treatments": {
      "done": 0,
      "adapted": 0,
      "ignored": 0,
      "refused": 0
    },
    "items": [
      {
        "at": "string",
        "treatment": "done",
        "why": "string",
        "change": "string"
      }
    ],
    "services": [
      {
        "name": "string",
        "app_id": "string",
        "status": "created",
        "kind": "service",
        "stateful": true,
        "version": true,
        "items": [
          {
            "at": "string",
            "treatment": "done",
            "why": "string",
            "change": "string"
          }
        ],
        "app": {
          "image": "string",
          "image_pull_secret": "string",
          "start_command": "string",
          "start_args": [
            "string"
          ],
          "port": 0,
          "ready": {
            "http": "string"
          },
          "env": {
            "property1": "string",
            "property2": "string"
          },
          "secrets": {
            "property1": "string",
            "property2": "string"
          },
          "size": {
            "vcpus": 1,
            "memory_bytes": 134217728
          },
          "volumes": [
            {
              "volume": "string",
              "path": "string",
              "read_only": true,
              "nocopy": true
            }
          ],
          "drives": [
            {
              "drive": "string",
              "path": "string",
              "mode": "string"
            }
          ],
          "key_drives": [
            {
              "name": "string",
              "path": "string",
              "size_bytes": 0,
              "nocopy": true
            }
          ],
          "kind": "string",
          "files": [
            {
              "path": "string",
              "content": "string",
              "secret": "string",
              "mode": 0,
              "uid": 0,
              "gid": 0
            }
          ],
          "user": "string",
          "working_dir": "string",
          "stop": {
            "signal": "string",
            "grace_ms": 0
          },
          "hostname": "string",
          "runtime": {
            "ulimits": {
              "property1": {},
              "property2": {}
            },
            "sysctls": {
              "property1": "string",
              "property2": "string"
            },
            "tmpfs": [
              {}
            ],
            "dns": {
              "servers": [
                null
              ],
              "search": [
                null
              ],
              "options": [
                null
              ]
            },
            "shm_size_bytes": 0
          },
          "regions": [
            "string"
          ],
          "scale": {
            "min_instances": 0,
            "max_instances": 1,
            "concurrency": 1,
            "sleep_after_ms": 600000,
            "sleep_notice_ms": 60000,
            "sleep_hold_max_ms": 900000,
            "suspend_after_ms": 1000,
            "wake_daily_at": "string",
            "delete_after_ms": 1000
          },
          "keys": {
            "from": {
              "header": "string"
            },
            "upgrade_on_deploy": true,
            "delete_after_idle_ms": 1000
          },
          "egress": {
            "default": "allow",
            "allow": [
              "string"
            ],
            "deny": [
              "string"
            ],
            "http": [
              {
                "allow": []
              }
            ],
            "inject": [
              {
                "headers": {}
              }
            ],
            "deny_ports": [
              1
            ]
          },
          "metadata": {
            "property1": "string",
            "property2": "string"
          },
          "logs": {
            "output": true,
            "keep": true,
            "requests": {
              "sample_rate": 1,
              "keep_errors": true
            }
          },
          "traces": {
            "sample_rate": 1,
            "trust_incoming": true
          },
          "public": true,
          "depends_on": [
            {
              "service": "string",
              "condition": "string"
            }
          ],
          "network": {
            "aliases": [
              "string"
            ],
            "endpoint_mode": "string"
          }
        }
      }
    ],
    "volumes": [
      {
        "model": "string",
        "name": "string",
        "id": "string",
        "shared": true,
        "status": "to_make",
        "used_by": [
          "string"
        ]
      }
    ],
    "secrets": [
      {
        "model": "string",
        "name": "string",
        "there": true,
        "used_by": [
          "string"
        ]
      }
    ],
    "left_out": [
      {
        "name": "string",
        "profiles": [
          "string"
        ]
      }
    ],
    "absent": [
      "string"
    ],
    "deploy": "string"
  },
  "accounts": [
    {
      "id": "string",
      "name": "string"
    }
  ],
  "error": {
    "type": "string",
    "code": "string",
    "message": "string",
    "param": "string",
    "retryable": true,
    "request_id": "string",
    "docs_url": "string"
  }
}
```

- `error` (`restoreDatabaseBranch.response.400.error`; object, required)
  - `type` (`restoreDatabaseBranch.response.400.error.type`; string, required)
  - `code` (`restoreDatabaseBranch.response.400.error.code`; string, required)
  - `message` (`restoreDatabaseBranch.response.400.error.message`; string, required)
  - `param` (`restoreDatabaseBranch.response.400.error.param`; string | null, required)
  - `retryable` (`restoreDatabaseBranch.response.400.error.retryable`; boolean, required)
  - `request_id` (`restoreDatabaseBranch.response.400.error.request_id`; string, required)
  - `docs_url` (`restoreDatabaseBranch.response.400.error.docs_url`; string | null, required)
- `move_id` (`restoreDatabaseBranch.response.400.move_id`; string, optional) — With `already_moving`: the move of the sandbox that is under way.
- `upgrade_id` (`restoreDatabaseBranch.response.400.upgrade_id`; string, optional) — With `upgrade_in_progress` (the key's upgrade that is not over), `upgrade_started` (the upgrade that has begun) and `rollback_gone` (the upgrade whose revert is refused): that upgrade.
  - pattern `^upg-[0-9a-hjkmnp-tv-z]{16}$`
- `move` (`restoreDatabaseBranch.response.400.move`; object, optional) — With `move_over`, `move_going_back` and `move_taken_over` (`POST /internal/moves/{id}/cancel`): the move, as it stands.
  - `object` (`restoreDatabaseBranch.response.400.move.object`; string, required)
  - `id` (`restoreDatabaseBranch.response.400.move.id`; string, required)
    - pattern `^mov-[0-9a-hjkmnp-tv-z]{16}$`
  - `sandbox_id` (`restoreDatabaseBranch.response.400.move.sandbox_id`; string, required)
  - `project_id` (`restoreDatabaseBranch.response.400.move.project_id`; string, required)
  - `from` (`restoreDatabaseBranch.response.400.move.from`; object, required)
    - `id` (`restoreDatabaseBranch.response.400.move.from.id`; string, required)
    - `name` (`restoreDatabaseBranch.response.400.move.from.name`; string | null, required) — Its name; null for a node that is off the books since.
  - `to` (`restoreDatabaseBranch.response.400.move.to`; object, required)
    - `id` (`restoreDatabaseBranch.response.400.move.to.id`; string, required)
    - `name` (`restoreDatabaseBranch.response.400.move.to.name`; string | null, required) — Its name; null for a node that is off the books since.
  - `epoch` (`restoreDatabaseBranch.response.400.move.epoch`; integer, required) — The epoch the table held the sandbox at when the move began: the old node releases it at it, the new one takes it over one on, the old one takes it back two on, and from the object store three on.
    - min 1
  - `step` (`restoreDatabaseBranch.response.400.move.step`; string, required) — Where it stands: `releasing` (the old node is asked to release it; the table has it there), `taking_over` (the new node is asked to take it over; the table has it there), `reclaiming` (the new node refused it, and the old one is asked to take it back), `restoring` (the old one kept nothing of it, and takes it over from the object store), `done` (on the new node), `failed` (where it was, or back there, or where a failure no time clears or an operator's cancel found it: `error` says why).
  - `why` (`restoreDatabaseBranch.response.400.move.why`; string, required) — What made it: the operator's move, an evacuation, a recovery.
  - `wake` (`restoreDatabaseBranch.response.400.move.wake`; boolean, required) — Whether the new node wakes it: as the call said, or as it was (it ran) when the move began.
  - `from_store` (`restoreDatabaseBranch.response.400.move.from_store`; boolean, required) — The new node takes it from the object store alone.
  - `release` (`restoreDatabaseBranch.response.400.move.release`; object | null, required) — What the old node's release answered (sandboxd/openapi/openapi.json, `releaseSandbox`), without the release's key; null before it answered.
  - `takeover` (`restoreDatabaseBranch.response.400.move.takeover`; object | null, required) — What the takeover that ended it answered (`takeoverSandbox` of the node's document): where its disk and memory came from (`source`), how long each took (`ms`), `memory`; null before.
  - `error` (`restoreDatabaseBranch.response.400.move.error`; one of, required) — Why it failed, of one that failed (the new node's refusal, where it was taken back to the old node); null, of one that is done; of one under way, what the step it is at was last told where it is asked again.
    - one of: `object`, `null`
  - `attempts` (`restoreDatabaseBranch.response.400.move.attempts`; integer, required) — How many times the step it is at was asked without an answer that settles it.
    - min 0
  - `next_attempt_at` (`restoreDatabaseBranch.response.400.move.next_attempt_at`; string | null, required) — When that step is asked again; null where it is not waiting.
    - format `date-time`
  - `batch` (`restoreDatabaseBranch.response.400.move.batch`; string | null, required) — The evacuation (`evc-…`) or recovery (`rcv-…`) it is of.
  - `created_at` (`restoreDatabaseBranch.response.400.move.created_at`; string, required)
    - format `date-time`
  - `updated_at` (`restoreDatabaseBranch.response.400.move.updated_at`; string, required)
    - format `date-time`
  - `ended_at` (`restoreDatabaseBranch.response.400.move.ended_at`; string | null, required)
    - format `date-time`
- `lease_until` (`restoreDatabaseBranch.response.400.lease_until`; string, optional) — With `lease_held`: until when the node may still hold the lease it was granted last, and the time after it for the node to have seen it run out (`recoverNode` is refused until then).
  - format `date-time`
- `active` (`restoreDatabaseBranch.response.400.active`; object | null, optional) — With `standby`: the active copy, as the standby last read the lease; null while no copy holds it.
  - `name` (`restoreDatabaseBranch.response.400.active.name`; string, required)
  - `url` (`restoreDatabaseBranch.response.400.active.url`; string, required)
  - `term` (`restoreDatabaseBranch.response.400.active.term`; integer, required)
    - min 1
- `allowed_hosts` (`restoreDatabaseBranch.response.400.allowed_hosts`; array | null, optional) — With `secret_host_not_allowed`: the hosts the secret may go to, as the secret has them; null where it was given none (the node's `SecretHosts`).
- `problems` (`restoreDatabaseBranch.response.400.problems`; array<object>, optional) — With `invalid_definition`: every problem of the definition, each where it is and what it is.
  - `at` (`restoreDatabaseBranch.response.400.problems.at`; string, required) — Where in the definition, a dotted path (`services.web.port`); empty for the whole of it.
  - `message` (`restoreDatabaseBranch.response.400.problems.message`; string, required)
- `report` (`restoreDatabaseBranch.response.400.report`; object, optional) — With `compose_refused`: the import's report, which says what is refused, why, and what to change.
  - `object` (`restoreDatabaseBranch.response.400.report.object`; string, required)
    - one of `"compose_import"`
  - `name` (`restoreDatabaseBranch.response.400.report.name`; string | null, required) — The model's `name`: each service's label `compose.project`. Null: it has none.
  - `dry_run` (`restoreDatabaseBranch.response.400.report.dry_run`; boolean, required)
  - `strict` (`restoreDatabaseBranch.response.400.report.strict`; boolean, required)
  - `profiles` (`restoreDatabaseBranch.response.400.report.profiles`; array<string>, required)
  - `treatments` (`restoreDatabaseBranch.response.400.report.treatments`; object, required) — How many items of the report have each treatment.
    - `done` (`restoreDatabaseBranch.response.400.report.treatments.done`; integer, required)
      - min 0
    - `adapted` (`restoreDatabaseBranch.response.400.report.treatments.adapted`; integer, required)
      - min 0
    - `ignored` (`restoreDatabaseBranch.response.400.report.treatments.ignored`; integer, required)
      - min 0
    - `refused` (`restoreDatabaseBranch.response.400.report.treatments.refused`; integer, required)
      - min 0
  - `items` (`restoreDatabaseBranch.response.400.report.items`; array<object>, required) — The model's top-level elements: `name`, each volume, network, config and secret, extensions.
    - `at` (`restoreDatabaseBranch.response.400.report.items.at`; string, required) — Where in the model: of a service, its attribute (`ports[0]`, `depends_on.db`, `environment.KEY`), empty for the service as a whole; of the top level, the element (`volumes.db-data`).
    - `treatment` (`restoreDatabaseBranch.response.400.report.items.treatment`; string, required) — `done`: it means the same on the platform; `adapted`: the platform does the same another way; `ignored`: it matters to a local run alone (refused with `strict`); `refused`: the platform cannot do it, and doing without it would let the program go wrong quietly.
      - one of `"done"`, `"adapted"`, `"ignored"`, `"refused"`
    - `why` (`restoreDatabaseBranch.response.400.report.items.why`; string, required)
    - `change` (`restoreDatabaseBranch.response.400.report.items.change`; string | null, required) — Of one that is refused: what to change. Null otherwise.
  - `services` (`restoreDatabaseBranch.response.400.report.services`; array<object>, required) — The services the import takes, in the model's order.
    - `name` (`restoreDatabaseBranch.response.400.report.services.name`; string, required) — The service's name, which is its app's.
    - `app_id` (`restoreDatabaseBranch.response.400.report.services.app_id`; string | null, required) — Its app. Null: a dry run of a service the project does not have.
      - pattern `^app-`
    - `status` (`restoreDatabaseBranch.response.400.report.services.status`; string, required) — What the import does (or, in a dry run, would do) to its app: makes it, writes what changed, or nothing.
      - one of `"created"`, `"changed"`, `"unchanged"`
    - `kind` (`restoreDatabaseBranch.response.400.report.services.kind`; string, required) — `job`: a service of the model waits for it to complete, and it runs to its end in each deploy that needs it.
      - one of `"service"`, `"job"`
    - `stateful` (`restoreDatabaseBranch.response.400.report.services.stateful`; boolean, required) — It mounts a volume of its own: one instance, which has the volume.
    - `version` (`restoreDatabaseBranch.response.400.report.services.version`; boolean, required) — Whether the import's deploy makes a version of it: what its version would be made of, its references resolved, is not what its current version is.
    - `items` (`restoreDatabaseBranch.response.400.report.services.items`; array<object>, required)
      - `at` (`restoreDatabaseBranch.response.400.report.services.items.at`; string, required) — Where in the model: of a service, its attribute (`ports[0]`, `depends_on.db`, `environment.KEY`), empty for the service as a whole; of the top level, the element (`volumes.db-data`).
      - `treatment` (`restoreDatabaseBranch.response.400.report.services.items.treatment`; string, required) — `done`: it means the same on the platform; `adapted`: the platform does the same another way; `ignored`: it matters to a local run alone (refused with `strict`); `refused`: the platform cannot do it, and doing without it would let the program go wrong quietly.
        - one of `"done"`, `"adapted"`, `"ignored"`, `"refused"`
      - `why` (`restoreDatabaseBranch.response.400.report.services.items.why`; string, required)
      - `change` (`restoreDatabaseBranch.response.400.report.services.items.change`; string | null, required) — Of one that is refused: what to change. Null otherwise.
    - `app` (`restoreDatabaseBranch.response.400.report.services.app`; object, required) — The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
      - `image` (`restoreDatabaseBranch.response.400.report.services.app.image`; string | null, required) — What the app's next version is made of, with the seven fields after it: its newest version's, with what was changed since. `null`: the app has no image, and no version.
      - `image_pull_secret` (`restoreDatabaseBranch.response.400.report.services.app.image_pull_secret`; string | null, required) — The name of the secret that holds the credentials of the image's registry. No answer has its value. `null`: none.
      - `start_command` (`restoreDatabaseBranch.response.400.report.services.app.start_command`; any of, required)
        - any of: `StartCommand`, `null`
      - `start_args` (`restoreDatabaseBranch.response.400.report.services.app.start_args`; any of, required) — What follows the image's ENTRYPOINT in the place of its CMD. `null`: the image's CMD, or the whole of `start_command`.
        - any of: `array<string>`, `null`
      - `port` (`restoreDatabaseBranch.response.400.report.services.app.port`; integer | null, required)
      - `ready` (`restoreDatabaseBranch.response.400.report.services.app.ready`; object, required) — How to tell that an instance is up, which a version's template is saved after: exactly one of the three. The first two are asked from outside the instance, so the service has to listen on every address (`0.0.0.0`).
        - `http` (`restoreDatabaseBranch.response.400.report.services.app.ready.http`; string, optional) — A path, beginning with `/`: a `GET` of it on the app's port is answered with a status from 200 to 399.
        - `tcp` (`restoreDatabaseBranch.response.400.report.services.app.ready.tcp`; boolean, optional) — The app's port takes a connection.
          - one of `true`
        - `command` (`restoreDatabaseBranch.response.400.report.services.app.ready.command`; one of, optional) — A command that succeeds in the instance. It is run by the instance's shell: a list of arguments is written as one line for it.
          - one of: `string`, `array<string>`
      - `env` (`restoreDatabaseBranch.response.400.report.services.app.env`; map<string>, required)
      - `secrets` (`restoreDatabaseBranch.response.400.report.services.app.secrets`; map<string>, required) — Names of secrets. No answer has a value.
      - `size` (`restoreDatabaseBranch.response.400.report.services.app.size`; object, required) — What one instance may use at most. It is billed by what it uses.
        - `vcpus` (`restoreDatabaseBranch.response.400.report.services.app.size.vcpus`; integer, required)
          - min 1
        - `memory_bytes` (`restoreDatabaseBranch.response.400.report.services.app.size.memory_bytes`; integer, required) — An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400 `invalid_field` (param `size.memory_bytes`): no node would make an instance of it, as none makes a sandbox of it (the node's `SandboxLimitsCreate.memory_bytes`).
          - min 134217728
      - `volumes` (`restoreDatabaseBranch.response.400.report.services.app.volumes`; array<object>, required)
        - `volume` (`restoreDatabaseBranch.response.400.report.services.app.volumes.volume`; string, required)
        - `path` (`restoreDatabaseBranch.response.400.report.services.app.volumes.path`; string, required)
        - `read_only` (`restoreDatabaseBranch.response.400.report.services.app.volumes.read_only`; boolean, required)
        - `nocopy` (`restoreDatabaseBranch.response.400.report.services.app.volumes.nocopy`; unknown, optional) — There only where it was given as `true`.
      - `kind` (`restoreDatabaseBranch.response.400.report.services.app.kind`; string, required)
      - `files` (`restoreDatabaseBranch.response.400.report.services.app.files`; array<object>, required)
        - `path` (`restoreDatabaseBranch.response.400.report.services.app.files.path`; string, required)
        - `mode` (`restoreDatabaseBranch.response.400.report.services.app.files.mode`; integer, required)
        - `uid` (`restoreDatabaseBranch.response.400.report.services.app.files.uid`; integer, required)
        - `gid` (`restoreDatabaseBranch.response.400.report.services.app.files.gid`; integer, required)
        - `content` (`restoreDatabaseBranch.response.400.report.services.app.files.content`; string, optional)
        - `secret` (`restoreDatabaseBranch.response.400.report.services.app.files.secret`; string, optional)
      - `user` (`restoreDatabaseBranch.response.400.report.services.app.user`; string | null, required)
      - `working_dir` (`restoreDatabaseBranch.response.400.report.services.app.working_dir`; string | null, required)
      - `stop` (`restoreDatabaseBranch.response.400.report.services.app.stop`; any of, required)
        - any of: `ServiceStop`, `null`
      - `hostname` (`restoreDatabaseBranch.response.400.report.services.app.hostname`; string | null, required)
      - `regions` (`restoreDatabaseBranch.response.400.report.services.app.regions`; array<string>, required) — In the order na, eu, ap.
      - `scale` (`restoreDatabaseBranch.response.400.report.services.app.scale`; object, required)
        - `min_instances` (`restoreDatabaseBranch.response.400.report.services.app.scale.min_instances`; integer, required) — How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share `max_instances` (two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At most `max_instances`, where that is given, and at most what the account's plan lets an app ask for in a region (`caps.app_instances.limit`: 5, 50 and 500): more is refused, 403 `plan_cap_reached`.
          - min 0
        - `max_instances` (`restoreDatabaseBranch.response.400.report.services.app.scale.max_instances`; integer | null, required) — How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (`caps.app_instances.limit`: 5 on the free plan, 50 on `p20`, 200 on `p100`, 500 on `p300`, 1,000 on `p1000`, 2,000 on `p2000`): more is refused, 403 `plan_cap_reached`, and what an app asked for on a plan that let it is kept, and held to the plan's number. `null`: the plan's number for an app that names none (`caps.app_instances.default`: 2, 10, 20, 50, 100 and 200), or `min_instances` where that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.
          - min 1
        - `concurrency` (`restoreDatabaseBranch.response.400.report.services.app.scale.concurrency`; integer | null, required) — A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more. `null`, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.
          - min 1; max 1000
        - `sleep_after_ms` (`restoreDatabaseBranch.response.400.report.services.app.scale.sleep_after_ms`; integer, required) — After how long without a request an instance stops. One that stays stopped is deleted by its node after `delete_after_ms`, and the next request that needs an instance gets a new one; the instances `min_instances` keeps awake are neither stopped nor deleted.
          - min 0; max 600000
        - `sleep_notice_ms` (`restoreDatabaseBranch.response.400.report.services.app.scale.sleep_notice_ms`; integer | null, required) — How long before an instance stops for being idle the programs connected to its guest's `/run/sbx/awake` are sent the line `sleep N`, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).
          - min 0; max 60000
        - `sleep_hold_max_ms` (`restoreDatabaseBranch.response.400.report.services.app.scale.sleep_hold_max_ms`; integer, required) — How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to `/run/sbx/awake` and sends `+` before it answers a request whose work goes on after the answer, and `-` (or closes the connection, or dies) when that work is done; the instance stops `sleep_after_ms` after the last hold is lowered. Past this time it stops whatever holds it, the programs connected told `sleep N cap` first where `sleep_notice_ms` asks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).
          - min 0; max 900000
        - `delete_after_ms` (`restoreDatabaseBranch.response.400.report.services.app.scale.delete_after_ms`; integer | null, required) — After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400 `invalid_field`), and an instance that is to stay warm is one of `min_instances`. `null`, which is what it is when nothing is said: the hour of the nodes (`--app-delete-after-seconds`). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, which `keys.delete_after_idle_ms` is for.
          - min 1000; max 3600000
        - `suspend_after_ms` (`restoreDatabaseBranch.response.400.report.services.app.scale.suspend_after_ms`; integer | null, optional) — How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's `suspend_after_seconds` is its app's.
          - min 1000; max 86400000
        - `wake_daily_at` (`restoreDatabaseBranch.response.400.report.services.app.scale.wake_daily_at`; string | null, optional) — A time of day in UTC, `HH:MM`, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server's `pg_cron` jobs, whatever this says. Null (the default): none. A database's `wake_daily_at` is its app's.
          - pattern `^([01][0-9]|2[0-3]):[0-5][0-9]$`
      - `keys` (`restoreDatabaseBranch.response.400.report.services.app.keys`; any of, required)
        - any of: `object`, `null`
      - `egress` (`restoreDatabaseBranch.response.400.report.services.app.egress`; object | null, required) — Egress rules as a sandbox has them (`default`, `allow`, `deny`, `http`, `inject`), null when there are none; kept as the calls gave them (a `PATCH` merges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).
        - `default` (`restoreDatabaseBranch.response.400.report.services.app.egress.default`; string | null, optional)
          - one of `"allow"`, `"deny"`, `null`
        - `allow` (`restoreDatabaseBranch.response.400.report.services.app.egress.allow`; array | null, optional)
        - `deny` (`restoreDatabaseBranch.response.400.report.services.app.egress.deny`; array | null, optional)
        - `http` (`restoreDatabaseBranch.response.400.report.services.app.egress.http`; array | null, optional)
        - `inject` (`restoreDatabaseBranch.response.400.report.services.app.egress.inject`; array | null, optional)
        - `deny_ports` (`restoreDatabaseBranch.response.400.report.services.app.egress.deny_ports`; array | null, optional) — Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
      - `metadata` (`restoreDatabaseBranch.response.400.report.services.app.metadata`; map<string>, required)
      - `logs` (`restoreDatabaseBranch.response.400.report.services.app.logs`; object, required) — What the app's log has, each part as it was given or at its default (`AppLogSettings`).
        - `output` (`restoreDatabaseBranch.response.400.report.services.app.logs.output`; boolean, required)
        - `keep` (`restoreDatabaseBranch.response.400.report.services.app.logs.keep`; boolean, required)
        - `requests` (`restoreDatabaseBranch.response.400.report.services.app.logs.requests`; object, required)
          - `sample_rate` (`restoreDatabaseBranch.response.400.report.services.app.logs.requests.sample_rate`; number, required)
            - min 0; max 1
          - `keep_errors` (`restoreDatabaseBranch.response.400.report.services.app.logs.requests.keep_errors`; boolean, required)
      - `public` (`restoreDatabaseBranch.response.400.report.services.app.public`; boolean, required) — Whether it answers at its default domain (`url`).
      - `depends_on` (`restoreDatabaseBranch.response.400.report.services.app.depends_on`; array<object>, required)
        - `service` (`restoreDatabaseBranch.response.400.report.services.app.depends_on.service`; string, required)
        - `condition` (`restoreDatabaseBranch.response.400.report.services.app.depends_on.condition`; string, required)
      - `network` (`restoreDatabaseBranch.response.400.report.services.app.network`; object, required)
        - `aliases` (`restoreDatabaseBranch.response.400.report.services.app.network.aliases`; array<string>, required)
        - `endpoint_mode` (`restoreDatabaseBranch.response.400.report.services.app.network.endpoint_mode`; string, required)
      - `drives` (`restoreDatabaseBranch.response.400.report.services.app.drives`; array<object>, optional) — The Drives its instance mounts (`AppCreate.drives`): none, `[]`, where it names none.
        - `drive` (`restoreDatabaseBranch.response.400.report.services.app.drives.drive`; string, required)
        - `path` (`restoreDatabaseBranch.response.400.report.services.app.drives.path`; string, required)
        - `mode` (`restoreDatabaseBranch.response.400.report.services.app.drives.mode`; string, required)
      - `key_drives` (`restoreDatabaseBranch.response.400.report.services.app.key_drives`; array<object>, optional) — The Drives each key's instance has of its own (`AppCreate.key_drives`): none, `[]`, where it gives none.
        - `name` (`restoreDatabaseBranch.response.400.report.services.app.key_drives.name`; string, required)
        - `path` (`restoreDatabaseBranch.response.400.report.services.app.key_drives.path`; string, required)
        - `size_bytes` (`restoreDatabaseBranch.response.400.report.services.app.key_drives.size_bytes`; integer | null, required)
          - format `int64`
        - `nocopy` (`restoreDatabaseBranch.response.400.report.services.app.key_drives.nocopy`; unknown, optional) — There only where it was given as `true`.
      - `runtime` (`restoreDatabaseBranch.response.400.report.services.app.runtime`; any of, optional) — Its runtime settings (`AppCreate.runtime`). `null`: none.
        - any of: `Runtime`, `null`
      - `traces` (`restoreDatabaseBranch.response.400.report.services.app.traces`; object, optional) — What the app's requests' traces have, each part as it was given or at its default (`AppTraceSettings`): no span where `sample_rate` is 0.
        - `sample_rate` (`restoreDatabaseBranch.response.400.report.services.app.traces.sample_rate`; number, required)
          - min 0; max 1
        - `trust_incoming` (`restoreDatabaseBranch.response.400.report.services.app.traces.trust_incoming`; boolean, required)
  - `volumes` (`restoreDatabaseBranch.response.400.report.volumes`; array<object>, required) — The volumes of the project the services mount.
    - `model` (`restoreDatabaseBranch.response.400.report.volumes.model`; string | null, required) — Its name in the model. Null: made for a path a stateful service mounts with no volume named.
    - `name` (`restoreDatabaseBranch.response.400.report.volumes.name`; string, required) — Its name in the project.
    - `id` (`restoreDatabaseBranch.response.400.report.volumes.id`; string | null, required) — Null: not made yet (`to_make`).
      - pattern `^vol-`
    - `shared` (`restoreDatabaseBranch.response.400.report.volumes.shared`; boolean, required) — Several services mount it, or one with several instances: every instance of each mounts it at once.
    - `status` (`restoreDatabaseBranch.response.400.report.volumes.status`; string, required) — `to_make`: the import makes it (a dry run says so of what it would make); `made`: this import made it; `there`: an earlier import made it, or a volume of its name was there; `external`: the model names it `external`, and the project has it.
      - one of `"to_make"`, `"made"`, `"there"`, `"external"`
    - `used_by` (`restoreDatabaseBranch.response.400.report.volumes.used_by`; array<string>, required)
  - `secrets` (`restoreDatabaseBranch.response.400.report.secrets`; array<object>, required) — The secrets of the model that services are granted.
    - `model` (`restoreDatabaseBranch.response.400.report.secrets.model`; string, required) — Its name in the model.
    - `name` (`restoreDatabaseBranch.response.400.report.secrets.name`; string, required) — The project's secret that holds it: the model's name, with each character a secret's name does not take written as an underscore.
    - `there` (`restoreDatabaseBranch.response.400.report.secrets.there`; boolean, required) — Whether the project has it. An import (not a dry run) with one that is not there is refused 404 `secret_not_found`.
    - `used_by` (`restoreDatabaseBranch.response.400.report.secrets.used_by`; array<string>, required)
  - `left_out` (`restoreDatabaseBranch.response.400.report.left_out`; array<object>, required) — The services of profiles that are not turned on, which the import does not touch.
    - `name` (`restoreDatabaseBranch.response.400.report.left_out.name`; string, required)
    - `profiles` (`restoreDatabaseBranch.response.400.report.left_out.profiles`; array<string>, required)
  - `absent` (`restoreDatabaseBranch.response.400.report.absent`; array<string>, required) — The project's services that the model does not have: kept as they are.
  - `deploy` (`restoreDatabaseBranch.response.400.report.deploy`; string | null, required) — The deploy the import made (`GET /v1/deploys/{id}`). Null: a dry run, or nothing would get a version.
    - pattern `^dpl-`
- `accounts` (`restoreDatabaseBranch.response.400.accounts`; array<object>, optional) — With `sole_owner`: the accounts the user is the only owner of.
  - `id` (`restoreDatabaseBranch.response.400.accounts.id`; string, required)
    - pattern `^acct-[0-9a-hjkmnp-tv-z]{16}$`
  - `name` (`restoreDatabaseBranch.response.400.accounts.name`; string, required)

### 401

`missing_api_key`, `invalid_api_key`, `expired_api_key`, `invalid_token`.

#### Example

```json
{
  "move_id": "string",
  "upgrade_id": "string",
  "move": {
    "object": "move",
    "id": "string",
    "sandbox_id": "string",
    "project_id": "string",
    "from": {
      "id": "string",
      "name": "string"
    },
    "to": {
      "id": "string",
      "name": "string"
    },
    "epoch": 1,
    "step": "string",
    "why": "string",
    "wake": true,
    "from_store": true,
    "release": {},
    "takeover": {},
    "error": {
      "code": "string",
      "message": "string",
      "status": 0,
      "takeover_refused": {
        "code": "string",
        "message": "string",
        "status": 0
      },
      "image": "string",
      "holder": "string",
      "holder_says": "has"
    },
    "attempts": 0,
    "next_attempt_at": "2019-08-24T14:15:22Z",
    "batch": "string",
    "created_at": "2019-08-24T14:15:22Z",
    "updated_at": "2019-08-24T14:15:22Z",
    "ended_at": "2019-08-24T14:15:22Z"
  },
  "lease_until": "2019-08-24T14:15:22Z",
  "active": {
    "name": "string",
    "url": "string",
    "term": 1
  },
  "allowed_hosts": [
    "string"
  ],
  "problems": [
    {
      "at": "string",
      "message": "string"
    }
  ],
  "report": {
    "object": "compose_import",
    "name": "string",
    "dry_run": true,
    "strict": true,
    "profiles": [
      "string"
    ],
    "treatments": {
      "done": 0,
      "adapted": 0,
      "ignored": 0,
      "refused": 0
    },
    "items": [
      {
        "at": "string",
        "treatment": "done",
        "why": "string",
        "change": "string"
      }
    ],
    "services": [
      {
        "name": "string",
        "app_id": "string",
        "status": "created",
        "kind": "service",
        "stateful": true,
        "version": true,
        "items": [
          {
            "at": "string",
            "treatment": "done",
            "why": "string",
            "change": "string"
          }
        ],
        "app": {
          "image": "string",
          "image_pull_secret": "string",
          "start_command": "string",
          "start_args": [
            "string"
          ],
          "port": 0,
          "ready": {
            "http": "string"
          },
          "env": {
            "property1": "string",
            "property2": "string"
          },
          "secrets": {
            "property1": "string",
            "property2": "string"
          },
          "size": {
            "vcpus": 1,
            "memory_bytes": 134217728
          },
          "volumes": [
            {
              "volume": "string",
              "path": "string",
              "read_only": true,
              "nocopy": true
            }
          ],
          "drives": [
            {
              "drive": "string",
              "path": "string",
              "mode": "string"
            }
          ],
          "key_drives": [
            {
              "name": "string",
              "path": "string",
              "size_bytes": 0,
              "nocopy": true
            }
          ],
          "kind": "string",
          "files": [
            {
              "path": "string",
              "content": "string",
              "secret": "string",
              "mode": 0,
              "uid": 0,
              "gid": 0
            }
          ],
          "user": "string",
          "working_dir": "string",
          "stop": {
            "signal": "string",
            "grace_ms": 0
          },
          "hostname": "string",
          "runtime": {
            "ulimits": {
              "property1": {},
              "property2": {}
            },
            "sysctls": {
              "property1": "string",
              "property2": "string"
            },
            "tmpfs": [
              {}
            ],
            "dns": {
              "servers": [
                null
              ],
              "search": [
                null
              ],
              "options": [
                null
              ]
            },
            "shm_size_bytes": 0
          },
          "regions": [
            "string"
          ],
          "scale": {
            "min_instances": 0,
            "max_instances": 1,
            "concurrency": 1,
            "sleep_after_ms": 600000,
            "sleep_notice_ms": 60000,
            "sleep_hold_max_ms": 900000,
            "suspend_after_ms": 1000,
            "wake_daily_at": "string",
            "delete_after_ms": 1000
          },
          "keys": {
            "from": {
              "header": "string"
            },
            "upgrade_on_deploy": true,
            "delete_after_idle_ms": 1000
          },
          "egress": {
            "default": "allow",
            "allow": [
              "string"
            ],
            "deny": [
              "string"
            ],
            "http": [
              {
                "allow": []
              }
            ],
            "inject": [
              {
                "headers": {}
              }
            ],
            "deny_ports": [
              1
            ]
          },
          "metadata": {
            "property1": "string",
            "property2": "string"
          },
          "logs": {
            "output": true,
            "keep": true,
            "requests": {
              "sample_rate": 1,
              "keep_errors": true
            }
          },
          "traces": {
            "sample_rate": 1,
            "trust_incoming": true
          },
          "public": true,
          "depends_on": [
            {
              "service": "string",
              "condition": "string"
            }
          ],
          "network": {
            "aliases": [
              "string"
            ],
            "endpoint_mode": "string"
          }
        }
      }
    ],
    "volumes": [
      {
        "model": "string",
        "name": "string",
        "id": "string",
        "shared": true,
        "status": "to_make",
        "used_by": [
          "string"
        ]
      }
    ],
    "secrets": [
      {
        "model": "string",
        "name": "string",
        "there": true,
        "used_by": [
          "string"
        ]
      }
    ],
    "left_out": [
      {
        "name": "string",
        "profiles": [
          "string"
        ]
      }
    ],
    "absent": [
      "string"
    ],
    "deploy": "string"
  },
  "accounts": [
    {
      "id": "string",
      "name": "string"
    }
  ],
  "error": {
    "type": "string",
    "code": "string",
    "message": "string",
    "param": "string",
    "retryable": true,
    "request_id": "string",
    "docs_url": "string"
  }
}
```

- `error` (`restoreDatabaseBranch.response.401.error`; object, required)
  - `type` (`restoreDatabaseBranch.response.401.error.type`; string, required)
  - `code` (`restoreDatabaseBranch.response.401.error.code`; string, required)
  - `message` (`restoreDatabaseBranch.response.401.error.message`; string, required)
  - `param` (`restoreDatabaseBranch.response.401.error.param`; string | null, required)
  - `retryable` (`restoreDatabaseBranch.response.401.error.retryable`; boolean, required)
  - `request_id` (`restoreDatabaseBranch.response.401.error.request_id`; string, required)
  - `docs_url` (`restoreDatabaseBranch.response.401.error.docs_url`; string | null, required)
- `move_id` (`restoreDatabaseBranch.response.401.move_id`; string, optional) — With `already_moving`: the move of the sandbox that is under way.
- `upgrade_id` (`restoreDatabaseBranch.response.401.upgrade_id`; string, optional) — With `upgrade_in_progress` (the key's upgrade that is not over), `upgrade_started` (the upgrade that has begun) and `rollback_gone` (the upgrade whose revert is refused): that upgrade.
  - pattern `^upg-[0-9a-hjkmnp-tv-z]{16}$`
- `move` (`restoreDatabaseBranch.response.401.move`; object, optional) — With `move_over`, `move_going_back` and `move_taken_over` (`POST /internal/moves/{id}/cancel`): the move, as it stands.
  - `object` (`restoreDatabaseBranch.response.401.move.object`; string, required)
  - `id` (`restoreDatabaseBranch.response.401.move.id`; string, required)
    - pattern `^mov-[0-9a-hjkmnp-tv-z]{16}$`
  - `sandbox_id` (`restoreDatabaseBranch.response.401.move.sandbox_id`; string, required)
  - `project_id` (`restoreDatabaseBranch.response.401.move.project_id`; string, required)
  - `from` (`restoreDatabaseBranch.response.401.move.from`; object, required)
    - `id` (`restoreDatabaseBranch.response.401.move.from.id`; string, required)
    - `name` (`restoreDatabaseBranch.response.401.move.from.name`; string | null, required) — Its name; null for a node that is off the books since.
  - `to` (`restoreDatabaseBranch.response.401.move.to`; object, required)
    - `id` (`restoreDatabaseBranch.response.401.move.to.id`; string, required)
    - `name` (`restoreDatabaseBranch.response.401.move.to.name`; string | null, required) — Its name; null for a node that is off the books since.
  - `epoch` (`restoreDatabaseBranch.response.401.move.epoch`; integer, required) — The epoch the table held the sandbox at when the move began: the old node releases it at it, the new one takes it over one on, the old one takes it back two on, and from the object store three on.
    - min 1
  - `step` (`restoreDatabaseBranch.response.401.move.step`; string, required) — Where it stands: `releasing` (the old node is asked to release it; the table has it there), `taking_over` (the new node is asked to take it over; the table has it there), `reclaiming` (the new node refused it, and the old one is asked to take it back), `restoring` (the old one kept nothing of it, and takes it over from the object store), `done` (on the new node), `failed` (where it was, or back there, or where a failure no time clears or an operator's cancel found it: `error` says why).
  - `why` (`restoreDatabaseBranch.response.401.move.why`; string, required) — What made it: the operator's move, an evacuation, a recovery.
  - `wake` (`restoreDatabaseBranch.response.401.move.wake`; boolean, required) — Whether the new node wakes it: as the call said, or as it was (it ran) when the move began.
  - `from_store` (`restoreDatabaseBranch.response.401.move.from_store`; boolean, required) — The new node takes it from the object store alone.
  - `release` (`restoreDatabaseBranch.response.401.move.release`; object | null, required) — What the old node's release answered (sandboxd/openapi/openapi.json, `releaseSandbox`), without the release's key; null before it answered.
  - `takeover` (`restoreDatabaseBranch.response.401.move.takeover`; object | null, required) — What the takeover that ended it answered (`takeoverSandbox` of the node's document): where its disk and memory came from (`source`), how long each took (`ms`), `memory`; null before.
  - `error` (`restoreDatabaseBranch.response.401.move.error`; one of, required) — Why it failed, of one that failed (the new node's refusal, where it was taken back to the old node); null, of one that is done; of one under way, what the step it is at was last told where it is asked again.
    - one of: `object`, `null`
  - `attempts` (`restoreDatabaseBranch.response.401.move.attempts`; integer, required) — How many times the step it is at was asked without an answer that settles it.
    - min 0
  - `next_attempt_at` (`restoreDatabaseBranch.response.401.move.next_attempt_at`; string | null, required) — When that step is asked again; null where it is not waiting.
    - format `date-time`
  - `batch` (`restoreDatabaseBranch.response.401.move.batch`; string | null, required) — The evacuation (`evc-…`) or recovery (`rcv-…`) it is of.
  - `created_at` (`restoreDatabaseBranch.response.401.move.created_at`; string, required)
    - format `date-time`
  - `updated_at` (`restoreDatabaseBranch.response.401.move.updated_at`; string, required)
    - format `date-time`
  - `ended_at` (`restoreDatabaseBranch.response.401.move.ended_at`; string | null, required)
    - format `date-time`
- `lease_until` (`restoreDatabaseBranch.response.401.lease_until`; string, optional) — With `lease_held`: until when the node may still hold the lease it was granted last, and the time after it for the node to have seen it run out (`recoverNode` is refused until then).
  - format `date-time`
- `active` (`restoreDatabaseBranch.response.401.active`; object | null, optional) — With `standby`: the active copy, as the standby last read the lease; null while no copy holds it.
  - `name` (`restoreDatabaseBranch.response.401.active.name`; string, required)
  - `url` (`restoreDatabaseBranch.response.401.active.url`; string, required)
  - `term` (`restoreDatabaseBranch.response.401.active.term`; integer, required)
    - min 1
- `allowed_hosts` (`restoreDatabaseBranch.response.401.allowed_hosts`; array | null, optional) — With `secret_host_not_allowed`: the hosts the secret may go to, as the secret has them; null where it was given none (the node's `SecretHosts`).
- `problems` (`restoreDatabaseBranch.response.401.problems`; array<object>, optional) — With `invalid_definition`: every problem of the definition, each where it is and what it is.
  - `at` (`restoreDatabaseBranch.response.401.problems.at`; string, required) — Where in the definition, a dotted path (`services.web.port`); empty for the whole of it.
  - `message` (`restoreDatabaseBranch.response.401.problems.message`; string, required)
- `report` (`restoreDatabaseBranch.response.401.report`; object, optional) — With `compose_refused`: the import's report, which says what is refused, why, and what to change.
  - `object` (`restoreDatabaseBranch.response.401.report.object`; string, required)
    - one of `"compose_import"`
  - `name` (`restoreDatabaseBranch.response.401.report.name`; string | null, required) — The model's `name`: each service's label `compose.project`. Null: it has none.
  - `dry_run` (`restoreDatabaseBranch.response.401.report.dry_run`; boolean, required)
  - `strict` (`restoreDatabaseBranch.response.401.report.strict`; boolean, required)
  - `profiles` (`restoreDatabaseBranch.response.401.report.profiles`; array<string>, required)
  - `treatments` (`restoreDatabaseBranch.response.401.report.treatments`; object, required) — How many items of the report have each treatment.
    - `done` (`restoreDatabaseBranch.response.401.report.treatments.done`; integer, required)
      - min 0
    - `adapted` (`restoreDatabaseBranch.response.401.report.treatments.adapted`; integer, required)
      - min 0
    - `ignored` (`restoreDatabaseBranch.response.401.report.treatments.ignored`; integer, required)
      - min 0
    - `refused` (`restoreDatabaseBranch.response.401.report.treatments.refused`; integer, required)
      - min 0
  - `items` (`restoreDatabaseBranch.response.401.report.items`; array<object>, required) — The model's top-level elements: `name`, each volume, network, config and secret, extensions.
    - `at` (`restoreDatabaseBranch.response.401.report.items.at`; string, required) — Where in the model: of a service, its attribute (`ports[0]`, `depends_on.db`, `environment.KEY`), empty for the service as a whole; of the top level, the element (`volumes.db-data`).
    - `treatment` (`restoreDatabaseBranch.response.401.report.items.treatment`; string, required) — `done`: it means the same on the platform; `adapted`: the platform does the same another way; `ignored`: it matters to a local run alone (refused with `strict`); `refused`: the platform cannot do it, and doing without it would let the program go wrong quietly.
      - one of `"done"`, `"adapted"`, `"ignored"`, `"refused"`
    - `why` (`restoreDatabaseBranch.response.401.report.items.why`; string, required)
    - `change` (`restoreDatabaseBranch.response.401.report.items.change`; string | null, required) — Of one that is refused: what to change. Null otherwise.
  - `services` (`restoreDatabaseBranch.response.401.report.services`; array<object>, required) — The services the import takes, in the model's order.
    - `name` (`restoreDatabaseBranch.response.401.report.services.name`; string, required) — The service's name, which is its app's.
    - `app_id` (`restoreDatabaseBranch.response.401.report.services.app_id`; string | null, required) — Its app. Null: a dry run of a service the project does not have.
      - pattern `^app-`
    - `status` (`restoreDatabaseBranch.response.401.report.services.status`; string, required) — What the import does (or, in a dry run, would do) to its app: makes it, writes what changed, or nothing.
      - one of `"created"`, `"changed"`, `"unchanged"`
    - `kind` (`restoreDatabaseBranch.response.401.report.services.kind`; string, required) — `job`: a service of the model waits for it to complete, and it runs to its end in each deploy that needs it.
      - one of `"service"`, `"job"`
    - `stateful` (`restoreDatabaseBranch.response.401.report.services.stateful`; boolean, required) — It mounts a volume of its own: one instance, which has the volume.
    - `version` (`restoreDatabaseBranch.response.401.report.services.version`; boolean, required) — Whether the import's deploy makes a version of it: what its version would be made of, its references resolved, is not what its current version is.
    - `items` (`restoreDatabaseBranch.response.401.report.services.items`; array<object>, required)
      - `at` (`restoreDatabaseBranch.response.401.report.services.items.at`; string, required) — Where in the model: of a service, its attribute (`ports[0]`, `depends_on.db`, `environment.KEY`), empty for the service as a whole; of the top level, the element (`volumes.db-data`).
      - `treatment` (`restoreDatabaseBranch.response.401.report.services.items.treatment`; string, required) — `done`: it means the same on the platform; `adapted`: the platform does the same another way; `ignored`: it matters to a local run alone (refused with `strict`); `refused`: the platform cannot do it, and doing without it would let the program go wrong quietly.
        - one of `"done"`, `"adapted"`, `"ignored"`, `"refused"`
      - `why` (`restoreDatabaseBranch.response.401.report.services.items.why`; string, required)
      - `change` (`restoreDatabaseBranch.response.401.report.services.items.change`; string | null, required) — Of one that is refused: what to change. Null otherwise.
    - `app` (`restoreDatabaseBranch.response.401.report.services.app`; object, required) — The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
      - `image` (`restoreDatabaseBranch.response.401.report.services.app.image`; string | null, required) — What the app's next version is made of, with the seven fields after it: its newest version's, with what was changed since. `null`: the app has no image, and no version.
      - `image_pull_secret` (`restoreDatabaseBranch.response.401.report.services.app.image_pull_secret`; string | null, required) — The name of the secret that holds the credentials of the image's registry. No answer has its value. `null`: none.
      - `start_command` (`restoreDatabaseBranch.response.401.report.services.app.start_command`; any of, required)
        - any of: `StartCommand`, `null`
      - `start_args` (`restoreDatabaseBranch.response.401.report.services.app.start_args`; any of, required) — What follows the image's ENTRYPOINT in the place of its CMD. `null`: the image's CMD, or the whole of `start_command`.
        - any of: `array<string>`, `null`
      - `port` (`restoreDatabaseBranch.response.401.report.services.app.port`; integer | null, required)
      - `ready` (`restoreDatabaseBranch.response.401.report.services.app.ready`; object, required) — How to tell that an instance is up, which a version's template is saved after: exactly one of the three. The first two are asked from outside the instance, so the service has to listen on every address (`0.0.0.0`).
        - `http` (`restoreDatabaseBranch.response.401.report.services.app.ready.http`; string, optional) — A path, beginning with `/`: a `GET` of it on the app's port is answered with a status from 200 to 399.
        - `tcp` (`restoreDatabaseBranch.response.401.report.services.app.ready.tcp`; boolean, optional) — The app's port takes a connection.
          - one of `true`
        - `command` (`restoreDatabaseBranch.response.401.report.services.app.ready.command`; one of, optional) — A command that succeeds in the instance. It is run by the instance's shell: a list of arguments is written as one line for it.
          - one of: `string`, `array<string>`
      - `env` (`restoreDatabaseBranch.response.401.report.services.app.env`; map<string>, required)
      - `secrets` (`restoreDatabaseBranch.response.401.report.services.app.secrets`; map<string>, required) — Names of secrets. No answer has a value.
      - `size` (`restoreDatabaseBranch.response.401.report.services.app.size`; object, required) — What one instance may use at most. It is billed by what it uses.
        - `vcpus` (`restoreDatabaseBranch.response.401.report.services.app.size.vcpus`; integer, required)
          - min 1
        - `memory_bytes` (`restoreDatabaseBranch.response.401.report.services.app.size.memory_bytes`; integer, required) — An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400 `invalid_field` (param `size.memory_bytes`): no node would make an instance of it, as none makes a sandbox of it (the node's `SandboxLimitsCreate.memory_bytes`).
          - min 134217728
      - `volumes` (`restoreDatabaseBranch.response.401.report.services.app.volumes`; array<object>, required)
        - `volume` (`restoreDatabaseBranch.response.401.report.services.app.volumes.volume`; string, required)
        - `path` (`restoreDatabaseBranch.response.401.report.services.app.volumes.path`; string, required)
        - `read_only` (`restoreDatabaseBranch.response.401.report.services.app.volumes.read_only`; boolean, required)
        - `nocopy` (`restoreDatabaseBranch.response.401.report.services.app.volumes.nocopy`; unknown, optional) — There only where it was given as `true`.
      - `kind` (`restoreDatabaseBranch.response.401.report.services.app.kind`; string, required)
      - `files` (`restoreDatabaseBranch.response.401.report.services.app.files`; array<object>, required)
        - `path` (`restoreDatabaseBranch.response.401.report.services.app.files.path`; string, required)
        - `mode` (`restoreDatabaseBranch.response.401.report.services.app.files.mode`; integer, required)
        - `uid` (`restoreDatabaseBranch.response.401.report.services.app.files.uid`; integer, required)
        - `gid` (`restoreDatabaseBranch.response.401.report.services.app.files.gid`; integer, required)
        - `content` (`restoreDatabaseBranch.response.401.report.services.app.files.content`; string, optional)
        - `secret` (`restoreDatabaseBranch.response.401.report.services.app.files.secret`; string, optional)
      - `user` (`restoreDatabaseBranch.response.401.report.services.app.user`; string | null, required)
      - `working_dir` (`restoreDatabaseBranch.response.401.report.services.app.working_dir`; string | null, required)
      - `stop` (`restoreDatabaseBranch.response.401.report.services.app.stop`; any of, required)
        - any of: `ServiceStop`, `null`
      - `hostname` (`restoreDatabaseBranch.response.401.report.services.app.hostname`; string | null, required)
      - `regions` (`restoreDatabaseBranch.response.401.report.services.app.regions`; array<string>, required) — In the order na, eu, ap.
      - `scale` (`restoreDatabaseBranch.response.401.report.services.app.scale`; object, required)
        - `min_instances` (`restoreDatabaseBranch.response.401.report.services.app.scale.min_instances`; integer, required) — How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share `max_instances` (two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At most `max_instances`, where that is given, and at most what the account's plan lets an app ask for in a region (`caps.app_instances.limit`: 5, 50 and 500): more is refused, 403 `plan_cap_reached`.
          - min 0
        - `max_instances` (`restoreDatabaseBranch.response.401.report.services.app.scale.max_instances`; integer | null, required) — How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (`caps.app_instances.limit`: 5 on the free plan, 50 on `p20`, 200 on `p100`, 500 on `p300`, 1,000 on `p1000`, 2,000 on `p2000`): more is refused, 403 `plan_cap_reached`, and what an app asked for on a plan that let it is kept, and held to the plan's number. `null`: the plan's number for an app that names none (`caps.app_instances.default`: 2, 10, 20, 50, 100 and 200), or `min_instances` where that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.
          - min 1
        - `concurrency` (`restoreDatabaseBranch.response.401.report.services.app.scale.concurrency`; integer | null, required) — A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more. `null`, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.
          - min 1; max 1000
        - `sleep_after_ms` (`restoreDatabaseBranch.response.401.report.services.app.scale.sleep_after_ms`; integer, required) — After how long without a request an instance stops. One that stays stopped is deleted by its node after `delete_after_ms`, and the next request that needs an instance gets a new one; the instances `min_instances` keeps awake are neither stopped nor deleted.
          - min 0; max 600000
        - `sleep_notice_ms` (`restoreDatabaseBranch.response.401.report.services.app.scale.sleep_notice_ms`; integer | null, required) — How long before an instance stops for being idle the programs connected to its guest's `/run/sbx/awake` are sent the line `sleep N`, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).
          - min 0; max 60000
        - `sleep_hold_max_ms` (`restoreDatabaseBranch.response.401.report.services.app.scale.sleep_hold_max_ms`; integer, required) — How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to `/run/sbx/awake` and sends `+` before it answers a request whose work goes on after the answer, and `-` (or closes the connection, or dies) when that work is done; the instance stops `sleep_after_ms` after the last hold is lowered. Past this time it stops whatever holds it, the programs connected told `sleep N cap` first where `sleep_notice_ms` asks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).
          - min 0; max 900000
        - `delete_after_ms` (`restoreDatabaseBranch.response.401.report.services.app.scale.delete_after_ms`; integer | null, required) — After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400 `invalid_field`), and an instance that is to stay warm is one of `min_instances`. `null`, which is what it is when nothing is said: the hour of the nodes (`--app-delete-after-seconds`). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, which `keys.delete_after_idle_ms` is for.
          - min 1000; max 3600000
        - `suspend_after_ms` (`restoreDatabaseBranch.response.401.report.services.app.scale.suspend_after_ms`; integer | null, optional) — How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's `suspend_after_seconds` is its app's.
          - min 1000; max 86400000
        - `wake_daily_at` (`restoreDatabaseBranch.response.401.report.services.app.scale.wake_daily_at`; string | null, optional) — A time of day in UTC, `HH:MM`, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server's `pg_cron` jobs, whatever this says. Null (the default): none. A database's `wake_daily_at` is its app's.
          - pattern `^([01][0-9]|2[0-3]):[0-5][0-9]$`
      - `keys` (`restoreDatabaseBranch.response.401.report.services.app.keys`; any of, required)
        - any of: `object`, `null`
      - `egress` (`restoreDatabaseBranch.response.401.report.services.app.egress`; object | null, required) — Egress rules as a sandbox has them (`default`, `allow`, `deny`, `http`, `inject`), null when there are none; kept as the calls gave them (a `PATCH` merges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).
        - `default` (`restoreDatabaseBranch.response.401.report.services.app.egress.default`; string | null, optional)
          - one of `"allow"`, `"deny"`, `null`
        - `allow` (`restoreDatabaseBranch.response.401.report.services.app.egress.allow`; array | null, optional)
        - `deny` (`restoreDatabaseBranch.response.401.report.services.app.egress.deny`; array | null, optional)
        - `http` (`restoreDatabaseBranch.response.401.report.services.app.egress.http`; array | null, optional)
        - `inject` (`restoreDatabaseBranch.response.401.report.services.app.egress.inject`; array | null, optional)
        - `deny_ports` (`restoreDatabaseBranch.response.401.report.services.app.egress.deny_ports`; array | null, optional) — Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
      - `metadata` (`restoreDatabaseBranch.response.401.report.services.app.metadata`; map<string>, required)
      - `logs` (`restoreDatabaseBranch.response.401.report.services.app.logs`; object, required) — What the app's log has, each part as it was given or at its default (`AppLogSettings`).
        - `output` (`restoreDatabaseBranch.response.401.report.services.app.logs.output`; boolean, required)
        - `keep` (`restoreDatabaseBranch.response.401.report.services.app.logs.keep`; boolean, required)
        - `requests` (`restoreDatabaseBranch.response.401.report.services.app.logs.requests`; object, required)
          - `sample_rate` (`restoreDatabaseBranch.response.401.report.services.app.logs.requests.sample_rate`; number, required)
            - min 0; max 1
          - `keep_errors` (`restoreDatabaseBranch.response.401.report.services.app.logs.requests.keep_errors`; boolean, required)
      - `public` (`restoreDatabaseBranch.response.401.report.services.app.public`; boolean, required) — Whether it answers at its default domain (`url`).
      - `depends_on` (`restoreDatabaseBranch.response.401.report.services.app.depends_on`; array<object>, required)
        - `service` (`restoreDatabaseBranch.response.401.report.services.app.depends_on.service`; string, required)
        - `condition` (`restoreDatabaseBranch.response.401.report.services.app.depends_on.condition`; string, required)
      - `network` (`restoreDatabaseBranch.response.401.report.services.app.network`; object, required)
        - `aliases` (`restoreDatabaseBranch.response.401.report.services.app.network.aliases`; array<string>, required)
        - `endpoint_mode` (`restoreDatabaseBranch.response.401.report.services.app.network.endpoint_mode`; string, required)
      - `drives` (`restoreDatabaseBranch.response.401.report.services.app.drives`; array<object>, optional) — The Drives its instance mounts (`AppCreate.drives`): none, `[]`, where it names none.
        - `drive` (`restoreDatabaseBranch.response.401.report.services.app.drives.drive`; string, required)
        - `path` (`restoreDatabaseBranch.response.401.report.services.app.drives.path`; string, required)
        - `mode` (`restoreDatabaseBranch.response.401.report.services.app.drives.mode`; string, required)
      - `key_drives` (`restoreDatabaseBranch.response.401.report.services.app.key_drives`; array<object>, optional) — The Drives each key's instance has of its own (`AppCreate.key_drives`): none, `[]`, where it gives none.
        - `name` (`restoreDatabaseBranch.response.401.report.services.app.key_drives.name`; string, required)
        - `path` (`restoreDatabaseBranch.response.401.report.services.app.key_drives.path`; string, required)
        - `size_bytes` (`restoreDatabaseBranch.response.401.report.services.app.key_drives.size_bytes`; integer | null, required)
          - format `int64`
        - `nocopy` (`restoreDatabaseBranch.response.401.report.services.app.key_drives.nocopy`; unknown, optional) — There only where it was given as `true`.
      - `runtime` (`restoreDatabaseBranch.response.401.report.services.app.runtime`; any of, optional) — Its runtime settings (`AppCreate.runtime`). `null`: none.
        - any of: `Runtime`, `null`
      - `traces` (`restoreDatabaseBranch.response.401.report.services.app.traces`; object, optional) — What the app's requests' traces have, each part as it was given or at its default (`AppTraceSettings`): no span where `sample_rate` is 0.
        - `sample_rate` (`restoreDatabaseBranch.response.401.report.services.app.traces.sample_rate`; number, required)
          - min 0; max 1
        - `trust_incoming` (`restoreDatabaseBranch.response.401.report.services.app.traces.trust_incoming`; boolean, required)
  - `volumes` (`restoreDatabaseBranch.response.401.report.volumes`; array<object>, required) — The volumes of the project the services mount.
    - `model` (`restoreDatabaseBranch.response.401.report.volumes.model`; string | null, required) — Its name in the model. Null: made for a path a stateful service mounts with no volume named.
    - `name` (`restoreDatabaseBranch.response.401.report.volumes.name`; string, required) — Its name in the project.
    - `id` (`restoreDatabaseBranch.response.401.report.volumes.id`; string | null, required) — Null: not made yet (`to_make`).
      - pattern `^vol-`
    - `shared` (`restoreDatabaseBranch.response.401.report.volumes.shared`; boolean, required) — Several services mount it, or one with several instances: every instance of each mounts it at once.
    - `status` (`restoreDatabaseBranch.response.401.report.volumes.status`; string, required) — `to_make`: the import makes it (a dry run says so of what it would make); `made`: this import made it; `there`: an earlier import made it, or a volume of its name was there; `external`: the model names it `external`, and the project has it.
      - one of `"to_make"`, `"made"`, `"there"`, `"external"`
    - `used_by` (`restoreDatabaseBranch.response.401.report.volumes.used_by`; array<string>, required)
  - `secrets` (`restoreDatabaseBranch.response.401.report.secrets`; array<object>, required) — The secrets of the model that services are granted.
    - `model` (`restoreDatabaseBranch.response.401.report.secrets.model`; string, required) — Its name in the model.
    - `name` (`restoreDatabaseBranch.response.401.report.secrets.name`; string, required) — The project's secret that holds it: the model's name, with each character a secret's name does not take written as an underscore.
    - `there` (`restoreDatabaseBranch.response.401.report.secrets.there`; boolean, required) — Whether the project has it. An import (not a dry run) with one that is not there is refused 404 `secret_not_found`.
    - `used_by` (`restoreDatabaseBranch.response.401.report.secrets.used_by`; array<string>, required)
  - `left_out` (`restoreDatabaseBranch.response.401.report.left_out`; array<object>, required) — The services of profiles that are not turned on, which the import does not touch.
    - `name` (`restoreDatabaseBranch.response.401.report.left_out.name`; string, required)
    - `profiles` (`restoreDatabaseBranch.response.401.report.left_out.profiles`; array<string>, required)
  - `absent` (`restoreDatabaseBranch.response.401.report.absent`; array<string>, required) — The project's services that the model does not have: kept as they are.
  - `deploy` (`restoreDatabaseBranch.response.401.report.deploy`; string | null, required) — The deploy the import made (`GET /v1/deploys/{id}`). Null: a dry run, or nothing would get a version.
    - pattern `^dpl-`
- `accounts` (`restoreDatabaseBranch.response.401.accounts`; array<object>, optional) — With `sole_owner`: the accounts the user is the only owner of.
  - `id` (`restoreDatabaseBranch.response.401.accounts.id`; string, required)
    - pattern `^acct-[0-9a-hjkmnp-tv-z]{16}$`
  - `name` (`restoreDatabaseBranch.response.401.accounts.name`; string, required)

### 402

`account_in_debt`: the account owes (its balance is below zero), and until it has paid nothing of it can be used: every call of its keys, and of the tokens of its sandboxes, is refused so, but those that read what it owes and pay it; those that list and read the backups of its volumes and make a volume from one (`POST /v1/volumes` with `from_backup`, but while what it stores is being deleted), what one that stopped paying wants most; and, unless the control plane is started with `--debt-allows-delete false`, those that list, read and delete the volumes, snapshots and sandboxes it stores, and delete its backups. Never a new backup. Before the key's scopes are looked at, and whatever the path. The message says how much is owed, since when, when what the account stores is deleted, how to pay, that it can delete what it stores to stop the amount from growing, and that a volume is still made from a backup (`GET /v1/billing`, `debt`).

#### Example

```json
{
  "move_id": "string",
  "upgrade_id": "string",
  "move": {
    "object": "move",
    "id": "string",
    "sandbox_id": "string",
    "project_id": "string",
    "from": {
      "id": "string",
      "name": "string"
    },
    "to": {
      "id": "string",
      "name": "string"
    },
    "epoch": 1,
    "step": "string",
    "why": "string",
    "wake": true,
    "from_store": true,
    "release": {},
    "takeover": {},
    "error": {
      "code": "string",
      "message": "string",
      "status": 0,
      "takeover_refused": {
        "code": "string",
        "message": "string",
        "status": 0
      },
      "image": "string",
      "holder": "string",
      "holder_says": "has"
    },
    "attempts": 0,
    "next_attempt_at": "2019-08-24T14:15:22Z",
    "batch": "string",
    "created_at": "2019-08-24T14:15:22Z",
    "updated_at": "2019-08-24T14:15:22Z",
    "ended_at": "2019-08-24T14:15:22Z"
  },
  "lease_until": "2019-08-24T14:15:22Z",
  "active": {
    "name": "string",
    "url": "string",
    "term": 1
  },
  "allowed_hosts": [
    "string"
  ],
  "problems": [
    {
      "at": "string",
      "message": "string"
    }
  ],
  "report": {
    "object": "compose_import",
    "name": "string",
    "dry_run": true,
    "strict": true,
    "profiles": [
      "string"
    ],
    "treatments": {
      "done": 0,
      "adapted": 0,
      "ignored": 0,
      "refused": 0
    },
    "items": [
      {
        "at": "string",
        "treatment": "done",
        "why": "string",
        "change": "string"
      }
    ],
    "services": [
      {
        "name": "string",
        "app_id": "string",
        "status": "created",
        "kind": "service",
        "stateful": true,
        "version": true,
        "items": [
          {
            "at": "string",
            "treatment": "done",
            "why": "string",
            "change": "string"
          }
        ],
        "app": {
          "image": "string",
          "image_pull_secret": "string",
          "start_command": "string",
          "start_args": [
            "string"
          ],
          "port": 0,
          "ready": {
            "http": "string"
          },
          "env": {
            "property1": "string",
            "property2": "string"
          },
          "secrets": {
            "property1": "string",
            "property2": "string"
          },
          "size": {
            "vcpus": 1,
            "memory_bytes": 134217728
          },
          "volumes": [
            {
              "volume": "string",
              "path": "string",
              "read_only": true,
              "nocopy": true
            }
          ],
          "drives": [
            {
              "drive": "string",
              "path": "string",
              "mode": "string"
            }
          ],
          "key_drives": [
            {
              "name": "string",
              "path": "string",
              "size_bytes": 0,
              "nocopy": true
            }
          ],
          "kind": "string",
          "files": [
            {
              "path": "string",
              "content": "string",
              "secret": "string",
              "mode": 0,
              "uid": 0,
              "gid": 0
            }
          ],
          "user": "string",
          "working_dir": "string",
          "stop": {
            "signal": "string",
            "grace_ms": 0
          },
          "hostname": "string",
          "runtime": {
            "ulimits": {
              "property1": {},
              "property2": {}
            },
            "sysctls": {
              "property1": "string",
              "property2": "string"
            },
            "tmpfs": [
              {}
            ],
            "dns": {
              "servers": [
                null
              ],
              "search": [
                null
              ],
              "options": [
                null
              ]
            },
            "shm_size_bytes": 0
          },
          "regions": [
            "string"
          ],
          "scale": {
            "min_instances": 0,
            "max_instances": 1,
            "concurrency": 1,
            "sleep_after_ms": 600000,
            "sleep_notice_ms": 60000,
            "sleep_hold_max_ms": 900000,
            "suspend_after_ms": 1000,
            "wake_daily_at": "string",
            "delete_after_ms": 1000
          },
          "keys": {
            "from": {
              "header": "string"
            },
            "upgrade_on_deploy": true,
            "delete_after_idle_ms": 1000
          },
          "egress": {
            "default": "allow",
            "allow": [
              "string"
            ],
            "deny": [
              "string"
            ],
            "http": [
              {
                "allow": []
              }
            ],
            "inject": [
              {
                "headers": {}
              }
            ],
            "deny_ports": [
              1
            ]
          },
          "metadata": {
            "property1": "string",
            "property2": "string"
          },
          "logs": {
            "output": true,
            "keep": true,
            "requests": {
              "sample_rate": 1,
              "keep_errors": true
            }
          },
          "traces": {
            "sample_rate": 1,
            "trust_incoming": true
          },
          "public": true,
          "depends_on": [
            {
              "service": "string",
              "condition": "string"
            }
          ],
          "network": {
            "aliases": [
              "string"
            ],
            "endpoint_mode": "string"
          }
        }
      }
    ],
    "volumes": [
      {
        "model": "string",
        "name": "string",
        "id": "string",
        "shared": true,
        "status": "to_make",
        "used_by": [
          "string"
        ]
      }
    ],
    "secrets": [
      {
        "model": "string",
        "name": "string",
        "there": true,
        "used_by": [
          "string"
        ]
      }
    ],
    "left_out": [
      {
        "name": "string",
        "profiles": [
          "string"
        ]
      }
    ],
    "absent": [
      "string"
    ],
    "deploy": "string"
  },
  "accounts": [
    {
      "id": "string",
      "name": "string"
    }
  ],
  "error": {
    "type": "string",
    "code": "string",
    "message": "string",
    "param": "string",
    "retryable": true,
    "request_id": "string",
    "docs_url": "string"
  }
}
```

- `error` (`restoreDatabaseBranch.response.402.error`; object, required)
  - `type` (`restoreDatabaseBranch.response.402.error.type`; string, required)
  - `code` (`restoreDatabaseBranch.response.402.error.code`; string, required)
  - `message` (`restoreDatabaseBranch.response.402.error.message`; string, required)
  - `param` (`restoreDatabaseBranch.response.402.error.param`; string | null, required)
  - `retryable` (`restoreDatabaseBranch.response.402.error.retryable`; boolean, required)
  - `request_id` (`restoreDatabaseBranch.response.402.error.request_id`; string, required)
  - `docs_url` (`restoreDatabaseBranch.response.402.error.docs_url`; string | null, required)
- `move_id` (`restoreDatabaseBranch.response.402.move_id`; string, optional) — With `already_moving`: the move of the sandbox that is under way.
- `upgrade_id` (`restoreDatabaseBranch.response.402.upgrade_id`; string, optional) — With `upgrade_in_progress` (the key's upgrade that is not over), `upgrade_started` (the upgrade that has begun) and `rollback_gone` (the upgrade whose revert is refused): that upgrade.
  - pattern `^upg-[0-9a-hjkmnp-tv-z]{16}$`
- `move` (`restoreDatabaseBranch.response.402.move`; object, optional) — With `move_over`, `move_going_back` and `move_taken_over` (`POST /internal/moves/{id}/cancel`): the move, as it stands.
  - `object` (`restoreDatabaseBranch.response.402.move.object`; string, required)
  - `id` (`restoreDatabaseBranch.response.402.move.id`; string, required)
    - pattern `^mov-[0-9a-hjkmnp-tv-z]{16}$`
  - `sandbox_id` (`restoreDatabaseBranch.response.402.move.sandbox_id`; string, required)
  - `project_id` (`restoreDatabaseBranch.response.402.move.project_id`; string, required)
  - `from` (`restoreDatabaseBranch.response.402.move.from`; object, required)
    - `id` (`restoreDatabaseBranch.response.402.move.from.id`; string, required)
    - `name` (`restoreDatabaseBranch.response.402.move.from.name`; string | null, required) — Its name; null for a node that is off the books since.
  - `to` (`restoreDatabaseBranch.response.402.move.to`; object, required)
    - `id` (`restoreDatabaseBranch.response.402.move.to.id`; string, required)
    - `name` (`restoreDatabaseBranch.response.402.move.to.name`; string | null, required) — Its name; null for a node that is off the books since.
  - `epoch` (`restoreDatabaseBranch.response.402.move.epoch`; integer, required) — The epoch the table held the sandbox at when the move began: the old node releases it at it, the new one takes it over one on, the old one takes it back two on, and from the object store three on.
    - min 1
  - `step` (`restoreDatabaseBranch.response.402.move.step`; string, required) — Where it stands: `releasing` (the old node is asked to release it; the table has it there), `taking_over` (the new node is asked to take it over; the table has it there), `reclaiming` (the new node refused it, and the old one is asked to take it back), `restoring` (the old one kept nothing of it, and takes it over from the object store), `done` (on the new node), `failed` (where it was, or back there, or where a failure no time clears or an operator's cancel found it: `error` says why).
  - `why` (`restoreDatabaseBranch.response.402.move.why`; string, required) — What made it: the operator's move, an evacuation, a recovery.
  - `wake` (`restoreDatabaseBranch.response.402.move.wake`; boolean, required) — Whether the new node wakes it: as the call said, or as it was (it ran) when the move began.
  - `from_store` (`restoreDatabaseBranch.response.402.move.from_store`; boolean, required) — The new node takes it from the object store alone.
  - `release` (`restoreDatabaseBranch.response.402.move.release`; object | null, required) — What the old node's release answered (sandboxd/openapi/openapi.json, `releaseSandbox`), without the release's key; null before it answered.
  - `takeover` (`restoreDatabaseBranch.response.402.move.takeover`; object | null, required) — What the takeover that ended it answered (`takeoverSandbox` of the node's document): where its disk and memory came from (`source`), how long each took (`ms`), `memory`; null before.
  - `error` (`restoreDatabaseBranch.response.402.move.error`; one of, required) — Why it failed, of one that failed (the new node's refusal, where it was taken back to the old node); null, of one that is done; of one under way, what the step it is at was last told where it is asked again.
    - one of: `object`, `null`
  - `attempts` (`restoreDatabaseBranch.response.402.move.attempts`; integer, required) — How many times the step it is at was asked without an answer that settles it.
    - min 0
  - `next_attempt_at` (`restoreDatabaseBranch.response.402.move.next_attempt_at`; string | null, required) — When that step is asked again; null where it is not waiting.
    - format `date-time`
  - `batch` (`restoreDatabaseBranch.response.402.move.batch`; string | null, required) — The evacuation (`evc-…`) or recovery (`rcv-…`) it is of.
  - `created_at` (`restoreDatabaseBranch.response.402.move.created_at`; string, required)
    - format `date-time`
  - `updated_at` (`restoreDatabaseBranch.response.402.move.updated_at`; string, required)
    - format `date-time`
  - `ended_at` (`restoreDatabaseBranch.response.402.move.ended_at`; string | null, required)
    - format `date-time`
- `lease_until` (`restoreDatabaseBranch.response.402.lease_until`; string, optional) — With `lease_held`: until when the node may still hold the lease it was granted last, and the time after it for the node to have seen it run out (`recoverNode` is refused until then).
  - format `date-time`
- `active` (`restoreDatabaseBranch.response.402.active`; object | null, optional) — With `standby`: the active copy, as the standby last read the lease; null while no copy holds it.
  - `name` (`restoreDatabaseBranch.response.402.active.name`; string, required)
  - `url` (`restoreDatabaseBranch.response.402.active.url`; string, required)
  - `term` (`restoreDatabaseBranch.response.402.active.term`; integer, required)
    - min 1
- `allowed_hosts` (`restoreDatabaseBranch.response.402.allowed_hosts`; array | null, optional) — With `secret_host_not_allowed`: the hosts the secret may go to, as the secret has them; null where it was given none (the node's `SecretHosts`).
- `problems` (`restoreDatabaseBranch.response.402.problems`; array<object>, optional) — With `invalid_definition`: every problem of the definition, each where it is and what it is.
  - `at` (`restoreDatabaseBranch.response.402.problems.at`; string, required) — Where in the definition, a dotted path (`services.web.port`); empty for the whole of it.
  - `message` (`restoreDatabaseBranch.response.402.problems.message`; string, required)
- `report` (`restoreDatabaseBranch.response.402.report`; object, optional) — With `compose_refused`: the import's report, which says what is refused, why, and what to change.
  - `object` (`restoreDatabaseBranch.response.402.report.object`; string, required)
    - one of `"compose_import"`
  - `name` (`restoreDatabaseBranch.response.402.report.name`; string | null, required) — The model's `name`: each service's label `compose.project`. Null: it has none.
  - `dry_run` (`restoreDatabaseBranch.response.402.report.dry_run`; boolean, required)
  - `strict` (`restoreDatabaseBranch.response.402.report.strict`; boolean, required)
  - `profiles` (`restoreDatabaseBranch.response.402.report.profiles`; array<string>, required)
  - `treatments` (`restoreDatabaseBranch.response.402.report.treatments`; object, required) — How many items of the report have each treatment.
    - `done` (`restoreDatabaseBranch.response.402.report.treatments.done`; integer, required)
      - min 0
    - `adapted` (`restoreDatabaseBranch.response.402.report.treatments.adapted`; integer, required)
      - min 0
    - `ignored` (`restoreDatabaseBranch.response.402.report.treatments.ignored`; integer, required)
      - min 0
    - `refused` (`restoreDatabaseBranch.response.402.report.treatments.refused`; integer, required)
      - min 0
  - `items` (`restoreDatabaseBranch.response.402.report.items`; array<object>, required) — The model's top-level elements: `name`, each volume, network, config and secret, extensions.
    - `at` (`restoreDatabaseBranch.response.402.report.items.at`; string, required) — Where in the model: of a service, its attribute (`ports[0]`, `depends_on.db`, `environment.KEY`), empty for the service as a whole; of the top level, the element (`volumes.db-data`).
    - `treatment` (`restoreDatabaseBranch.response.402.report.items.treatment`; string, required) — `done`: it means the same on the platform; `adapted`: the platform does the same another way; `ignored`: it matters to a local run alone (refused with `strict`); `refused`: the platform cannot do it, and doing without it would let the program go wrong quietly.
      - one of `"done"`, `"adapted"`, `"ignored"`, `"refused"`
    - `why` (`restoreDatabaseBranch.response.402.report.items.why`; string, required)
    - `change` (`restoreDatabaseBranch.response.402.report.items.change`; string | null, required) — Of one that is refused: what to change. Null otherwise.
  - `services` (`restoreDatabaseBranch.response.402.report.services`; array<object>, required) — The services the import takes, in the model's order.
    - `name` (`restoreDatabaseBranch.response.402.report.services.name`; string, required) — The service's name, which is its app's.
    - `app_id` (`restoreDatabaseBranch.response.402.report.services.app_id`; string | null, required) — Its app. Null: a dry run of a service the project does not have.
      - pattern `^app-`
    - `status` (`restoreDatabaseBranch.response.402.report.services.status`; string, required) — What the import does (or, in a dry run, would do) to its app: makes it, writes what changed, or nothing.
      - one of `"created"`, `"changed"`, `"unchanged"`
    - `kind` (`restoreDatabaseBranch.response.402.report.services.kind`; string, required) — `job`: a service of the model waits for it to complete, and it runs to its end in each deploy that needs it.
      - one of `"service"`, `"job"`
    - `stateful` (`restoreDatabaseBranch.response.402.report.services.stateful`; boolean, required) — It mounts a volume of its own: one instance, which has the volume.
    - `version` (`restoreDatabaseBranch.response.402.report.services.version`; boolean, required) — Whether the import's deploy makes a version of it: what its version would be made of, its references resolved, is not what its current version is.
    - `items` (`restoreDatabaseBranch.response.402.report.services.items`; array<object>, required)
      - `at` (`restoreDatabaseBranch.response.402.report.services.items.at`; string, required) — Where in the model: of a service, its attribute (`ports[0]`, `depends_on.db`, `environment.KEY`), empty for the service as a whole; of the top level, the element (`volumes.db-data`).
      - `treatment` (`restoreDatabaseBranch.response.402.report.services.items.treatment`; string, required) — `done`: it means the same on the platform; `adapted`: the platform does the same another way; `ignored`: it matters to a local run alone (refused with `strict`); `refused`: the platform cannot do it, and doing without it would let the program go wrong quietly.
        - one of `"done"`, `"adapted"`, `"ignored"`, `"refused"`
      - `why` (`restoreDatabaseBranch.response.402.report.services.items.why`; string, required)
      - `change` (`restoreDatabaseBranch.response.402.report.services.items.change`; string | null, required) — Of one that is refused: what to change. Null otherwise.
    - `app` (`restoreDatabaseBranch.response.402.report.services.app`; object, required) — The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
      - `image` (`restoreDatabaseBranch.response.402.report.services.app.image`; string | null, required) — What the app's next version is made of, with the seven fields after it: its newest version's, with what was changed since. `null`: the app has no image, and no version.
      - `image_pull_secret` (`restoreDatabaseBranch.response.402.report.services.app.image_pull_secret`; string | null, required) — The name of the secret that holds the credentials of the image's registry. No answer has its value. `null`: none.
      - `start_command` (`restoreDatabaseBranch.response.402.report.services.app.start_command`; any of, required)
        - any of: `StartCommand`, `null`
      - `start_args` (`restoreDatabaseBranch.response.402.report.services.app.start_args`; any of, required) — What follows the image's ENTRYPOINT in the place of its CMD. `null`: the image's CMD, or the whole of `start_command`.
        - any of: `array<string>`, `null`
      - `port` (`restoreDatabaseBranch.response.402.report.services.app.port`; integer | null, required)
      - `ready` (`restoreDatabaseBranch.response.402.report.services.app.ready`; object, required) — How to tell that an instance is up, which a version's template is saved after: exactly one of the three. The first two are asked from outside the instance, so the service has to listen on every address (`0.0.0.0`).
        - `http` (`restoreDatabaseBranch.response.402.report.services.app.ready.http`; string, optional) — A path, beginning with `/`: a `GET` of it on the app's port is answered with a status from 200 to 399.
        - `tcp` (`restoreDatabaseBranch.response.402.report.services.app.ready.tcp`; boolean, optional) — The app's port takes a connection.
          - one of `true`
        - `command` (`restoreDatabaseBranch.response.402.report.services.app.ready.command`; one of, optional) — A command that succeeds in the instance. It is run by the instance's shell: a list of arguments is written as one line for it.
          - one of: `string`, `array<string>`
      - `env` (`restoreDatabaseBranch.response.402.report.services.app.env`; map<string>, required)
      - `secrets` (`restoreDatabaseBranch.response.402.report.services.app.secrets`; map<string>, required) — Names of secrets. No answer has a value.
      - `size` (`restoreDatabaseBranch.response.402.report.services.app.size`; object, required) — What one instance may use at most. It is billed by what it uses.
        - `vcpus` (`restoreDatabaseBranch.response.402.report.services.app.size.vcpus`; integer, required)
          - min 1
        - `memory_bytes` (`restoreDatabaseBranch.response.402.report.services.app.size.memory_bytes`; integer, required) — An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400 `invalid_field` (param `size.memory_bytes`): no node would make an instance of it, as none makes a sandbox of it (the node's `SandboxLimitsCreate.memory_bytes`).
          - min 134217728
      - `volumes` (`restoreDatabaseBranch.response.402.report.services.app.volumes`; array<object>, required)
        - `volume` (`restoreDatabaseBranch.response.402.report.services.app.volumes.volume`; string, required)
        - `path` (`restoreDatabaseBranch.response.402.report.services.app.volumes.path`; string, required)
        - `read_only` (`restoreDatabaseBranch.response.402.report.services.app.volumes.read_only`; boolean, required)
        - `nocopy` (`restoreDatabaseBranch.response.402.report.services.app.volumes.nocopy`; unknown, optional) — There only where it was given as `true`.
      - `kind` (`restoreDatabaseBranch.response.402.report.services.app.kind`; string, required)
      - `files` (`restoreDatabaseBranch.response.402.report.services.app.files`; array<object>, required)
        - `path` (`restoreDatabaseBranch.response.402.report.services.app.files.path`; string, required)
        - `mode` (`restoreDatabaseBranch.response.402.report.services.app.files.mode`; integer, required)
        - `uid` (`restoreDatabaseBranch.response.402.report.services.app.files.uid`; integer, required)
        - `gid` (`restoreDatabaseBranch.response.402.report.services.app.files.gid`; integer, required)
        - `content` (`restoreDatabaseBranch.response.402.report.services.app.files.content`; string, optional)
        - `secret` (`restoreDatabaseBranch.response.402.report.services.app.files.secret`; string, optional)
      - `user` (`restoreDatabaseBranch.response.402.report.services.app.user`; string | null, required)
      - `working_dir` (`restoreDatabaseBranch.response.402.report.services.app.working_dir`; string | null, required)
      - `stop` (`restoreDatabaseBranch.response.402.report.services.app.stop`; any of, required)
        - any of: `ServiceStop`, `null`
      - `hostname` (`restoreDatabaseBranch.response.402.report.services.app.hostname`; string | null, required)
      - `regions` (`restoreDatabaseBranch.response.402.report.services.app.regions`; array<string>, required) — In the order na, eu, ap.
      - `scale` (`restoreDatabaseBranch.response.402.report.services.app.scale`; object, required)
        - `min_instances` (`restoreDatabaseBranch.response.402.report.services.app.scale.min_instances`; integer, required) — How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share `max_instances` (two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At most `max_instances`, where that is given, and at most what the account's plan lets an app ask for in a region (`caps.app_instances.limit`: 5, 50 and 500): more is refused, 403 `plan_cap_reached`.
          - min 0
        - `max_instances` (`restoreDatabaseBranch.response.402.report.services.app.scale.max_instances`; integer | null, required) — How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (`caps.app_instances.limit`: 5 on the free plan, 50 on `p20`, 200 on `p100`, 500 on `p300`, 1,000 on `p1000`, 2,000 on `p2000`): more is refused, 403 `plan_cap_reached`, and what an app asked for on a plan that let it is kept, and held to the plan's number. `null`: the plan's number for an app that names none (`caps.app_instances.default`: 2, 10, 20, 50, 100 and 200), or `min_instances` where that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.
          - min 1
        - `concurrency` (`restoreDatabaseBranch.response.402.report.services.app.scale.concurrency`; integer | null, required) — A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more. `null`, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.
          - min 1; max 1000
        - `sleep_after_ms` (`restoreDatabaseBranch.response.402.report.services.app.scale.sleep_after_ms`; integer, required) — After how long without a request an instance stops. One that stays stopped is deleted by its node after `delete_after_ms`, and the next request that needs an instance gets a new one; the instances `min_instances` keeps awake are neither stopped nor deleted.
          - min 0; max 600000
        - `sleep_notice_ms` (`restoreDatabaseBranch.response.402.report.services.app.scale.sleep_notice_ms`; integer | null, required) — How long before an instance stops for being idle the programs connected to its guest's `/run/sbx/awake` are sent the line `sleep N`, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).
          - min 0; max 60000
        - `sleep_hold_max_ms` (`restoreDatabaseBranch.response.402.report.services.app.scale.sleep_hold_max_ms`; integer, required) — How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to `/run/sbx/awake` and sends `+` before it answers a request whose work goes on after the answer, and `-` (or closes the connection, or dies) when that work is done; the instance stops `sleep_after_ms` after the last hold is lowered. Past this time it stops whatever holds it, the programs connected told `sleep N cap` first where `sleep_notice_ms` asks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).
          - min 0; max 900000
        - `delete_after_ms` (`restoreDatabaseBranch.response.402.report.services.app.scale.delete_after_ms`; integer | null, required) — After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400 `invalid_field`), and an instance that is to stay warm is one of `min_instances`. `null`, which is what it is when nothing is said: the hour of the nodes (`--app-delete-after-seconds`). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, which `keys.delete_after_idle_ms` is for.
          - min 1000; max 3600000
        - `suspend_after_ms` (`restoreDatabaseBranch.response.402.report.services.app.scale.suspend_after_ms`; integer | null, optional) — How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's `suspend_after_seconds` is its app's.
          - min 1000; max 86400000
        - `wake_daily_at` (`restoreDatabaseBranch.response.402.report.services.app.scale.wake_daily_at`; string | null, optional) — A time of day in UTC, `HH:MM`, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server's `pg_cron` jobs, whatever this says. Null (the default): none. A database's `wake_daily_at` is its app's.
          - pattern `^([01][0-9]|2[0-3]):[0-5][0-9]$`
      - `keys` (`restoreDatabaseBranch.response.402.report.services.app.keys`; any of, required)
        - any of: `object`, `null`
      - `egress` (`restoreDatabaseBranch.response.402.report.services.app.egress`; object | null, required) — Egress rules as a sandbox has them (`default`, `allow`, `deny`, `http`, `inject`), null when there are none; kept as the calls gave them (a `PATCH` merges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).
        - `default` (`restoreDatabaseBranch.response.402.report.services.app.egress.default`; string | null, optional)
          - one of `"allow"`, `"deny"`, `null`
        - `allow` (`restoreDatabaseBranch.response.402.report.services.app.egress.allow`; array | null, optional)
        - `deny` (`restoreDatabaseBranch.response.402.report.services.app.egress.deny`; array | null, optional)
        - `http` (`restoreDatabaseBranch.response.402.report.services.app.egress.http`; array | null, optional)
        - `inject` (`restoreDatabaseBranch.response.402.report.services.app.egress.inject`; array | null, optional)
        - `deny_ports` (`restoreDatabaseBranch.response.402.report.services.app.egress.deny_ports`; array | null, optional) — Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
      - `metadata` (`restoreDatabaseBranch.response.402.report.services.app.metadata`; map<string>, required)
      - `logs` (`restoreDatabaseBranch.response.402.report.services.app.logs`; object, required) — What the app's log has, each part as it was given or at its default (`AppLogSettings`).
        - `output` (`restoreDatabaseBranch.response.402.report.services.app.logs.output`; boolean, required)
        - `keep` (`restoreDatabaseBranch.response.402.report.services.app.logs.keep`; boolean, required)
        - `requests` (`restoreDatabaseBranch.response.402.report.services.app.logs.requests`; object, required)
          - `sample_rate` (`restoreDatabaseBranch.response.402.report.services.app.logs.requests.sample_rate`; number, required)
            - min 0; max 1
          - `keep_errors` (`restoreDatabaseBranch.response.402.report.services.app.logs.requests.keep_errors`; boolean, required)
      - `public` (`restoreDatabaseBranch.response.402.report.services.app.public`; boolean, required) — Whether it answers at its default domain (`url`).
      - `depends_on` (`restoreDatabaseBranch.response.402.report.services.app.depends_on`; array<object>, required)
        - `service` (`restoreDatabaseBranch.response.402.report.services.app.depends_on.service`; string, required)
        - `condition` (`restoreDatabaseBranch.response.402.report.services.app.depends_on.condition`; string, required)
      - `network` (`restoreDatabaseBranch.response.402.report.services.app.network`; object, required)
        - `aliases` (`restoreDatabaseBranch.response.402.report.services.app.network.aliases`; array<string>, required)
        - `endpoint_mode` (`restoreDatabaseBranch.response.402.report.services.app.network.endpoint_mode`; string, required)
      - `drives` (`restoreDatabaseBranch.response.402.report.services.app.drives`; array<object>, optional) — The Drives its instance mounts (`AppCreate.drives`): none, `[]`, where it names none.
        - `drive` (`restoreDatabaseBranch.response.402.report.services.app.drives.drive`; string, required)
        - `path` (`restoreDatabaseBranch.response.402.report.services.app.drives.path`; string, required)
        - `mode` (`restoreDatabaseBranch.response.402.report.services.app.drives.mode`; string, required)
      - `key_drives` (`restoreDatabaseBranch.response.402.report.services.app.key_drives`; array<object>, optional) — The Drives each key's instance has of its own (`AppCreate.key_drives`): none, `[]`, where it gives none.
        - `name` (`restoreDatabaseBranch.response.402.report.services.app.key_drives.name`; string, required)
        - `path` (`restoreDatabaseBranch.response.402.report.services.app.key_drives.path`; string, required)
        - `size_bytes` (`restoreDatabaseBranch.response.402.report.services.app.key_drives.size_bytes`; integer | null, required)
          - format `int64`
        - `nocopy` (`restoreDatabaseBranch.response.402.report.services.app.key_drives.nocopy`; unknown, optional) — There only where it was given as `true`.
      - `runtime` (`restoreDatabaseBranch.response.402.report.services.app.runtime`; any of, optional) — Its runtime settings (`AppCreate.runtime`). `null`: none.
        - any of: `Runtime`, `null`
      - `traces` (`restoreDatabaseBranch.response.402.report.services.app.traces`; object, optional) — What the app's requests' traces have, each part as it was given or at its default (`AppTraceSettings`): no span where `sample_rate` is 0.
        - `sample_rate` (`restoreDatabaseBranch.response.402.report.services.app.traces.sample_rate`; number, required)
          - min 0; max 1
        - `trust_incoming` (`restoreDatabaseBranch.response.402.report.services.app.traces.trust_incoming`; boolean, required)
  - `volumes` (`restoreDatabaseBranch.response.402.report.volumes`; array<object>, required) — The volumes of the project the services mount.
    - `model` (`restoreDatabaseBranch.response.402.report.volumes.model`; string | null, required) — Its name in the model. Null: made for a path a stateful service mounts with no volume named.
    - `name` (`restoreDatabaseBranch.response.402.report.volumes.name`; string, required) — Its name in the project.
    - `id` (`restoreDatabaseBranch.response.402.report.volumes.id`; string | null, required) — Null: not made yet (`to_make`).
      - pattern `^vol-`
    - `shared` (`restoreDatabaseBranch.response.402.report.volumes.shared`; boolean, required) — Several services mount it, or one with several instances: every instance of each mounts it at once.
    - `status` (`restoreDatabaseBranch.response.402.report.volumes.status`; string, required) — `to_make`: the import makes it (a dry run says so of what it would make); `made`: this import made it; `there`: an earlier import made it, or a volume of its name was there; `external`: the model names it `external`, and the project has it.
      - one of `"to_make"`, `"made"`, `"there"`, `"external"`
    - `used_by` (`restoreDatabaseBranch.response.402.report.volumes.used_by`; array<string>, required)
  - `secrets` (`restoreDatabaseBranch.response.402.report.secrets`; array<object>, required) — The secrets of the model that services are granted.
    - `model` (`restoreDatabaseBranch.response.402.report.secrets.model`; string, required) — Its name in the model.
    - `name` (`restoreDatabaseBranch.response.402.report.secrets.name`; string, required) — The project's secret that holds it: the model's name, with each character a secret's name does not take written as an underscore.
    - `there` (`restoreDatabaseBranch.response.402.report.secrets.there`; boolean, required) — Whether the project has it. An import (not a dry run) with one that is not there is refused 404 `secret_not_found`.
    - `used_by` (`restoreDatabaseBranch.response.402.report.secrets.used_by`; array<string>, required)
  - `left_out` (`restoreDatabaseBranch.response.402.report.left_out`; array<object>, required) — The services of profiles that are not turned on, which the import does not touch.
    - `name` (`restoreDatabaseBranch.response.402.report.left_out.name`; string, required)
    - `profiles` (`restoreDatabaseBranch.response.402.report.left_out.profiles`; array<string>, required)
  - `absent` (`restoreDatabaseBranch.response.402.report.absent`; array<string>, required) — The project's services that the model does not have: kept as they are.
  - `deploy` (`restoreDatabaseBranch.response.402.report.deploy`; string | null, required) — The deploy the import made (`GET /v1/deploys/{id}`). Null: a dry run, or nothing would get a version.
    - pattern `^dpl-`
- `accounts` (`restoreDatabaseBranch.response.402.accounts`; array<object>, optional) — With `sole_owner`: the accounts the user is the only owner of.
  - `id` (`restoreDatabaseBranch.response.402.accounts.id`; string, required)
    - pattern `^acct-[0-9a-hjkmnp-tv-z]{16}$`
  - `name` (`restoreDatabaseBranch.response.402.accounts.name`; string, required)

### 403

`key_scope`, `needs_api_key`, `account_held` (as everywhere); the node its app's version on the restored Drive is made on refused it (the database is on its Drive as it was, the restored Drive and the branch of before gone): `account_share_reached`, the account would hold more than its share of that node's data drive; `plan_cap_reached`, `spend_limit_reached`, `balance_used_up`, as for any instance.

#### Example

```json
{
  "move_id": "string",
  "upgrade_id": "string",
  "move": {
    "object": "move",
    "id": "string",
    "sandbox_id": "string",
    "project_id": "string",
    "from": {
      "id": "string",
      "name": "string"
    },
    "to": {
      "id": "string",
      "name": "string"
    },
    "epoch": 1,
    "step": "string",
    "why": "string",
    "wake": true,
    "from_store": true,
    "release": {},
    "takeover": {},
    "error": {
      "code": "string",
      "message": "string",
      "status": 0,
      "takeover_refused": {
        "code": "string",
        "message": "string",
        "status": 0
      },
      "image": "string",
      "holder": "string",
      "holder_says": "has"
    },
    "attempts": 0,
    "next_attempt_at": "2019-08-24T14:15:22Z",
    "batch": "string",
    "created_at": "2019-08-24T14:15:22Z",
    "updated_at": "2019-08-24T14:15:22Z",
    "ended_at": "2019-08-24T14:15:22Z"
  },
  "lease_until": "2019-08-24T14:15:22Z",
  "active": {
    "name": "string",
    "url": "string",
    "term": 1
  },
  "allowed_hosts": [
    "string"
  ],
  "problems": [
    {
      "at": "string",
      "message": "string"
    }
  ],
  "report": {
    "object": "compose_import",
    "name": "string",
    "dry_run": true,
    "strict": true,
    "profiles": [
      "string"
    ],
    "treatments": {
      "done": 0,
      "adapted": 0,
      "ignored": 0,
      "refused": 0
    },
    "items": [
      {
        "at": "string",
        "treatment": "done",
        "why": "string",
        "change": "string"
      }
    ],
    "services": [
      {
        "name": "string",
        "app_id": "string",
        "status": "created",
        "kind": "service",
        "stateful": true,
        "version": true,
        "items": [
          {
            "at": "string",
            "treatment": "done",
            "why": "string",
            "change": "string"
          }
        ],
        "app": {
          "image": "string",
          "image_pull_secret": "string",
          "start_command": "string",
          "start_args": [
            "string"
          ],
          "port": 0,
          "ready": {
            "http": "string"
          },
          "env": {
            "property1": "string",
            "property2": "string"
          },
          "secrets": {
            "property1": "string",
            "property2": "string"
          },
          "size": {
            "vcpus": 1,
            "memory_bytes": 134217728
          },
          "volumes": [
            {
              "volume": "string",
              "path": "string",
              "read_only": true,
              "nocopy": true
            }
          ],
          "drives": [
            {
              "drive": "string",
              "path": "string",
              "mode": "string"
            }
          ],
          "key_drives": [
            {
              "name": "string",
              "path": "string",
              "size_bytes": 0,
              "nocopy": true
            }
          ],
          "kind": "string",
          "files": [
            {
              "path": "string",
              "content": "string",
              "secret": "string",
              "mode": 0,
              "uid": 0,
              "gid": 0
            }
          ],
          "user": "string",
          "working_dir": "string",
          "stop": {
            "signal": "string",
            "grace_ms": 0
          },
          "hostname": "string",
          "runtime": {
            "ulimits": {
              "property1": {},
              "property2": {}
            },
            "sysctls": {
              "property1": "string",
              "property2": "string"
            },
            "tmpfs": [
              {}
            ],
            "dns": {
              "servers": [
                null
              ],
              "search": [
                null
              ],
              "options": [
                null
              ]
            },
            "shm_size_bytes": 0
          },
          "regions": [
            "string"
          ],
          "scale": {
            "min_instances": 0,
            "max_instances": 1,
            "concurrency": 1,
            "sleep_after_ms": 600000,
            "sleep_notice_ms": 60000,
            "sleep_hold_max_ms": 900000,
            "suspend_after_ms": 1000,
            "wake_daily_at": "string",
            "delete_after_ms": 1000
          },
          "keys": {
            "from": {
              "header": "string"
            },
            "upgrade_on_deploy": true,
            "delete_after_idle_ms": 1000
          },
          "egress": {
            "default": "allow",
            "allow": [
              "string"
            ],
            "deny": [
              "string"
            ],
            "http": [
              {
                "allow": []
              }
            ],
            "inject": [
              {
                "headers": {}
              }
            ],
            "deny_ports": [
              1
            ]
          },
          "metadata": {
            "property1": "string",
            "property2": "string"
          },
          "logs": {
            "output": true,
            "keep": true,
            "requests": {
              "sample_rate": 1,
              "keep_errors": true
            }
          },
          "traces": {
            "sample_rate": 1,
            "trust_incoming": true
          },
          "public": true,
          "depends_on": [
            {
              "service": "string",
              "condition": "string"
            }
          ],
          "network": {
            "aliases": [
              "string"
            ],
            "endpoint_mode": "string"
          }
        }
      }
    ],
    "volumes": [
      {
        "model": "string",
        "name": "string",
        "id": "string",
        "shared": true,
        "status": "to_make",
        "used_by": [
          "string"
        ]
      }
    ],
    "secrets": [
      {
        "model": "string",
        "name": "string",
        "there": true,
        "used_by": [
          "string"
        ]
      }
    ],
    "left_out": [
      {
        "name": "string",
        "profiles": [
          "string"
        ]
      }
    ],
    "absent": [
      "string"
    ],
    "deploy": "string"
  },
  "accounts": [
    {
      "id": "string",
      "name": "string"
    }
  ],
  "error": {
    "type": "string",
    "code": "string",
    "message": "string",
    "param": "string",
    "retryable": true,
    "request_id": "string",
    "docs_url": "string"
  }
}
```

- `error` (`restoreDatabaseBranch.response.403.error`; object, required)
  - `type` (`restoreDatabaseBranch.response.403.error.type`; string, required)
  - `code` (`restoreDatabaseBranch.response.403.error.code`; string, required)
  - `message` (`restoreDatabaseBranch.response.403.error.message`; string, required)
  - `param` (`restoreDatabaseBranch.response.403.error.param`; string | null, required)
  - `retryable` (`restoreDatabaseBranch.response.403.error.retryable`; boolean, required)
  - `request_id` (`restoreDatabaseBranch.response.403.error.request_id`; string, required)
  - `docs_url` (`restoreDatabaseBranch.response.403.error.docs_url`; string | null, required)
- `move_id` (`restoreDatabaseBranch.response.403.move_id`; string, optional) — With `already_moving`: the move of the sandbox that is under way.
- `upgrade_id` (`restoreDatabaseBranch.response.403.upgrade_id`; string, optional) — With `upgrade_in_progress` (the key's upgrade that is not over), `upgrade_started` (the upgrade that has begun) and `rollback_gone` (the upgrade whose revert is refused): that upgrade.
  - pattern `^upg-[0-9a-hjkmnp-tv-z]{16}$`
- `move` (`restoreDatabaseBranch.response.403.move`; object, optional) — With `move_over`, `move_going_back` and `move_taken_over` (`POST /internal/moves/{id}/cancel`): the move, as it stands.
  - `object` (`restoreDatabaseBranch.response.403.move.object`; string, required)
  - `id` (`restoreDatabaseBranch.response.403.move.id`; string, required)
    - pattern `^mov-[0-9a-hjkmnp-tv-z]{16}$`
  - `sandbox_id` (`restoreDatabaseBranch.response.403.move.sandbox_id`; string, required)
  - `project_id` (`restoreDatabaseBranch.response.403.move.project_id`; string, required)
  - `from` (`restoreDatabaseBranch.response.403.move.from`; object, required)
    - `id` (`restoreDatabaseBranch.response.403.move.from.id`; string, required)
    - `name` (`restoreDatabaseBranch.response.403.move.from.name`; string | null, required) — Its name; null for a node that is off the books since.
  - `to` (`restoreDatabaseBranch.response.403.move.to`; object, required)
    - `id` (`restoreDatabaseBranch.response.403.move.to.id`; string, required)
    - `name` (`restoreDatabaseBranch.response.403.move.to.name`; string | null, required) — Its name; null for a node that is off the books since.
  - `epoch` (`restoreDatabaseBranch.response.403.move.epoch`; integer, required) — The epoch the table held the sandbox at when the move began: the old node releases it at it, the new one takes it over one on, the old one takes it back two on, and from the object store three on.
    - min 1
  - `step` (`restoreDatabaseBranch.response.403.move.step`; string, required) — Where it stands: `releasing` (the old node is asked to release it; the table has it there), `taking_over` (the new node is asked to take it over; the table has it there), `reclaiming` (the new node refused it, and the old one is asked to take it back), `restoring` (the old one kept nothing of it, and takes it over from the object store), `done` (on the new node), `failed` (where it was, or back there, or where a failure no time clears or an operator's cancel found it: `error` says why).
  - `why` (`restoreDatabaseBranch.response.403.move.why`; string, required) — What made it: the operator's move, an evacuation, a recovery.
  - `wake` (`restoreDatabaseBranch.response.403.move.wake`; boolean, required) — Whether the new node wakes it: as the call said, or as it was (it ran) when the move began.
  - `from_store` (`restoreDatabaseBranch.response.403.move.from_store`; boolean, required) — The new node takes it from the object store alone.
  - `release` (`restoreDatabaseBranch.response.403.move.release`; object | null, required) — What the old node's release answered (sandboxd/openapi/openapi.json, `releaseSandbox`), without the release's key; null before it answered.
  - `takeover` (`restoreDatabaseBranch.response.403.move.takeover`; object | null, required) — What the takeover that ended it answered (`takeoverSandbox` of the node's document): where its disk and memory came from (`source`), how long each took (`ms`), `memory`; null before.
  - `error` (`restoreDatabaseBranch.response.403.move.error`; one of, required) — Why it failed, of one that failed (the new node's refusal, where it was taken back to the old node); null, of one that is done; of one under way, what the step it is at was last told where it is asked again.
    - one of: `object`, `null`
  - `attempts` (`restoreDatabaseBranch.response.403.move.attempts`; integer, required) — How many times the step it is at was asked without an answer that settles it.
    - min 0
  - `next_attempt_at` (`restoreDatabaseBranch.response.403.move.next_attempt_at`; string | null, required) — When that step is asked again; null where it is not waiting.
    - format `date-time`
  - `batch` (`restoreDatabaseBranch.response.403.move.batch`; string | null, required) — The evacuation (`evc-…`) or recovery (`rcv-…`) it is of.
  - `created_at` (`restoreDatabaseBranch.response.403.move.created_at`; string, required)
    - format `date-time`
  - `updated_at` (`restoreDatabaseBranch.response.403.move.updated_at`; string, required)
    - format `date-time`
  - `ended_at` (`restoreDatabaseBranch.response.403.move.ended_at`; string | null, required)
    - format `date-time`
- `lease_until` (`restoreDatabaseBranch.response.403.lease_until`; string, optional) — With `lease_held`: until when the node may still hold the lease it was granted last, and the time after it for the node to have seen it run out (`recoverNode` is refused until then).
  - format `date-time`
- `active` (`restoreDatabaseBranch.response.403.active`; object | null, optional) — With `standby`: the active copy, as the standby last read the lease; null while no copy holds it.
  - `name` (`restoreDatabaseBranch.response.403.active.name`; string, required)
  - `url` (`restoreDatabaseBranch.response.403.active.url`; string, required)
  - `term` (`restoreDatabaseBranch.response.403.active.term`; integer, required)
    - min 1
- `allowed_hosts` (`restoreDatabaseBranch.response.403.allowed_hosts`; array | null, optional) — With `secret_host_not_allowed`: the hosts the secret may go to, as the secret has them; null where it was given none (the node's `SecretHosts`).
- `problems` (`restoreDatabaseBranch.response.403.problems`; array<object>, optional) — With `invalid_definition`: every problem of the definition, each where it is and what it is.
  - `at` (`restoreDatabaseBranch.response.403.problems.at`; string, required) — Where in the definition, a dotted path (`services.web.port`); empty for the whole of it.
  - `message` (`restoreDatabaseBranch.response.403.problems.message`; string, required)
- `report` (`restoreDatabaseBranch.response.403.report`; object, optional) — With `compose_refused`: the import's report, which says what is refused, why, and what to change.
  - `object` (`restoreDatabaseBranch.response.403.report.object`; string, required)
    - one of `"compose_import"`
  - `name` (`restoreDatabaseBranch.response.403.report.name`; string | null, required) — The model's `name`: each service's label `compose.project`. Null: it has none.
  - `dry_run` (`restoreDatabaseBranch.response.403.report.dry_run`; boolean, required)
  - `strict` (`restoreDatabaseBranch.response.403.report.strict`; boolean, required)
  - `profiles` (`restoreDatabaseBranch.response.403.report.profiles`; array<string>, required)
  - `treatments` (`restoreDatabaseBranch.response.403.report.treatments`; object, required) — How many items of the report have each treatment.
    - `done` (`restoreDatabaseBranch.response.403.report.treatments.done`; integer, required)
      - min 0
    - `adapted` (`restoreDatabaseBranch.response.403.report.treatments.adapted`; integer, required)
      - min 0
    - `ignored` (`restoreDatabaseBranch.response.403.report.treatments.ignored`; integer, required)
      - min 0
    - `refused` (`restoreDatabaseBranch.response.403.report.treatments.refused`; integer, required)
      - min 0
  - `items` (`restoreDatabaseBranch.response.403.report.items`; array<object>, required) — The model's top-level elements: `name`, each volume, network, config and secret, extensions.
    - `at` (`restoreDatabaseBranch.response.403.report.items.at`; string, required) — Where in the model: of a service, its attribute (`ports[0]`, `depends_on.db`, `environment.KEY`), empty for the service as a whole; of the top level, the element (`volumes.db-data`).
    - `treatment` (`restoreDatabaseBranch.response.403.report.items.treatment`; string, required) — `done`: it means the same on the platform; `adapted`: the platform does the same another way; `ignored`: it matters to a local run alone (refused with `strict`); `refused`: the platform cannot do it, and doing without it would let the program go wrong quietly.
      - one of `"done"`, `"adapted"`, `"ignored"`, `"refused"`
    - `why` (`restoreDatabaseBranch.response.403.report.items.why`; string, required)
    - `change` (`restoreDatabaseBranch.response.403.report.items.change`; string | null, required) — Of one that is refused: what to change. Null otherwise.
  - `services` (`restoreDatabaseBranch.response.403.report.services`; array<object>, required) — The services the import takes, in the model's order.
    - `name` (`restoreDatabaseBranch.response.403.report.services.name`; string, required) — The service's name, which is its app's.
    - `app_id` (`restoreDatabaseBranch.response.403.report.services.app_id`; string | null, required) — Its app. Null: a dry run of a service the project does not have.
      - pattern `^app-`
    - `status` (`restoreDatabaseBranch.response.403.report.services.status`; string, required) — What the import does (or, in a dry run, would do) to its app: makes it, writes what changed, or nothing.
      - one of `"created"`, `"changed"`, `"unchanged"`
    - `kind` (`restoreDatabaseBranch.response.403.report.services.kind`; string, required) — `job`: a service of the model waits for it to complete, and it runs to its end in each deploy that needs it.
      - one of `"service"`, `"job"`
    - `stateful` (`restoreDatabaseBranch.response.403.report.services.stateful`; boolean, required) — It mounts a volume of its own: one instance, which has the volume.
    - `version` (`restoreDatabaseBranch.response.403.report.services.version`; boolean, required) — Whether the import's deploy makes a version of it: what its version would be made of, its references resolved, is not what its current version is.
    - `items` (`restoreDatabaseBranch.response.403.report.services.items`; array<object>, required)
      - `at` (`restoreDatabaseBranch.response.403.report.services.items.at`; string, required) — Where in the model: of a service, its attribute (`ports[0]`, `depends_on.db`, `environment.KEY`), empty for the service as a whole; of the top level, the element (`volumes.db-data`).
      - `treatment` (`restoreDatabaseBranch.response.403.report.services.items.treatment`; string, required) — `done`: it means the same on the platform; `adapted`: the platform does the same another way; `ignored`: it matters to a local run alone (refused with `strict`); `refused`: the platform cannot do it, and doing without it would let the program go wrong quietly.
        - one of `"done"`, `"adapted"`, `"ignored"`, `"refused"`
      - `why` (`restoreDatabaseBranch.response.403.report.services.items.why`; string, required)
      - `change` (`restoreDatabaseBranch.response.403.report.services.items.change`; string | null, required) — Of one that is refused: what to change. Null otherwise.
    - `app` (`restoreDatabaseBranch.response.403.report.services.app`; object, required) — The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
      - `image` (`restoreDatabaseBranch.response.403.report.services.app.image`; string | null, required) — What the app's next version is made of, with the seven fields after it: its newest version's, with what was changed since. `null`: the app has no image, and no version.
      - `image_pull_secret` (`restoreDatabaseBranch.response.403.report.services.app.image_pull_secret`; string | null, required) — The name of the secret that holds the credentials of the image's registry. No answer has its value. `null`: none.
      - `start_command` (`restoreDatabaseBranch.response.403.report.services.app.start_command`; any of, required)
        - any of: `StartCommand`, `null`
      - `start_args` (`restoreDatabaseBranch.response.403.report.services.app.start_args`; any of, required) — What follows the image's ENTRYPOINT in the place of its CMD. `null`: the image's CMD, or the whole of `start_command`.
        - any of: `array<string>`, `null`
      - `port` (`restoreDatabaseBranch.response.403.report.services.app.port`; integer | null, required)
      - `ready` (`restoreDatabaseBranch.response.403.report.services.app.ready`; object, required) — How to tell that an instance is up, which a version's template is saved after: exactly one of the three. The first two are asked from outside the instance, so the service has to listen on every address (`0.0.0.0`).
        - `http` (`restoreDatabaseBranch.response.403.report.services.app.ready.http`; string, optional) — A path, beginning with `/`: a `GET` of it on the app's port is answered with a status from 200 to 399.
        - `tcp` (`restoreDatabaseBranch.response.403.report.services.app.ready.tcp`; boolean, optional) — The app's port takes a connection.
          - one of `true`
        - `command` (`restoreDatabaseBranch.response.403.report.services.app.ready.command`; one of, optional) — A command that succeeds in the instance. It is run by the instance's shell: a list of arguments is written as one line for it.
          - one of: `string`, `array<string>`
      - `env` (`restoreDatabaseBranch.response.403.report.services.app.env`; map<string>, required)
      - `secrets` (`restoreDatabaseBranch.response.403.report.services.app.secrets`; map<string>, required) — Names of secrets. No answer has a value.
      - `size` (`restoreDatabaseBranch.response.403.report.services.app.size`; object, required) — What one instance may use at most. It is billed by what it uses.
        - `vcpus` (`restoreDatabaseBranch.response.403.report.services.app.size.vcpus`; integer, required)
          - min 1
        - `memory_bytes` (`restoreDatabaseBranch.response.403.report.services.app.size.memory_bytes`; integer, required) — An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400 `invalid_field` (param `size.memory_bytes`): no node would make an instance of it, as none makes a sandbox of it (the node's `SandboxLimitsCreate.memory_bytes`).
          - min 134217728
      - `volumes` (`restoreDatabaseBranch.response.403.report.services.app.volumes`; array<object>, required)
        - `volume` (`restoreDatabaseBranch.response.403.report.services.app.volumes.volume`; string, required)
        - `path` (`restoreDatabaseBranch.response.403.report.services.app.volumes.path`; string, required)
        - `read_only` (`restoreDatabaseBranch.response.403.report.services.app.volumes.read_only`; boolean, required)
        - `nocopy` (`restoreDatabaseBranch.response.403.report.services.app.volumes.nocopy`; unknown, optional) — There only where it was given as `true`.
      - `kind` (`restoreDatabaseBranch.response.403.report.services.app.kind`; string, required)
      - `files` (`restoreDatabaseBranch.response.403.report.services.app.files`; array<object>, required)
        - `path` (`restoreDatabaseBranch.response.403.report.services.app.files.path`; string, required)
        - `mode` (`restoreDatabaseBranch.response.403.report.services.app.files.mode`; integer, required)
        - `uid` (`restoreDatabaseBranch.response.403.report.services.app.files.uid`; integer, required)
        - `gid` (`restoreDatabaseBranch.response.403.report.services.app.files.gid`; integer, required)
        - `content` (`restoreDatabaseBranch.response.403.report.services.app.files.content`; string, optional)
        - `secret` (`restoreDatabaseBranch.response.403.report.services.app.files.secret`; string, optional)
      - `user` (`restoreDatabaseBranch.response.403.report.services.app.user`; string | null, required)
      - `working_dir` (`restoreDatabaseBranch.response.403.report.services.app.working_dir`; string | null, required)
      - `stop` (`restoreDatabaseBranch.response.403.report.services.app.stop`; any of, required)
        - any of: `ServiceStop`, `null`
      - `hostname` (`restoreDatabaseBranch.response.403.report.services.app.hostname`; string | null, required)
      - `regions` (`restoreDatabaseBranch.response.403.report.services.app.regions`; array<string>, required) — In the order na, eu, ap.
      - `scale` (`restoreDatabaseBranch.response.403.report.services.app.scale`; object, required)
        - `min_instances` (`restoreDatabaseBranch.response.403.report.services.app.scale.min_instances`; integer, required) — How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share `max_instances` (two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At most `max_instances`, where that is given, and at most what the account's plan lets an app ask for in a region (`caps.app_instances.limit`: 5, 50 and 500): more is refused, 403 `plan_cap_reached`.
          - min 0
        - `max_instances` (`restoreDatabaseBranch.response.403.report.services.app.scale.max_instances`; integer | null, required) — How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (`caps.app_instances.limit`: 5 on the free plan, 50 on `p20`, 200 on `p100`, 500 on `p300`, 1,000 on `p1000`, 2,000 on `p2000`): more is refused, 403 `plan_cap_reached`, and what an app asked for on a plan that let it is kept, and held to the plan's number. `null`: the plan's number for an app that names none (`caps.app_instances.default`: 2, 10, 20, 50, 100 and 200), or `min_instances` where that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.
          - min 1
        - `concurrency` (`restoreDatabaseBranch.response.403.report.services.app.scale.concurrency`; integer | null, required) — A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more. `null`, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.
          - min 1; max 1000
        - `sleep_after_ms` (`restoreDatabaseBranch.response.403.report.services.app.scale.sleep_after_ms`; integer, required) — After how long without a request an instance stops. One that stays stopped is deleted by its node after `delete_after_ms`, and the next request that needs an instance gets a new one; the instances `min_instances` keeps awake are neither stopped nor deleted.
          - min 0; max 600000
        - `sleep_notice_ms` (`restoreDatabaseBranch.response.403.report.services.app.scale.sleep_notice_ms`; integer | null, required) — How long before an instance stops for being idle the programs connected to its guest's `/run/sbx/awake` are sent the line `sleep N`, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).
          - min 0; max 60000
        - `sleep_hold_max_ms` (`restoreDatabaseBranch.response.403.report.services.app.scale.sleep_hold_max_ms`; integer, required) — How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to `/run/sbx/awake` and sends `+` before it answers a request whose work goes on after the answer, and `-` (or closes the connection, or dies) when that work is done; the instance stops `sleep_after_ms` after the last hold is lowered. Past this time it stops whatever holds it, the programs connected told `sleep N cap` first where `sleep_notice_ms` asks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).
          - min 0; max 900000
        - `delete_after_ms` (`restoreDatabaseBranch.response.403.report.services.app.scale.delete_after_ms`; integer | null, required) — After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400 `invalid_field`), and an instance that is to stay warm is one of `min_instances`. `null`, which is what it is when nothing is said: the hour of the nodes (`--app-delete-after-seconds`). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, which `keys.delete_after_idle_ms` is for.
          - min 1000; max 3600000
        - `suspend_after_ms` (`restoreDatabaseBranch.response.403.report.services.app.scale.suspend_after_ms`; integer | null, optional) — How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's `suspend_after_seconds` is its app's.
          - min 1000; max 86400000
        - `wake_daily_at` (`restoreDatabaseBranch.response.403.report.services.app.scale.wake_daily_at`; string | null, optional) — A time of day in UTC, `HH:MM`, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server's `pg_cron` jobs, whatever this says. Null (the default): none. A database's `wake_daily_at` is its app's.
          - pattern `^([01][0-9]|2[0-3]):[0-5][0-9]$`
      - `keys` (`restoreDatabaseBranch.response.403.report.services.app.keys`; any of, required)
        - any of: `object`, `null`
      - `egress` (`restoreDatabaseBranch.response.403.report.services.app.egress`; object | null, required) — Egress rules as a sandbox has them (`default`, `allow`, `deny`, `http`, `inject`), null when there are none; kept as the calls gave them (a `PATCH` merges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).
        - `default` (`restoreDatabaseBranch.response.403.report.services.app.egress.default`; string | null, optional)
          - one of `"allow"`, `"deny"`, `null`
        - `allow` (`restoreDatabaseBranch.response.403.report.services.app.egress.allow`; array | null, optional)
        - `deny` (`restoreDatabaseBranch.response.403.report.services.app.egress.deny`; array | null, optional)
        - `http` (`restoreDatabaseBranch.response.403.report.services.app.egress.http`; array | null, optional)
        - `inject` (`restoreDatabaseBranch.response.403.report.services.app.egress.inject`; array | null, optional)
        - `deny_ports` (`restoreDatabaseBranch.response.403.report.services.app.egress.deny_ports`; array | null, optional) — Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
      - `metadata` (`restoreDatabaseBranch.response.403.report.services.app.metadata`; map<string>, required)
      - `logs` (`restoreDatabaseBranch.response.403.report.services.app.logs`; object, required) — What the app's log has, each part as it was given or at its default (`AppLogSettings`).
        - `output` (`restoreDatabaseBranch.response.403.report.services.app.logs.output`; boolean, required)
        - `keep` (`restoreDatabaseBranch.response.403.report.services.app.logs.keep`; boolean, required)
        - `requests` (`restoreDatabaseBranch.response.403.report.services.app.logs.requests`; object, required)
          - `sample_rate` (`restoreDatabaseBranch.response.403.report.services.app.logs.requests.sample_rate`; number, required)
            - min 0; max 1
          - `keep_errors` (`restoreDatabaseBranch.response.403.report.services.app.logs.requests.keep_errors`; boolean, required)
      - `public` (`restoreDatabaseBranch.response.403.report.services.app.public`; boolean, required) — Whether it answers at its default domain (`url`).
      - `depends_on` (`restoreDatabaseBranch.response.403.report.services.app.depends_on`; array<object>, required)
        - `service` (`restoreDatabaseBranch.response.403.report.services.app.depends_on.service`; string, required)
        - `condition` (`restoreDatabaseBranch.response.403.report.services.app.depends_on.condition`; string, required)
      - `network` (`restoreDatabaseBranch.response.403.report.services.app.network`; object, required)
        - `aliases` (`restoreDatabaseBranch.response.403.report.services.app.network.aliases`; array<string>, required)
        - `endpoint_mode` (`restoreDatabaseBranch.response.403.report.services.app.network.endpoint_mode`; string, required)
      - `drives` (`restoreDatabaseBranch.response.403.report.services.app.drives`; array<object>, optional) — The Drives its instance mounts (`AppCreate.drives`): none, `[]`, where it names none.
        - `drive` (`restoreDatabaseBranch.response.403.report.services.app.drives.drive`; string, required)
        - `path` (`restoreDatabaseBranch.response.403.report.services.app.drives.path`; string, required)
        - `mode` (`restoreDatabaseBranch.response.403.report.services.app.drives.mode`; string, required)
      - `key_drives` (`restoreDatabaseBranch.response.403.report.services.app.key_drives`; array<object>, optional) — The Drives each key's instance has of its own (`AppCreate.key_drives`): none, `[]`, where it gives none.
        - `name` (`restoreDatabaseBranch.response.403.report.services.app.key_drives.name`; string, required)
        - `path` (`restoreDatabaseBranch.response.403.report.services.app.key_drives.path`; string, required)
        - `size_bytes` (`restoreDatabaseBranch.response.403.report.services.app.key_drives.size_bytes`; integer | null, required)
          - format `int64`
        - `nocopy` (`restoreDatabaseBranch.response.403.report.services.app.key_drives.nocopy`; unknown, optional) — There only where it was given as `true`.
      - `runtime` (`restoreDatabaseBranch.response.403.report.services.app.runtime`; any of, optional) — Its runtime settings (`AppCreate.runtime`). `null`: none.
        - any of: `Runtime`, `null`
      - `traces` (`restoreDatabaseBranch.response.403.report.services.app.traces`; object, optional) — What the app's requests' traces have, each part as it was given or at its default (`AppTraceSettings`): no span where `sample_rate` is 0.
        - `sample_rate` (`restoreDatabaseBranch.response.403.report.services.app.traces.sample_rate`; number, required)
          - min 0; max 1
        - `trust_incoming` (`restoreDatabaseBranch.response.403.report.services.app.traces.trust_incoming`; boolean, required)
  - `volumes` (`restoreDatabaseBranch.response.403.report.volumes`; array<object>, required) — The volumes of the project the services mount.
    - `model` (`restoreDatabaseBranch.response.403.report.volumes.model`; string | null, required) — Its name in the model. Null: made for a path a stateful service mounts with no volume named.
    - `name` (`restoreDatabaseBranch.response.403.report.volumes.name`; string, required) — Its name in the project.
    - `id` (`restoreDatabaseBranch.response.403.report.volumes.id`; string | null, required) — Null: not made yet (`to_make`).
      - pattern `^vol-`
    - `shared` (`restoreDatabaseBranch.response.403.report.volumes.shared`; boolean, required) — Several services mount it, or one with several instances: every instance of each mounts it at once.
    - `status` (`restoreDatabaseBranch.response.403.report.volumes.status`; string, required) — `to_make`: the import makes it (a dry run says so of what it would make); `made`: this import made it; `there`: an earlier import made it, or a volume of its name was there; `external`: the model names it `external`, and the project has it.
      - one of `"to_make"`, `"made"`, `"there"`, `"external"`
    - `used_by` (`restoreDatabaseBranch.response.403.report.volumes.used_by`; array<string>, required)
  - `secrets` (`restoreDatabaseBranch.response.403.report.secrets`; array<object>, required) — The secrets of the model that services are granted.
    - `model` (`restoreDatabaseBranch.response.403.report.secrets.model`; string, required) — Its name in the model.
    - `name` (`restoreDatabaseBranch.response.403.report.secrets.name`; string, required) — The project's secret that holds it: the model's name, with each character a secret's name does not take written as an underscore.
    - `there` (`restoreDatabaseBranch.response.403.report.secrets.there`; boolean, required) — Whether the project has it. An import (not a dry run) with one that is not there is refused 404 `secret_not_found`.
    - `used_by` (`restoreDatabaseBranch.response.403.report.secrets.used_by`; array<string>, required)
  - `left_out` (`restoreDatabaseBranch.response.403.report.left_out`; array<object>, required) — The services of profiles that are not turned on, which the import does not touch.
    - `name` (`restoreDatabaseBranch.response.403.report.left_out.name`; string, required)
    - `profiles` (`restoreDatabaseBranch.response.403.report.left_out.profiles`; array<string>, required)
  - `absent` (`restoreDatabaseBranch.response.403.report.absent`; array<string>, required) — The project's services that the model does not have: kept as they are.
  - `deploy` (`restoreDatabaseBranch.response.403.report.deploy`; string | null, required) — The deploy the import made (`GET /v1/deploys/{id}`). Null: a dry run, or nothing would get a version.
    - pattern `^dpl-`
- `accounts` (`restoreDatabaseBranch.response.403.accounts`; array<object>, optional) — With `sole_owner`: the accounts the user is the only owner of.
  - `id` (`restoreDatabaseBranch.response.403.accounts.id`; string, required)
    - pattern `^acct-[0-9a-hjkmnp-tv-z]{16}$`
  - `name` (`restoreDatabaseBranch.response.403.accounts.name`; string, required)

### 404

`database_not_found`; `branch_not_found`: the database has no such branch.

#### Example

```json
{
  "move_id": "string",
  "upgrade_id": "string",
  "move": {
    "object": "move",
    "id": "string",
    "sandbox_id": "string",
    "project_id": "string",
    "from": {
      "id": "string",
      "name": "string"
    },
    "to": {
      "id": "string",
      "name": "string"
    },
    "epoch": 1,
    "step": "string",
    "why": "string",
    "wake": true,
    "from_store": true,
    "release": {},
    "takeover": {},
    "error": {
      "code": "string",
      "message": "string",
      "status": 0,
      "takeover_refused": {
        "code": "string",
        "message": "string",
        "status": 0
      },
      "image": "string",
      "holder": "string",
      "holder_says": "has"
    },
    "attempts": 0,
    "next_attempt_at": "2019-08-24T14:15:22Z",
    "batch": "string",
    "created_at": "2019-08-24T14:15:22Z",
    "updated_at": "2019-08-24T14:15:22Z",
    "ended_at": "2019-08-24T14:15:22Z"
  },
  "lease_until": "2019-08-24T14:15:22Z",
  "active": {
    "name": "string",
    "url": "string",
    "term": 1
  },
  "allowed_hosts": [
    "string"
  ],
  "problems": [
    {
      "at": "string",
      "message": "string"
    }
  ],
  "report": {
    "object": "compose_import",
    "name": "string",
    "dry_run": true,
    "strict": true,
    "profiles": [
      "string"
    ],
    "treatments": {
      "done": 0,
      "adapted": 0,
      "ignored": 0,
      "refused": 0
    },
    "items": [
      {
        "at": "string",
        "treatment": "done",
        "why": "string",
        "change": "string"
      }
    ],
    "services": [
      {
        "name": "string",
        "app_id": "string",
        "status": "created",
        "kind": "service",
        "stateful": true,
        "version": true,
        "items": [
          {
            "at": "string",
            "treatment": "done",
            "why": "string",
            "change": "string"
          }
        ],
        "app": {
          "image": "string",
          "image_pull_secret": "string",
          "start_command": "string",
          "start_args": [
            "string"
          ],
          "port": 0,
          "ready": {
            "http": "string"
          },
          "env": {
            "property1": "string",
            "property2": "string"
          },
          "secrets": {
            "property1": "string",
            "property2": "string"
          },
          "size": {
            "vcpus": 1,
            "memory_bytes": 134217728
          },
          "volumes": [
            {
              "volume": "string",
              "path": "string",
              "read_only": true,
              "nocopy": true
            }
          ],
          "drives": [
            {
              "drive": "string",
              "path": "string",
              "mode": "string"
            }
          ],
          "key_drives": [
            {
              "name": "string",
              "path": "string",
              "size_bytes": 0,
              "nocopy": true
            }
          ],
          "kind": "string",
          "files": [
            {
              "path": "string",
              "content": "string",
              "secret": "string",
              "mode": 0,
              "uid": 0,
              "gid": 0
            }
          ],
          "user": "string",
          "working_dir": "string",
          "stop": {
            "signal": "string",
            "grace_ms": 0
          },
          "hostname": "string",
          "runtime": {
            "ulimits": {
              "property1": {},
              "property2": {}
            },
            "sysctls": {
              "property1": "string",
              "property2": "string"
            },
            "tmpfs": [
              {}
            ],
            "dns": {
              "servers": [
                null
              ],
              "search": [
                null
              ],
              "options": [
                null
              ]
            },
            "shm_size_bytes": 0
          },
          "regions": [
            "string"
          ],
          "scale": {
            "min_instances": 0,
            "max_instances": 1,
            "concurrency": 1,
            "sleep_after_ms": 600000,
            "sleep_notice_ms": 60000,
            "sleep_hold_max_ms": 900000,
            "suspend_after_ms": 1000,
            "wake_daily_at": "string",
            "delete_after_ms": 1000
          },
          "keys": {
            "from": {
              "header": "string"
            },
            "upgrade_on_deploy": true,
            "delete_after_idle_ms": 1000
          },
          "egress": {
            "default": "allow",
            "allow": [
              "string"
            ],
            "deny": [
              "string"
            ],
            "http": [
              {
                "allow": []
              }
            ],
            "inject": [
              {
                "headers": {}
              }
            ],
            "deny_ports": [
              1
            ]
          },
          "metadata": {
            "property1": "string",
            "property2": "string"
          },
          "logs": {
            "output": true,
            "keep": true,
            "requests": {
              "sample_rate": 1,
              "keep_errors": true
            }
          },
          "traces": {
            "sample_rate": 1,
            "trust_incoming": true
          },
          "public": true,
          "depends_on": [
            {
              "service": "string",
              "condition": "string"
            }
          ],
          "network": {
            "aliases": [
              "string"
            ],
            "endpoint_mode": "string"
          }
        }
      }
    ],
    "volumes": [
      {
        "model": "string",
        "name": "string",
        "id": "string",
        "shared": true,
        "status": "to_make",
        "used_by": [
          "string"
        ]
      }
    ],
    "secrets": [
      {
        "model": "string",
        "name": "string",
        "there": true,
        "used_by": [
          "string"
        ]
      }
    ],
    "left_out": [
      {
        "name": "string",
        "profiles": [
          "string"
        ]
      }
    ],
    "absent": [
      "string"
    ],
    "deploy": "string"
  },
  "accounts": [
    {
      "id": "string",
      "name": "string"
    }
  ],
  "error": {
    "type": "string",
    "code": "string",
    "message": "string",
    "param": "string",
    "retryable": true,
    "request_id": "string",
    "docs_url": "string"
  }
}
```

- `error` (`restoreDatabaseBranch.response.404.error`; object, required)
  - `type` (`restoreDatabaseBranch.response.404.error.type`; string, required)
  - `code` (`restoreDatabaseBranch.response.404.error.code`; string, required)
  - `message` (`restoreDatabaseBranch.response.404.error.message`; string, required)
  - `param` (`restoreDatabaseBranch.response.404.error.param`; string | null, required)
  - `retryable` (`restoreDatabaseBranch.response.404.error.retryable`; boolean, required)
  - `request_id` (`restoreDatabaseBranch.response.404.error.request_id`; string, required)
  - `docs_url` (`restoreDatabaseBranch.response.404.error.docs_url`; string | null, required)
- `move_id` (`restoreDatabaseBranch.response.404.move_id`; string, optional) — With `already_moving`: the move of the sandbox that is under way.
- `upgrade_id` (`restoreDatabaseBranch.response.404.upgrade_id`; string, optional) — With `upgrade_in_progress` (the key's upgrade that is not over), `upgrade_started` (the upgrade that has begun) and `rollback_gone` (the upgrade whose revert is refused): that upgrade.
  - pattern `^upg-[0-9a-hjkmnp-tv-z]{16}$`
- `move` (`restoreDatabaseBranch.response.404.move`; object, optional) — With `move_over`, `move_going_back` and `move_taken_over` (`POST /internal/moves/{id}/cancel`): the move, as it stands.
  - `object` (`restoreDatabaseBranch.response.404.move.object`; string, required)
  - `id` (`restoreDatabaseBranch.response.404.move.id`; string, required)
    - pattern `^mov-[0-9a-hjkmnp-tv-z]{16}$`
  - `sandbox_id` (`restoreDatabaseBranch.response.404.move.sandbox_id`; string, required)
  - `project_id` (`restoreDatabaseBranch.response.404.move.project_id`; string, required)
  - `from` (`restoreDatabaseBranch.response.404.move.from`; object, required)
    - `id` (`restoreDatabaseBranch.response.404.move.from.id`; string, required)
    - `name` (`restoreDatabaseBranch.response.404.move.from.name`; string | null, required) — Its name; null for a node that is off the books since.
  - `to` (`restoreDatabaseBranch.response.404.move.to`; object, required)
    - `id` (`restoreDatabaseBranch.response.404.move.to.id`; string, required)
    - `name` (`restoreDatabaseBranch.response.404.move.to.name`; string | null, required) — Its name; null for a node that is off the books since.
  - `epoch` (`restoreDatabaseBranch.response.404.move.epoch`; integer, required) — The epoch the table held the sandbox at when the move began: the old node releases it at it, the new one takes it over one on, the old one takes it back two on, and from the object store three on.
    - min 1
  - `step` (`restoreDatabaseBranch.response.404.move.step`; string, required) — Where it stands: `releasing` (the old node is asked to release it; the table has it there), `taking_over` (the new node is asked to take it over; the table has it there), `reclaiming` (the new node refused it, and the old one is asked to take it back), `restoring` (the old one kept nothing of it, and takes it over from the object store), `done` (on the new node), `failed` (where it was, or back there, or where a failure no time clears or an operator's cancel found it: `error` says why).
  - `why` (`restoreDatabaseBranch.response.404.move.why`; string, required) — What made it: the operator's move, an evacuation, a recovery.
  - `wake` (`restoreDatabaseBranch.response.404.move.wake`; boolean, required) — Whether the new node wakes it: as the call said, or as it was (it ran) when the move began.
  - `from_store` (`restoreDatabaseBranch.response.404.move.from_store`; boolean, required) — The new node takes it from the object store alone.
  - `release` (`restoreDatabaseBranch.response.404.move.release`; object | null, required) — What the old node's release answered (sandboxd/openapi/openapi.json, `releaseSandbox`), without the release's key; null before it answered.
  - `takeover` (`restoreDatabaseBranch.response.404.move.takeover`; object | null, required) — What the takeover that ended it answered (`takeoverSandbox` of the node's document): where its disk and memory came from (`source`), how long each took (`ms`), `memory`; null before.
  - `error` (`restoreDatabaseBranch.response.404.move.error`; one of, required) — Why it failed, of one that failed (the new node's refusal, where it was taken back to the old node); null, of one that is done; of one under way, what the step it is at was last told where it is asked again.
    - one of: `object`, `null`
  - `attempts` (`restoreDatabaseBranch.response.404.move.attempts`; integer, required) — How many times the step it is at was asked without an answer that settles it.
    - min 0
  - `next_attempt_at` (`restoreDatabaseBranch.response.404.move.next_attempt_at`; string | null, required) — When that step is asked again; null where it is not waiting.
    - format `date-time`
  - `batch` (`restoreDatabaseBranch.response.404.move.batch`; string | null, required) — The evacuation (`evc-…`) or recovery (`rcv-…`) it is of.
  - `created_at` (`restoreDatabaseBranch.response.404.move.created_at`; string, required)
    - format `date-time`
  - `updated_at` (`restoreDatabaseBranch.response.404.move.updated_at`; string, required)
    - format `date-time`
  - `ended_at` (`restoreDatabaseBranch.response.404.move.ended_at`; string | null, required)
    - format `date-time`
- `lease_until` (`restoreDatabaseBranch.response.404.lease_until`; string, optional) — With `lease_held`: until when the node may still hold the lease it was granted last, and the time after it for the node to have seen it run out (`recoverNode` is refused until then).
  - format `date-time`
- `active` (`restoreDatabaseBranch.response.404.active`; object | null, optional) — With `standby`: the active copy, as the standby last read the lease; null while no copy holds it.
  - `name` (`restoreDatabaseBranch.response.404.active.name`; string, required)
  - `url` (`restoreDatabaseBranch.response.404.active.url`; string, required)
  - `term` (`restoreDatabaseBranch.response.404.active.term`; integer, required)
    - min 1
- `allowed_hosts` (`restoreDatabaseBranch.response.404.allowed_hosts`; array | null, optional) — With `secret_host_not_allowed`: the hosts the secret may go to, as the secret has them; null where it was given none (the node's `SecretHosts`).
- `problems` (`restoreDatabaseBranch.response.404.problems`; array<object>, optional) — With `invalid_definition`: every problem of the definition, each where it is and what it is.
  - `at` (`restoreDatabaseBranch.response.404.problems.at`; string, required) — Where in the definition, a dotted path (`services.web.port`); empty for the whole of it.
  - `message` (`restoreDatabaseBranch.response.404.problems.message`; string, required)
- `report` (`restoreDatabaseBranch.response.404.report`; object, optional) — With `compose_refused`: the import's report, which says what is refused, why, and what to change.
  - `object` (`restoreDatabaseBranch.response.404.report.object`; string, required)
    - one of `"compose_import"`
  - `name` (`restoreDatabaseBranch.response.404.report.name`; string | null, required) — The model's `name`: each service's label `compose.project`. Null: it has none.
  - `dry_run` (`restoreDatabaseBranch.response.404.report.dry_run`; boolean, required)
  - `strict` (`restoreDatabaseBranch.response.404.report.strict`; boolean, required)
  - `profiles` (`restoreDatabaseBranch.response.404.report.profiles`; array<string>, required)
  - `treatments` (`restoreDatabaseBranch.response.404.report.treatments`; object, required) — How many items of the report have each treatment.
    - `done` (`restoreDatabaseBranch.response.404.report.treatments.done`; integer, required)
      - min 0
    - `adapted` (`restoreDatabaseBranch.response.404.report.treatments.adapted`; integer, required)
      - min 0
    - `ignored` (`restoreDatabaseBranch.response.404.report.treatments.ignored`; integer, required)
      - min 0
    - `refused` (`restoreDatabaseBranch.response.404.report.treatments.refused`; integer, required)
      - min 0
  - `items` (`restoreDatabaseBranch.response.404.report.items`; array<object>, required) — The model's top-level elements: `name`, each volume, network, config and secret, extensions.
    - `at` (`restoreDatabaseBranch.response.404.report.items.at`; string, required) — Where in the model: of a service, its attribute (`ports[0]`, `depends_on.db`, `environment.KEY`), empty for the service as a whole; of the top level, the element (`volumes.db-data`).
    - `treatment` (`restoreDatabaseBranch.response.404.report.items.treatment`; string, required) — `done`: it means the same on the platform; `adapted`: the platform does the same another way; `ignored`: it matters to a local run alone (refused with `strict`); `refused`: the platform cannot do it, and doing without it would let the program go wrong quietly.
      - one of `"done"`, `"adapted"`, `"ignored"`, `"refused"`
    - `why` (`restoreDatabaseBranch.response.404.report.items.why`; string, required)
    - `change` (`restoreDatabaseBranch.response.404.report.items.change`; string | null, required) — Of one that is refused: what to change. Null otherwise.
  - `services` (`restoreDatabaseBranch.response.404.report.services`; array<object>, required) — The services the import takes, in the model's order.
    - `name` (`restoreDatabaseBranch.response.404.report.services.name`; string, required) — The service's name, which is its app's.
    - `app_id` (`restoreDatabaseBranch.response.404.report.services.app_id`; string | null, required) — Its app. Null: a dry run of a service the project does not have.
      - pattern `^app-`
    - `status` (`restoreDatabaseBranch.response.404.report.services.status`; string, required) — What the import does (or, in a dry run, would do) to its app: makes it, writes what changed, or nothing.
      - one of `"created"`, `"changed"`, `"unchanged"`
    - `kind` (`restoreDatabaseBranch.response.404.report.services.kind`; string, required) — `job`: a service of the model waits for it to complete, and it runs to its end in each deploy that needs it.
      - one of `"service"`, `"job"`
    - `stateful` (`restoreDatabaseBranch.response.404.report.services.stateful`; boolean, required) — It mounts a volume of its own: one instance, which has the volume.
    - `version` (`restoreDatabaseBranch.response.404.report.services.version`; boolean, required) — Whether the import's deploy makes a version of it: what its version would be made of, its references resolved, is not what its current version is.
    - `items` (`restoreDatabaseBranch.response.404.report.services.items`; array<object>, required)
      - `at` (`restoreDatabaseBranch.response.404.report.services.items.at`; string, required) — Where in the model: of a service, its attribute (`ports[0]`, `depends_on.db`, `environment.KEY`), empty for the service as a whole; of the top level, the element (`volumes.db-data`).
      - `treatment` (`restoreDatabaseBranch.response.404.report.services.items.treatment`; string, required) — `done`: it means the same on the platform; `adapted`: the platform does the same another way; `ignored`: it matters to a local run alone (refused with `strict`); `refused`: the platform cannot do it, and doing without it would let the program go wrong quietly.
        - one of `"done"`, `"adapted"`, `"ignored"`, `"refused"`
      - `why` (`restoreDatabaseBranch.response.404.report.services.items.why`; string, required)
      - `change` (`restoreDatabaseBranch.response.404.report.services.items.change`; string | null, required) — Of one that is refused: what to change. Null otherwise.
    - `app` (`restoreDatabaseBranch.response.404.report.services.app`; object, required) — The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
      - `image` (`restoreDatabaseBranch.response.404.report.services.app.image`; string | null, required) — What the app's next version is made of, with the seven fields after it: its newest version's, with what was changed since. `null`: the app has no image, and no version.
      - `image_pull_secret` (`restoreDatabaseBranch.response.404.report.services.app.image_pull_secret`; string | null, required) — The name of the secret that holds the credentials of the image's registry. No answer has its value. `null`: none.
      - `start_command` (`restoreDatabaseBranch.response.404.report.services.app.start_command`; any of, required)
        - any of: `StartCommand`, `null`
      - `start_args` (`restoreDatabaseBranch.response.404.report.services.app.start_args`; any of, required) — What follows the image's ENTRYPOINT in the place of its CMD. `null`: the image's CMD, or the whole of `start_command`.
        - any of: `array<string>`, `null`
      - `port` (`restoreDatabaseBranch.response.404.report.services.app.port`; integer | null, required)
      - `ready` (`restoreDatabaseBranch.response.404.report.services.app.ready`; object, required) — How to tell that an instance is up, which a version's template is saved after: exactly one of the three. The first two are asked from outside the instance, so the service has to listen on every address (`0.0.0.0`).
        - `http` (`restoreDatabaseBranch.response.404.report.services.app.ready.http`; string, optional) — A path, beginning with `/`: a `GET` of it on the app's port is answered with a status from 200 to 399.
        - `tcp` (`restoreDatabaseBranch.response.404.report.services.app.ready.tcp`; boolean, optional) — The app's port takes a connection.
          - one of `true`
        - `command` (`restoreDatabaseBranch.response.404.report.services.app.ready.command`; one of, optional) — A command that succeeds in the instance. It is run by the instance's shell: a list of arguments is written as one line for it.
          - one of: `string`, `array<string>`
      - `env` (`restoreDatabaseBranch.response.404.report.services.app.env`; map<string>, required)
      - `secrets` (`restoreDatabaseBranch.response.404.report.services.app.secrets`; map<string>, required) — Names of secrets. No answer has a value.
      - `size` (`restoreDatabaseBranch.response.404.report.services.app.size`; object, required) — What one instance may use at most. It is billed by what it uses.
        - `vcpus` (`restoreDatabaseBranch.response.404.report.services.app.size.vcpus`; integer, required)
          - min 1
        - `memory_bytes` (`restoreDatabaseBranch.response.404.report.services.app.size.memory_bytes`; integer, required) — An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400 `invalid_field` (param `size.memory_bytes`): no node would make an instance of it, as none makes a sandbox of it (the node's `SandboxLimitsCreate.memory_bytes`).
          - min 134217728
      - `volumes` (`restoreDatabaseBranch.response.404.report.services.app.volumes`; array<object>, required)
        - `volume` (`restoreDatabaseBranch.response.404.report.services.app.volumes.volume`; string, required)
        - `path` (`restoreDatabaseBranch.response.404.report.services.app.volumes.path`; string, required)
        - `read_only` (`restoreDatabaseBranch.response.404.report.services.app.volumes.read_only`; boolean, required)
        - `nocopy` (`restoreDatabaseBranch.response.404.report.services.app.volumes.nocopy`; unknown, optional) — There only where it was given as `true`.
      - `kind` (`restoreDatabaseBranch.response.404.report.services.app.kind`; string, required)
      - `files` (`restoreDatabaseBranch.response.404.report.services.app.files`; array<object>, required)
        - `path` (`restoreDatabaseBranch.response.404.report.services.app.files.path`; string, required)
        - `mode` (`restoreDatabaseBranch.response.404.report.services.app.files.mode`; integer, required)
        - `uid` (`restoreDatabaseBranch.response.404.report.services.app.files.uid`; integer, required)
        - `gid` (`restoreDatabaseBranch.response.404.report.services.app.files.gid`; integer, required)
        - `content` (`restoreDatabaseBranch.response.404.report.services.app.files.content`; string, optional)
        - `secret` (`restoreDatabaseBranch.response.404.report.services.app.files.secret`; string, optional)
      - `user` (`restoreDatabaseBranch.response.404.report.services.app.user`; string | null, required)
      - `working_dir` (`restoreDatabaseBranch.response.404.report.services.app.working_dir`; string | null, required)
      - `stop` (`restoreDatabaseBranch.response.404.report.services.app.stop`; any of, required)
        - any of: `ServiceStop`, `null`
      - `hostname` (`restoreDatabaseBranch.response.404.report.services.app.hostname`; string | null, required)
      - `regions` (`restoreDatabaseBranch.response.404.report.services.app.regions`; array<string>, required) — In the order na, eu, ap.
      - `scale` (`restoreDatabaseBranch.response.404.report.services.app.scale`; object, required)
        - `min_instances` (`restoreDatabaseBranch.response.404.report.services.app.scale.min_instances`; integer, required) — How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share `max_instances` (two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At most `max_instances`, where that is given, and at most what the account's plan lets an app ask for in a region (`caps.app_instances.limit`: 5, 50 and 500): more is refused, 403 `plan_cap_reached`.
          - min 0
        - `max_instances` (`restoreDatabaseBranch.response.404.report.services.app.scale.max_instances`; integer | null, required) — How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (`caps.app_instances.limit`: 5 on the free plan, 50 on `p20`, 200 on `p100`, 500 on `p300`, 1,000 on `p1000`, 2,000 on `p2000`): more is refused, 403 `plan_cap_reached`, and what an app asked for on a plan that let it is kept, and held to the plan's number. `null`: the plan's number for an app that names none (`caps.app_instances.default`: 2, 10, 20, 50, 100 and 200), or `min_instances` where that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.
          - min 1
        - `concurrency` (`restoreDatabaseBranch.response.404.report.services.app.scale.concurrency`; integer | null, required) — A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more. `null`, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.
          - min 1; max 1000
        - `sleep_after_ms` (`restoreDatabaseBranch.response.404.report.services.app.scale.sleep_after_ms`; integer, required) — After how long without a request an instance stops. One that stays stopped is deleted by its node after `delete_after_ms`, and the next request that needs an instance gets a new one; the instances `min_instances` keeps awake are neither stopped nor deleted.
          - min 0; max 600000
        - `sleep_notice_ms` (`restoreDatabaseBranch.response.404.report.services.app.scale.sleep_notice_ms`; integer | null, required) — How long before an instance stops for being idle the programs connected to its guest's `/run/sbx/awake` are sent the line `sleep N`, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).
          - min 0; max 60000
        - `sleep_hold_max_ms` (`restoreDatabaseBranch.response.404.report.services.app.scale.sleep_hold_max_ms`; integer, required) — How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to `/run/sbx/awake` and sends `+` before it answers a request whose work goes on after the answer, and `-` (or closes the connection, or dies) when that work is done; the instance stops `sleep_after_ms` after the last hold is lowered. Past this time it stops whatever holds it, the programs connected told `sleep N cap` first where `sleep_notice_ms` asks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).
          - min 0; max 900000
        - `delete_after_ms` (`restoreDatabaseBranch.response.404.report.services.app.scale.delete_after_ms`; integer | null, required) — After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400 `invalid_field`), and an instance that is to stay warm is one of `min_instances`. `null`, which is what it is when nothing is said: the hour of the nodes (`--app-delete-after-seconds`). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, which `keys.delete_after_idle_ms` is for.
          - min 1000; max 3600000
        - `suspend_after_ms` (`restoreDatabaseBranch.response.404.report.services.app.scale.suspend_after_ms`; integer | null, optional) — How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's `suspend_after_seconds` is its app's.
          - min 1000; max 86400000
        - `wake_daily_at` (`restoreDatabaseBranch.response.404.report.services.app.scale.wake_daily_at`; string | null, optional) — A time of day in UTC, `HH:MM`, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server's `pg_cron` jobs, whatever this says. Null (the default): none. A database's `wake_daily_at` is its app's.
          - pattern `^([01][0-9]|2[0-3]):[0-5][0-9]$`
      - `keys` (`restoreDatabaseBranch.response.404.report.services.app.keys`; any of, required)
        - any of: `object`, `null`
      - `egress` (`restoreDatabaseBranch.response.404.report.services.app.egress`; object | null, required) — Egress rules as a sandbox has them (`default`, `allow`, `deny`, `http`, `inject`), null when there are none; kept as the calls gave them (a `PATCH` merges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).
        - `default` (`restoreDatabaseBranch.response.404.report.services.app.egress.default`; string | null, optional)
          - one of `"allow"`, `"deny"`, `null`
        - `allow` (`restoreDatabaseBranch.response.404.report.services.app.egress.allow`; array | null, optional)
        - `deny` (`restoreDatabaseBranch.response.404.report.services.app.egress.deny`; array | null, optional)
        - `http` (`restoreDatabaseBranch.response.404.report.services.app.egress.http`; array | null, optional)
        - `inject` (`restoreDatabaseBranch.response.404.report.services.app.egress.inject`; array | null, optional)
        - `deny_ports` (`restoreDatabaseBranch.response.404.report.services.app.egress.deny_ports`; array | null, optional) — Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
      - `metadata` (`restoreDatabaseBranch.response.404.report.services.app.metadata`; map<string>, required)
      - `logs` (`restoreDatabaseBranch.response.404.report.services.app.logs`; object, required) — What the app's log has, each part as it was given or at its default (`AppLogSettings`).
        - `output` (`restoreDatabaseBranch.response.404.report.services.app.logs.output`; boolean, required)
        - `keep` (`restoreDatabaseBranch.response.404.report.services.app.logs.keep`; boolean, required)
        - `requests` (`restoreDatabaseBranch.response.404.report.services.app.logs.requests`; object, required)
          - `sample_rate` (`restoreDatabaseBranch.response.404.report.services.app.logs.requests.sample_rate`; number, required)
            - min 0; max 1
          - `keep_errors` (`restoreDatabaseBranch.response.404.report.services.app.logs.requests.keep_errors`; boolean, required)
      - `public` (`restoreDatabaseBranch.response.404.report.services.app.public`; boolean, required) — Whether it answers at its default domain (`url`).
      - `depends_on` (`restoreDatabaseBranch.response.404.report.services.app.depends_on`; array<object>, required)
        - `service` (`restoreDatabaseBranch.response.404.report.services.app.depends_on.service`; string, required)
        - `condition` (`restoreDatabaseBranch.response.404.report.services.app.depends_on.condition`; string, required)
      - `network` (`restoreDatabaseBranch.response.404.report.services.app.network`; object, required)
        - `aliases` (`restoreDatabaseBranch.response.404.report.services.app.network.aliases`; array<string>, required)
        - `endpoint_mode` (`restoreDatabaseBranch.response.404.report.services.app.network.endpoint_mode`; string, required)
      - `drives` (`restoreDatabaseBranch.response.404.report.services.app.drives`; array<object>, optional) — The Drives its instance mounts (`AppCreate.drives`): none, `[]`, where it names none.
        - `drive` (`restoreDatabaseBranch.response.404.report.services.app.drives.drive`; string, required)
        - `path` (`restoreDatabaseBranch.response.404.report.services.app.drives.path`; string, required)
        - `mode` (`restoreDatabaseBranch.response.404.report.services.app.drives.mode`; string, required)
      - `key_drives` (`restoreDatabaseBranch.response.404.report.services.app.key_drives`; array<object>, optional) — The Drives each key's instance has of its own (`AppCreate.key_drives`): none, `[]`, where it gives none.
        - `name` (`restoreDatabaseBranch.response.404.report.services.app.key_drives.name`; string, required)
        - `path` (`restoreDatabaseBranch.response.404.report.services.app.key_drives.path`; string, required)
        - `size_bytes` (`restoreDatabaseBranch.response.404.report.services.app.key_drives.size_bytes`; integer | null, required)
          - format `int64`
        - `nocopy` (`restoreDatabaseBranch.response.404.report.services.app.key_drives.nocopy`; unknown, optional) — There only where it was given as `true`.
      - `runtime` (`restoreDatabaseBranch.response.404.report.services.app.runtime`; any of, optional) — Its runtime settings (`AppCreate.runtime`). `null`: none.
        - any of: `Runtime`, `null`
      - `traces` (`restoreDatabaseBranch.response.404.report.services.app.traces`; object, optional) — What the app's requests' traces have, each part as it was given or at its default (`AppTraceSettings`): no span where `sample_rate` is 0.
        - `sample_rate` (`restoreDatabaseBranch.response.404.report.services.app.traces.sample_rate`; number, required)
          - min 0; max 1
        - `trust_incoming` (`restoreDatabaseBranch.response.404.report.services.app.traces.trust_incoming`; boolean, required)
  - `volumes` (`restoreDatabaseBranch.response.404.report.volumes`; array<object>, required) — The volumes of the project the services mount.
    - `model` (`restoreDatabaseBranch.response.404.report.volumes.model`; string | null, required) — Its name in the model. Null: made for a path a stateful service mounts with no volume named.
    - `name` (`restoreDatabaseBranch.response.404.report.volumes.name`; string, required) — Its name in the project.
    - `id` (`restoreDatabaseBranch.response.404.report.volumes.id`; string | null, required) — Null: not made yet (`to_make`).
      - pattern `^vol-`
    - `shared` (`restoreDatabaseBranch.response.404.report.volumes.shared`; boolean, required) — Several services mount it, or one with several instances: every instance of each mounts it at once.
    - `status` (`restoreDatabaseBranch.response.404.report.volumes.status`; string, required) — `to_make`: the import makes it (a dry run says so of what it would make); `made`: this import made it; `there`: an earlier import made it, or a volume of its name was there; `external`: the model names it `external`, and the project has it.
      - one of `"to_make"`, `"made"`, `"there"`, `"external"`
    - `used_by` (`restoreDatabaseBranch.response.404.report.volumes.used_by`; array<string>, required)
  - `secrets` (`restoreDatabaseBranch.response.404.report.secrets`; array<object>, required) — The secrets of the model that services are granted.
    - `model` (`restoreDatabaseBranch.response.404.report.secrets.model`; string, required) — Its name in the model.
    - `name` (`restoreDatabaseBranch.response.404.report.secrets.name`; string, required) — The project's secret that holds it: the model's name, with each character a secret's name does not take written as an underscore.
    - `there` (`restoreDatabaseBranch.response.404.report.secrets.there`; boolean, required) — Whether the project has it. An import (not a dry run) with one that is not there is refused 404 `secret_not_found`.
    - `used_by` (`restoreDatabaseBranch.response.404.report.secrets.used_by`; array<string>, required)
  - `left_out` (`restoreDatabaseBranch.response.404.report.left_out`; array<object>, required) — The services of profiles that are not turned on, which the import does not touch.
    - `name` (`restoreDatabaseBranch.response.404.report.left_out.name`; string, required)
    - `profiles` (`restoreDatabaseBranch.response.404.report.left_out.profiles`; array<string>, required)
  - `absent` (`restoreDatabaseBranch.response.404.report.absent`; array<string>, required) — The project's services that the model does not have: kept as they are.
  - `deploy` (`restoreDatabaseBranch.response.404.report.deploy`; string | null, required) — The deploy the import made (`GET /v1/deploys/{id}`). Null: a dry run, or nothing would get a version.
    - pattern `^dpl-`
- `accounts` (`restoreDatabaseBranch.response.404.accounts`; array<object>, optional) — With `sole_owner`: the accounts the user is the only owner of.
  - `id` (`restoreDatabaseBranch.response.404.accounts.id`; string, required)
    - pattern `^acct-[0-9a-hjkmnp-tv-z]{16}$`
  - `name` (`restoreDatabaseBranch.response.404.accounts.name`; string, required)

### 409

`not_root_branch`: the branch is not the root: a restore in place is of the root's alone (make a branch of a moment instead: `POST /v1/databases/{id}/branches` with `from: {at}`); `database_busy`: the database is being made, deleted or changed by another call now; `database_failed`: its first start failed; `idempotency_key_reused`: the `Idempotency-Key` came with another body; `idempotency_in_progress`: the first call with it has run for fifteen minutes and has not answered (retryable).

#### Example

```json
{
  "move_id": "string",
  "upgrade_id": "string",
  "move": {
    "object": "move",
    "id": "string",
    "sandbox_id": "string",
    "project_id": "string",
    "from": {
      "id": "string",
      "name": "string"
    },
    "to": {
      "id": "string",
      "name": "string"
    },
    "epoch": 1,
    "step": "string",
    "why": "string",
    "wake": true,
    "from_store": true,
    "release": {},
    "takeover": {},
    "error": {
      "code": "string",
      "message": "string",
      "status": 0,
      "takeover_refused": {
        "code": "string",
        "message": "string",
        "status": 0
      },
      "image": "string",
      "holder": "string",
      "holder_says": "has"
    },
    "attempts": 0,
    "next_attempt_at": "2019-08-24T14:15:22Z",
    "batch": "string",
    "created_at": "2019-08-24T14:15:22Z",
    "updated_at": "2019-08-24T14:15:22Z",
    "ended_at": "2019-08-24T14:15:22Z"
  },
  "lease_until": "2019-08-24T14:15:22Z",
  "active": {
    "name": "string",
    "url": "string",
    "term": 1
  },
  "allowed_hosts": [
    "string"
  ],
  "problems": [
    {
      "at": "string",
      "message": "string"
    }
  ],
  "report": {
    "object": "compose_import",
    "name": "string",
    "dry_run": true,
    "strict": true,
    "profiles": [
      "string"
    ],
    "treatments": {
      "done": 0,
      "adapted": 0,
      "ignored": 0,
      "refused": 0
    },
    "items": [
      {
        "at": "string",
        "treatment": "done",
        "why": "string",
        "change": "string"
      }
    ],
    "services": [
      {
        "name": "string",
        "app_id": "string",
        "status": "created",
        "kind": "service",
        "stateful": true,
        "version": true,
        "items": [
          {
            "at": "string",
            "treatment": "done",
            "why": "string",
            "change": "string"
          }
        ],
        "app": {
          "image": "string",
          "image_pull_secret": "string",
          "start_command": "string",
          "start_args": [
            "string"
          ],
          "port": 0,
          "ready": {
            "http": "string"
          },
          "env": {
            "property1": "string",
            "property2": "string"
          },
          "secrets": {
            "property1": "string",
            "property2": "string"
          },
          "size": {
            "vcpus": 1,
            "memory_bytes": 134217728
          },
          "volumes": [
            {
              "volume": "string",
              "path": "string",
              "read_only": true,
              "nocopy": true
            }
          ],
          "drives": [
            {
              "drive": "string",
              "path": "string",
              "mode": "string"
            }
          ],
          "key_drives": [
            {
              "name": "string",
              "path": "string",
              "size_bytes": 0,
              "nocopy": true
            }
          ],
          "kind": "string",
          "files": [
            {
              "path": "string",
              "content": "string",
              "secret": "string",
              "mode": 0,
              "uid": 0,
              "gid": 0
            }
          ],
          "user": "string",
          "working_dir": "string",
          "stop": {
            "signal": "string",
            "grace_ms": 0
          },
          "hostname": "string",
          "runtime": {
            "ulimits": {
              "property1": {},
              "property2": {}
            },
            "sysctls": {
              "property1": "string",
              "property2": "string"
            },
            "tmpfs": [
              {}
            ],
            "dns": {
              "servers": [
                null
              ],
              "search": [
                null
              ],
              "options": [
                null
              ]
            },
            "shm_size_bytes": 0
          },
          "regions": [
            "string"
          ],
          "scale": {
            "min_instances": 0,
            "max_instances": 1,
            "concurrency": 1,
            "sleep_after_ms": 600000,
            "sleep_notice_ms": 60000,
            "sleep_hold_max_ms": 900000,
            "suspend_after_ms": 1000,
            "wake_daily_at": "string",
            "delete_after_ms": 1000
          },
          "keys": {
            "from": {
              "header": "string"
            },
            "upgrade_on_deploy": true,
            "delete_after_idle_ms": 1000
          },
          "egress": {
            "default": "allow",
            "allow": [
              "string"
            ],
            "deny": [
              "string"
            ],
            "http": [
              {
                "allow": []
              }
            ],
            "inject": [
              {
                "headers": {}
              }
            ],
            "deny_ports": [
              1
            ]
          },
          "metadata": {
            "property1": "string",
            "property2": "string"
          },
          "logs": {
            "output": true,
            "keep": true,
            "requests": {
              "sample_rate": 1,
              "keep_errors": true
            }
          },
          "traces": {
            "sample_rate": 1,
            "trust_incoming": true
          },
          "public": true,
          "depends_on": [
            {
              "service": "string",
              "condition": "string"
            }
          ],
          "network": {
            "aliases": [
              "string"
            ],
            "endpoint_mode": "string"
          }
        }
      }
    ],
    "volumes": [
      {
        "model": "string",
        "name": "string",
        "id": "string",
        "shared": true,
        "status": "to_make",
        "used_by": [
          "string"
        ]
      }
    ],
    "secrets": [
      {
        "model": "string",
        "name": "string",
        "there": true,
        "used_by": [
          "string"
        ]
      }
    ],
    "left_out": [
      {
        "name": "string",
        "profiles": [
          "string"
        ]
      }
    ],
    "absent": [
      "string"
    ],
    "deploy": "string"
  },
  "accounts": [
    {
      "id": "string",
      "name": "string"
    }
  ],
  "error": {
    "type": "string",
    "code": "string",
    "message": "string",
    "param": "string",
    "retryable": true,
    "request_id": "string",
    "docs_url": "string"
  }
}
```

- `error` (`restoreDatabaseBranch.response.409.error`; object, required)
  - `type` (`restoreDatabaseBranch.response.409.error.type`; string, required)
  - `code` (`restoreDatabaseBranch.response.409.error.code`; string, required)
  - `message` (`restoreDatabaseBranch.response.409.error.message`; string, required)
  - `param` (`restoreDatabaseBranch.response.409.error.param`; string | null, required)
  - `retryable` (`restoreDatabaseBranch.response.409.error.retryable`; boolean, required)
  - `request_id` (`restoreDatabaseBranch.response.409.error.request_id`; string, required)
  - `docs_url` (`restoreDatabaseBranch.response.409.error.docs_url`; string | null, required)
- `move_id` (`restoreDatabaseBranch.response.409.move_id`; string, optional) — With `already_moving`: the move of the sandbox that is under way.
- `upgrade_id` (`restoreDatabaseBranch.response.409.upgrade_id`; string, optional) — With `upgrade_in_progress` (the key's upgrade that is not over), `upgrade_started` (the upgrade that has begun) and `rollback_gone` (the upgrade whose revert is refused): that upgrade.
  - pattern `^upg-[0-9a-hjkmnp-tv-z]{16}$`
- `move` (`restoreDatabaseBranch.response.409.move`; object, optional) — With `move_over`, `move_going_back` and `move_taken_over` (`POST /internal/moves/{id}/cancel`): the move, as it stands.
  - `object` (`restoreDatabaseBranch.response.409.move.object`; string, required)
  - `id` (`restoreDatabaseBranch.response.409.move.id`; string, required)
    - pattern `^mov-[0-9a-hjkmnp-tv-z]{16}$`
  - `sandbox_id` (`restoreDatabaseBranch.response.409.move.sandbox_id`; string, required)
  - `project_id` (`restoreDatabaseBranch.response.409.move.project_id`; string, required)
  - `from` (`restoreDatabaseBranch.response.409.move.from`; object, required)
    - `id` (`restoreDatabaseBranch.response.409.move.from.id`; string, required)
    - `name` (`restoreDatabaseBranch.response.409.move.from.name`; string | null, required) — Its name; null for a node that is off the books since.
  - `to` (`restoreDatabaseBranch.response.409.move.to`; object, required)
    - `id` (`restoreDatabaseBranch.response.409.move.to.id`; string, required)
    - `name` (`restoreDatabaseBranch.response.409.move.to.name`; string | null, required) — Its name; null for a node that is off the books since.
  - `epoch` (`restoreDatabaseBranch.response.409.move.epoch`; integer, required) — The epoch the table held the sandbox at when the move began: the old node releases it at it, the new one takes it over one on, the old one takes it back two on, and from the object store three on.
    - min 1
  - `step` (`restoreDatabaseBranch.response.409.move.step`; string, required) — Where it stands: `releasing` (the old node is asked to release it; the table has it there), `taking_over` (the new node is asked to take it over; the table has it there), `reclaiming` (the new node refused it, and the old one is asked to take it back), `restoring` (the old one kept nothing of it, and takes it over from the object store), `done` (on the new node), `failed` (where it was, or back there, or where a failure no time clears or an operator's cancel found it: `error` says why).
  - `why` (`restoreDatabaseBranch.response.409.move.why`; string, required) — What made it: the operator's move, an evacuation, a recovery.
  - `wake` (`restoreDatabaseBranch.response.409.move.wake`; boolean, required) — Whether the new node wakes it: as the call said, or as it was (it ran) when the move began.
  - `from_store` (`restoreDatabaseBranch.response.409.move.from_store`; boolean, required) — The new node takes it from the object store alone.
  - `release` (`restoreDatabaseBranch.response.409.move.release`; object | null, required) — What the old node's release answered (sandboxd/openapi/openapi.json, `releaseSandbox`), without the release's key; null before it answered.
  - `takeover` (`restoreDatabaseBranch.response.409.move.takeover`; object | null, required) — What the takeover that ended it answered (`takeoverSandbox` of the node's document): where its disk and memory came from (`source`), how long each took (`ms`), `memory`; null before.
  - `error` (`restoreDatabaseBranch.response.409.move.error`; one of, required) — Why it failed, of one that failed (the new node's refusal, where it was taken back to the old node); null, of one that is done; of one under way, what the step it is at was last told where it is asked again.
    - one of: `object`, `null`
  - `attempts` (`restoreDatabaseBranch.response.409.move.attempts`; integer, required) — How many times the step it is at was asked without an answer that settles it.
    - min 0
  - `next_attempt_at` (`restoreDatabaseBranch.response.409.move.next_attempt_at`; string | null, required) — When that step is asked again; null where it is not waiting.
    - format `date-time`
  - `batch` (`restoreDatabaseBranch.response.409.move.batch`; string | null, required) — The evacuation (`evc-…`) or recovery (`rcv-…`) it is of.
  - `created_at` (`restoreDatabaseBranch.response.409.move.created_at`; string, required)
    - format `date-time`
  - `updated_at` (`restoreDatabaseBranch.response.409.move.updated_at`; string, required)
    - format `date-time`
  - `ended_at` (`restoreDatabaseBranch.response.409.move.ended_at`; string | null, required)
    - format `date-time`
- `lease_until` (`restoreDatabaseBranch.response.409.lease_until`; string, optional) — With `lease_held`: until when the node may still hold the lease it was granted last, and the time after it for the node to have seen it run out (`recoverNode` is refused until then).
  - format `date-time`
- `active` (`restoreDatabaseBranch.response.409.active`; object | null, optional) — With `standby`: the active copy, as the standby last read the lease; null while no copy holds it.
  - `name` (`restoreDatabaseBranch.response.409.active.name`; string, required)
  - `url` (`restoreDatabaseBranch.response.409.active.url`; string, required)
  - `term` (`restoreDatabaseBranch.response.409.active.term`; integer, required)
    - min 1
- `allowed_hosts` (`restoreDatabaseBranch.response.409.allowed_hosts`; array | null, optional) — With `secret_host_not_allowed`: the hosts the secret may go to, as the secret has them; null where it was given none (the node's `SecretHosts`).
- `problems` (`restoreDatabaseBranch.response.409.problems`; array<object>, optional) — With `invalid_definition`: every problem of the definition, each where it is and what it is.
  - `at` (`restoreDatabaseBranch.response.409.problems.at`; string, required) — Where in the definition, a dotted path (`services.web.port`); empty for the whole of it.
  - `message` (`restoreDatabaseBranch.response.409.problems.message`; string, required)
- `report` (`restoreDatabaseBranch.response.409.report`; object, optional) — With `compose_refused`: the import's report, which says what is refused, why, and what to change.
  - `object` (`restoreDatabaseBranch.response.409.report.object`; string, required)
    - one of `"compose_import"`
  - `name` (`restoreDatabaseBranch.response.409.report.name`; string | null, required) — The model's `name`: each service's label `compose.project`. Null: it has none.
  - `dry_run` (`restoreDatabaseBranch.response.409.report.dry_run`; boolean, required)
  - `strict` (`restoreDatabaseBranch.response.409.report.strict`; boolean, required)
  - `profiles` (`restoreDatabaseBranch.response.409.report.profiles`; array<string>, required)
  - `treatments` (`restoreDatabaseBranch.response.409.report.treatments`; object, required) — How many items of the report have each treatment.
    - `done` (`restoreDatabaseBranch.response.409.report.treatments.done`; integer, required)
      - min 0
    - `adapted` (`restoreDatabaseBranch.response.409.report.treatments.adapted`; integer, required)
      - min 0
    - `ignored` (`restoreDatabaseBranch.response.409.report.treatments.ignored`; integer, required)
      - min 0
    - `refused` (`restoreDatabaseBranch.response.409.report.treatments.refused`; integer, required)
      - min 0
  - `items` (`restoreDatabaseBranch.response.409.report.items`; array<object>, required) — The model's top-level elements: `name`, each volume, network, config and secret, extensions.
    - `at` (`restoreDatabaseBranch.response.409.report.items.at`; string, required) — Where in the model: of a service, its attribute (`ports[0]`, `depends_on.db`, `environment.KEY`), empty for the service as a whole; of the top level, the element (`volumes.db-data`).
    - `treatment` (`restoreDatabaseBranch.response.409.report.items.treatment`; string, required) — `done`: it means the same on the platform; `adapted`: the platform does the same another way; `ignored`: it matters to a local run alone (refused with `strict`); `refused`: the platform cannot do it, and doing without it would let the program go wrong quietly.
      - one of `"done"`, `"adapted"`, `"ignored"`, `"refused"`
    - `why` (`restoreDatabaseBranch.response.409.report.items.why`; string, required)
    - `change` (`restoreDatabaseBranch.response.409.report.items.change`; string | null, required) — Of one that is refused: what to change. Null otherwise.
  - `services` (`restoreDatabaseBranch.response.409.report.services`; array<object>, required) — The services the import takes, in the model's order.
    - `name` (`restoreDatabaseBranch.response.409.report.services.name`; string, required) — The service's name, which is its app's.
    - `app_id` (`restoreDatabaseBranch.response.409.report.services.app_id`; string | null, required) — Its app. Null: a dry run of a service the project does not have.
      - pattern `^app-`
    - `status` (`restoreDatabaseBranch.response.409.report.services.status`; string, required) — What the import does (or, in a dry run, would do) to its app: makes it, writes what changed, or nothing.
      - one of `"created"`, `"changed"`, `"unchanged"`
    - `kind` (`restoreDatabaseBranch.response.409.report.services.kind`; string, required) — `job`: a service of the model waits for it to complete, and it runs to its end in each deploy that needs it.
      - one of `"service"`, `"job"`
    - `stateful` (`restoreDatabaseBranch.response.409.report.services.stateful`; boolean, required) — It mounts a volume of its own: one instance, which has the volume.
    - `version` (`restoreDatabaseBranch.response.409.report.services.version`; boolean, required) — Whether the import's deploy makes a version of it: what its version would be made of, its references resolved, is not what its current version is.
    - `items` (`restoreDatabaseBranch.response.409.report.services.items`; array<object>, required)
      - `at` (`restoreDatabaseBranch.response.409.report.services.items.at`; string, required) — Where in the model: of a service, its attribute (`ports[0]`, `depends_on.db`, `environment.KEY`), empty for the service as a whole; of the top level, the element (`volumes.db-data`).
      - `treatment` (`restoreDatabaseBranch.response.409.report.services.items.treatment`; string, required) — `done`: it means the same on the platform; `adapted`: the platform does the same another way; `ignored`: it matters to a local run alone (refused with `strict`); `refused`: the platform cannot do it, and doing without it would let the program go wrong quietly.
        - one of `"done"`, `"adapted"`, `"ignored"`, `"refused"`
      - `why` (`restoreDatabaseBranch.response.409.report.services.items.why`; string, required)
      - `change` (`restoreDatabaseBranch.response.409.report.services.items.change`; string | null, required) — Of one that is refused: what to change. Null otherwise.
    - `app` (`restoreDatabaseBranch.response.409.report.services.app`; object, required) — The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
      - `image` (`restoreDatabaseBranch.response.409.report.services.app.image`; string | null, required) — What the app's next version is made of, with the seven fields after it: its newest version's, with what was changed since. `null`: the app has no image, and no version.
      - `image_pull_secret` (`restoreDatabaseBranch.response.409.report.services.app.image_pull_secret`; string | null, required) — The name of the secret that holds the credentials of the image's registry. No answer has its value. `null`: none.
      - `start_command` (`restoreDatabaseBranch.response.409.report.services.app.start_command`; any of, required)
        - any of: `StartCommand`, `null`
      - `start_args` (`restoreDatabaseBranch.response.409.report.services.app.start_args`; any of, required) — What follows the image's ENTRYPOINT in the place of its CMD. `null`: the image's CMD, or the whole of `start_command`.
        - any of: `array<string>`, `null`
      - `port` (`restoreDatabaseBranch.response.409.report.services.app.port`; integer | null, required)
      - `ready` (`restoreDatabaseBranch.response.409.report.services.app.ready`; object, required) — How to tell that an instance is up, which a version's template is saved after: exactly one of the three. The first two are asked from outside the instance, so the service has to listen on every address (`0.0.0.0`).
        - `http` (`restoreDatabaseBranch.response.409.report.services.app.ready.http`; string, optional) — A path, beginning with `/`: a `GET` of it on the app's port is answered with a status from 200 to 399.
        - `tcp` (`restoreDatabaseBranch.response.409.report.services.app.ready.tcp`; boolean, optional) — The app's port takes a connection.
          - one of `true`
        - `command` (`restoreDatabaseBranch.response.409.report.services.app.ready.command`; one of, optional) — A command that succeeds in the instance. It is run by the instance's shell: a list of arguments is written as one line for it.
          - one of: `string`, `array<string>`
      - `env` (`restoreDatabaseBranch.response.409.report.services.app.env`; map<string>, required)
      - `secrets` (`restoreDatabaseBranch.response.409.report.services.app.secrets`; map<string>, required) — Names of secrets. No answer has a value.
      - `size` (`restoreDatabaseBranch.response.409.report.services.app.size`; object, required) — What one instance may use at most. It is billed by what it uses.
        - `vcpus` (`restoreDatabaseBranch.response.409.report.services.app.size.vcpus`; integer, required)
          - min 1
        - `memory_bytes` (`restoreDatabaseBranch.response.409.report.services.app.size.memory_bytes`; integer, required) — An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400 `invalid_field` (param `size.memory_bytes`): no node would make an instance of it, as none makes a sandbox of it (the node's `SandboxLimitsCreate.memory_bytes`).
          - min 134217728
      - `volumes` (`restoreDatabaseBranch.response.409.report.services.app.volumes`; array<object>, required)
        - `volume` (`restoreDatabaseBranch.response.409.report.services.app.volumes.volume`; string, required)
        - `path` (`restoreDatabaseBranch.response.409.report.services.app.volumes.path`; string, required)
        - `read_only` (`restoreDatabaseBranch.response.409.report.services.app.volumes.read_only`; boolean, required)
        - `nocopy` (`restoreDatabaseBranch.response.409.report.services.app.volumes.nocopy`; unknown, optional) — There only where it was given as `true`.
      - `kind` (`restoreDatabaseBranch.response.409.report.services.app.kind`; string, required)
      - `files` (`restoreDatabaseBranch.response.409.report.services.app.files`; array<object>, required)
        - `path` (`restoreDatabaseBranch.response.409.report.services.app.files.path`; string, required)
        - `mode` (`restoreDatabaseBranch.response.409.report.services.app.files.mode`; integer, required)
        - `uid` (`restoreDatabaseBranch.response.409.report.services.app.files.uid`; integer, required)
        - `gid` (`restoreDatabaseBranch.response.409.report.services.app.files.gid`; integer, required)
        - `content` (`restoreDatabaseBranch.response.409.report.services.app.files.content`; string, optional)
        - `secret` (`restoreDatabaseBranch.response.409.report.services.app.files.secret`; string, optional)
      - `user` (`restoreDatabaseBranch.response.409.report.services.app.user`; string | null, required)
      - `working_dir` (`restoreDatabaseBranch.response.409.report.services.app.working_dir`; string | null, required)
      - `stop` (`restoreDatabaseBranch.response.409.report.services.app.stop`; any of, required)
        - any of: `ServiceStop`, `null`
      - `hostname` (`restoreDatabaseBranch.response.409.report.services.app.hostname`; string | null, required)
      - `regions` (`restoreDatabaseBranch.response.409.report.services.app.regions`; array<string>, required) — In the order na, eu, ap.
      - `scale` (`restoreDatabaseBranch.response.409.report.services.app.scale`; object, required)
        - `min_instances` (`restoreDatabaseBranch.response.409.report.services.app.scale.min_instances`; integer, required) — How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share `max_instances` (two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At most `max_instances`, where that is given, and at most what the account's plan lets an app ask for in a region (`caps.app_instances.limit`: 5, 50 and 500): more is refused, 403 `plan_cap_reached`.
          - min 0
        - `max_instances` (`restoreDatabaseBranch.response.409.report.services.app.scale.max_instances`; integer | null, required) — How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (`caps.app_instances.limit`: 5 on the free plan, 50 on `p20`, 200 on `p100`, 500 on `p300`, 1,000 on `p1000`, 2,000 on `p2000`): more is refused, 403 `plan_cap_reached`, and what an app asked for on a plan that let it is kept, and held to the plan's number. `null`: the plan's number for an app that names none (`caps.app_instances.default`: 2, 10, 20, 50, 100 and 200), or `min_instances` where that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.
          - min 1
        - `concurrency` (`restoreDatabaseBranch.response.409.report.services.app.scale.concurrency`; integer | null, required) — A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more. `null`, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.
          - min 1; max 1000
        - `sleep_after_ms` (`restoreDatabaseBranch.response.409.report.services.app.scale.sleep_after_ms`; integer, required) — After how long without a request an instance stops. One that stays stopped is deleted by its node after `delete_after_ms`, and the next request that needs an instance gets a new one; the instances `min_instances` keeps awake are neither stopped nor deleted.
          - min 0; max 600000
        - `sleep_notice_ms` (`restoreDatabaseBranch.response.409.report.services.app.scale.sleep_notice_ms`; integer | null, required) — How long before an instance stops for being idle the programs connected to its guest's `/run/sbx/awake` are sent the line `sleep N`, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).
          - min 0; max 60000
        - `sleep_hold_max_ms` (`restoreDatabaseBranch.response.409.report.services.app.scale.sleep_hold_max_ms`; integer, required) — How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to `/run/sbx/awake` and sends `+` before it answers a request whose work goes on after the answer, and `-` (or closes the connection, or dies) when that work is done; the instance stops `sleep_after_ms` after the last hold is lowered. Past this time it stops whatever holds it, the programs connected told `sleep N cap` first where `sleep_notice_ms` asks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).
          - min 0; max 900000
        - `delete_after_ms` (`restoreDatabaseBranch.response.409.report.services.app.scale.delete_after_ms`; integer | null, required) — After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400 `invalid_field`), and an instance that is to stay warm is one of `min_instances`. `null`, which is what it is when nothing is said: the hour of the nodes (`--app-delete-after-seconds`). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, which `keys.delete_after_idle_ms` is for.
          - min 1000; max 3600000
        - `suspend_after_ms` (`restoreDatabaseBranch.response.409.report.services.app.scale.suspend_after_ms`; integer | null, optional) — How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's `suspend_after_seconds` is its app's.
          - min 1000; max 86400000
        - `wake_daily_at` (`restoreDatabaseBranch.response.409.report.services.app.scale.wake_daily_at`; string | null, optional) — A time of day in UTC, `HH:MM`, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server's `pg_cron` jobs, whatever this says. Null (the default): none. A database's `wake_daily_at` is its app's.
          - pattern `^([01][0-9]|2[0-3]):[0-5][0-9]$`
      - `keys` (`restoreDatabaseBranch.response.409.report.services.app.keys`; any of, required)
        - any of: `object`, `null`
      - `egress` (`restoreDatabaseBranch.response.409.report.services.app.egress`; object | null, required) — Egress rules as a sandbox has them (`default`, `allow`, `deny`, `http`, `inject`), null when there are none; kept as the calls gave them (a `PATCH` merges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).
        - `default` (`restoreDatabaseBranch.response.409.report.services.app.egress.default`; string | null, optional)
          - one of `"allow"`, `"deny"`, `null`
        - `allow` (`restoreDatabaseBranch.response.409.report.services.app.egress.allow`; array | null, optional)
        - `deny` (`restoreDatabaseBranch.response.409.report.services.app.egress.deny`; array | null, optional)
        - `http` (`restoreDatabaseBranch.response.409.report.services.app.egress.http`; array | null, optional)
        - `inject` (`restoreDatabaseBranch.response.409.report.services.app.egress.inject`; array | null, optional)
        - `deny_ports` (`restoreDatabaseBranch.response.409.report.services.app.egress.deny_ports`; array | null, optional) — Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
      - `metadata` (`restoreDatabaseBranch.response.409.report.services.app.metadata`; map<string>, required)
      - `logs` (`restoreDatabaseBranch.response.409.report.services.app.logs`; object, required) — What the app's log has, each part as it was given or at its default (`AppLogSettings`).
        - `output` (`restoreDatabaseBranch.response.409.report.services.app.logs.output`; boolean, required)
        - `keep` (`restoreDatabaseBranch.response.409.report.services.app.logs.keep`; boolean, required)
        - `requests` (`restoreDatabaseBranch.response.409.report.services.app.logs.requests`; object, required)
          - `sample_rate` (`restoreDatabaseBranch.response.409.report.services.app.logs.requests.sample_rate`; number, required)
            - min 0; max 1
          - `keep_errors` (`restoreDatabaseBranch.response.409.report.services.app.logs.requests.keep_errors`; boolean, required)
      - `public` (`restoreDatabaseBranch.response.409.report.services.app.public`; boolean, required) — Whether it answers at its default domain (`url`).
      - `depends_on` (`restoreDatabaseBranch.response.409.report.services.app.depends_on`; array<object>, required)
        - `service` (`restoreDatabaseBranch.response.409.report.services.app.depends_on.service`; string, required)
        - `condition` (`restoreDatabaseBranch.response.409.report.services.app.depends_on.condition`; string, required)
      - `network` (`restoreDatabaseBranch.response.409.report.services.app.network`; object, required)
        - `aliases` (`restoreDatabaseBranch.response.409.report.services.app.network.aliases`; array<string>, required)
        - `endpoint_mode` (`restoreDatabaseBranch.response.409.report.services.app.network.endpoint_mode`; string, required)
      - `drives` (`restoreDatabaseBranch.response.409.report.services.app.drives`; array<object>, optional) — The Drives its instance mounts (`AppCreate.drives`): none, `[]`, where it names none.
        - `drive` (`restoreDatabaseBranch.response.409.report.services.app.drives.drive`; string, required)
        - `path` (`restoreDatabaseBranch.response.409.report.services.app.drives.path`; string, required)
        - `mode` (`restoreDatabaseBranch.response.409.report.services.app.drives.mode`; string, required)
      - `key_drives` (`restoreDatabaseBranch.response.409.report.services.app.key_drives`; array<object>, optional) — The Drives each key's instance has of its own (`AppCreate.key_drives`): none, `[]`, where it gives none.
        - `name` (`restoreDatabaseBranch.response.409.report.services.app.key_drives.name`; string, required)
        - `path` (`restoreDatabaseBranch.response.409.report.services.app.key_drives.path`; string, required)
        - `size_bytes` (`restoreDatabaseBranch.response.409.report.services.app.key_drives.size_bytes`; integer | null, required)
          - format `int64`
        - `nocopy` (`restoreDatabaseBranch.response.409.report.services.app.key_drives.nocopy`; unknown, optional) — There only where it was given as `true`.
      - `runtime` (`restoreDatabaseBranch.response.409.report.services.app.runtime`; any of, optional) — Its runtime settings (`AppCreate.runtime`). `null`: none.
        - any of: `Runtime`, `null`
      - `traces` (`restoreDatabaseBranch.response.409.report.services.app.traces`; object, optional) — What the app's requests' traces have, each part as it was given or at its default (`AppTraceSettings`): no span where `sample_rate` is 0.
        - `sample_rate` (`restoreDatabaseBranch.response.409.report.services.app.traces.sample_rate`; number, required)
          - min 0; max 1
        - `trust_incoming` (`restoreDatabaseBranch.response.409.report.services.app.traces.trust_incoming`; boolean, required)
  - `volumes` (`restoreDatabaseBranch.response.409.report.volumes`; array<object>, required) — The volumes of the project the services mount.
    - `model` (`restoreDatabaseBranch.response.409.report.volumes.model`; string | null, required) — Its name in the model. Null: made for a path a stateful service mounts with no volume named.
    - `name` (`restoreDatabaseBranch.response.409.report.volumes.name`; string, required) — Its name in the project.
    - `id` (`restoreDatabaseBranch.response.409.report.volumes.id`; string | null, required) — Null: not made yet (`to_make`).
      - pattern `^vol-`
    - `shared` (`restoreDatabaseBranch.response.409.report.volumes.shared`; boolean, required) — Several services mount it, or one with several instances: every instance of each mounts it at once.
    - `status` (`restoreDatabaseBranch.response.409.report.volumes.status`; string, required) — `to_make`: the import makes it (a dry run says so of what it would make); `made`: this import made it; `there`: an earlier import made it, or a volume of its name was there; `external`: the model names it `external`, and the project has it.
      - one of `"to_make"`, `"made"`, `"there"`, `"external"`
    - `used_by` (`restoreDatabaseBranch.response.409.report.volumes.used_by`; array<string>, required)
  - `secrets` (`restoreDatabaseBranch.response.409.report.secrets`; array<object>, required) — The secrets of the model that services are granted.
    - `model` (`restoreDatabaseBranch.response.409.report.secrets.model`; string, required) — Its name in the model.
    - `name` (`restoreDatabaseBranch.response.409.report.secrets.name`; string, required) — The project's secret that holds it: the model's name, with each character a secret's name does not take written as an underscore.
    - `there` (`restoreDatabaseBranch.response.409.report.secrets.there`; boolean, required) — Whether the project has it. An import (not a dry run) with one that is not there is refused 404 `secret_not_found`.
    - `used_by` (`restoreDatabaseBranch.response.409.report.secrets.used_by`; array<string>, required)
  - `left_out` (`restoreDatabaseBranch.response.409.report.left_out`; array<object>, required) — The services of profiles that are not turned on, which the import does not touch.
    - `name` (`restoreDatabaseBranch.response.409.report.left_out.name`; string, required)
    - `profiles` (`restoreDatabaseBranch.response.409.report.left_out.profiles`; array<string>, required)
  - `absent` (`restoreDatabaseBranch.response.409.report.absent`; array<string>, required) — The project's services that the model does not have: kept as they are.
  - `deploy` (`restoreDatabaseBranch.response.409.report.deploy`; string | null, required) — The deploy the import made (`GET /v1/deploys/{id}`). Null: a dry run, or nothing would get a version.
    - pattern `^dpl-`
- `accounts` (`restoreDatabaseBranch.response.409.accounts`; array<object>, optional) — With `sole_owner`: the accounts the user is the only owner of.
  - `id` (`restoreDatabaseBranch.response.409.accounts.id`; string, required)
    - pattern `^acct-[0-9a-hjkmnp-tv-z]{16}$`
  - `name` (`restoreDatabaseBranch.response.409.accounts.name`; string, required)

### 503

`database_unavailable`: it has no app or no Drive now, or no instance to send its last segment of WAL: ask again in a moment; `unavailable`, `node_unavailable`: a node its Drive is forked on, or its app is deployed to, cannot be reached now; `database_archive_unavailable`: its machine did not send its last segment to the archive (the message says what it said), or the archive does not reach a time to the second (or `exact`) yet, its store refusing its segments since before it (`database.archive_failing`; the message says since when and the window's version at or before the time): nothing is done; `database_restore_failed`: the archive's replay to the moment did not end in a promoted PostgreSQL (the message has its last words), or the version of its app on the restored Drive did not serve within five minutes (it did not come up, and its instance was put back: `upgrade_failed`; the instance runs it on the Drive it had; or its PostgreSQL did not answer there), the message says why: the restore is undone, the root as it was; `no_capacity`: no node has room for the machine the replay runs in; `drive_unreadable`: the object store does not give every block of the version the restored Drive is made of (the window's, or the archive's base's snapshot): the root is as it was.

#### Example

```json
{
  "move_id": "string",
  "upgrade_id": "string",
  "move": {
    "object": "move",
    "id": "string",
    "sandbox_id": "string",
    "project_id": "string",
    "from": {
      "id": "string",
      "name": "string"
    },
    "to": {
      "id": "string",
      "name": "string"
    },
    "epoch": 1,
    "step": "string",
    "why": "string",
    "wake": true,
    "from_store": true,
    "release": {},
    "takeover": {},
    "error": {
      "code": "string",
      "message": "string",
      "status": 0,
      "takeover_refused": {
        "code": "string",
        "message": "string",
        "status": 0
      },
      "image": "string",
      "holder": "string",
      "holder_says": "has"
    },
    "attempts": 0,
    "next_attempt_at": "2019-08-24T14:15:22Z",
    "batch": "string",
    "created_at": "2019-08-24T14:15:22Z",
    "updated_at": "2019-08-24T14:15:22Z",
    "ended_at": "2019-08-24T14:15:22Z"
  },
  "lease_until": "2019-08-24T14:15:22Z",
  "active": {
    "name": "string",
    "url": "string",
    "term": 1
  },
  "allowed_hosts": [
    "string"
  ],
  "problems": [
    {
      "at": "string",
      "message": "string"
    }
  ],
  "report": {
    "object": "compose_import",
    "name": "string",
    "dry_run": true,
    "strict": true,
    "profiles": [
      "string"
    ],
    "treatments": {
      "done": 0,
      "adapted": 0,
      "ignored": 0,
      "refused": 0
    },
    "items": [
      {
        "at": "string",
        "treatment": "done",
        "why": "string",
        "change": "string"
      }
    ],
    "services": [
      {
        "name": "string",
        "app_id": "string",
        "status": "created",
        "kind": "service",
        "stateful": true,
        "version": true,
        "items": [
          {
            "at": "string",
            "treatment": "done",
            "why": "string",
            "change": "string"
          }
        ],
        "app": {
          "image": "string",
          "image_pull_secret": "string",
          "start_command": "string",
          "start_args": [
            "string"
          ],
          "port": 0,
          "ready": {
            "http": "string"
          },
          "env": {
            "property1": "string",
            "property2": "string"
          },
          "secrets": {
            "property1": "string",
            "property2": "string"
          },
          "size": {
            "vcpus": 1,
            "memory_bytes": 134217728
          },
          "volumes": [
            {
              "volume": "string",
              "path": "string",
              "read_only": true,
              "nocopy": true
            }
          ],
          "drives": [
            {
              "drive": "string",
              "path": "string",
              "mode": "string"
            }
          ],
          "key_drives": [
            {
              "name": "string",
              "path": "string",
              "size_bytes": 0,
              "nocopy": true
            }
          ],
          "kind": "string",
          "files": [
            {
              "path": "string",
              "content": "string",
              "secret": "string",
              "mode": 0,
              "uid": 0,
              "gid": 0
            }
          ],
          "user": "string",
          "working_dir": "string",
          "stop": {
            "signal": "string",
            "grace_ms": 0
          },
          "hostname": "string",
          "runtime": {
            "ulimits": {
              "property1": {},
              "property2": {}
            },
            "sysctls": {
              "property1": "string",
              "property2": "string"
            },
            "tmpfs": [
              {}
            ],
            "dns": {
              "servers": [
                null
              ],
              "search": [
                null
              ],
              "options": [
                null
              ]
            },
            "shm_size_bytes": 0
          },
          "regions": [
            "string"
          ],
          "scale": {
            "min_instances": 0,
            "max_instances": 1,
            "concurrency": 1,
            "sleep_after_ms": 600000,
            "sleep_notice_ms": 60000,
            "sleep_hold_max_ms": 900000,
            "suspend_after_ms": 1000,
            "wake_daily_at": "string",
            "delete_after_ms": 1000
          },
          "keys": {
            "from": {
              "header": "string"
            },
            "upgrade_on_deploy": true,
            "delete_after_idle_ms": 1000
          },
          "egress": {
            "default": "allow",
            "allow": [
              "string"
            ],
            "deny": [
              "string"
            ],
            "http": [
              {
                "allow": []
              }
            ],
            "inject": [
              {
                "headers": {}
              }
            ],
            "deny_ports": [
              1
            ]
          },
          "metadata": {
            "property1": "string",
            "property2": "string"
          },
          "logs": {
            "output": true,
            "keep": true,
            "requests": {
              "sample_rate": 1,
              "keep_errors": true
            }
          },
          "traces": {
            "sample_rate": 1,
            "trust_incoming": true
          },
          "public": true,
          "depends_on": [
            {
              "service": "string",
              "condition": "string"
            }
          ],
          "network": {
            "aliases": [
              "string"
            ],
            "endpoint_mode": "string"
          }
        }
      }
    ],
    "volumes": [
      {
        "model": "string",
        "name": "string",
        "id": "string",
        "shared": true,
        "status": "to_make",
        "used_by": [
          "string"
        ]
      }
    ],
    "secrets": [
      {
        "model": "string",
        "name": "string",
        "there": true,
        "used_by": [
          "string"
        ]
      }
    ],
    "left_out": [
      {
        "name": "string",
        "profiles": [
          "string"
        ]
      }
    ],
    "absent": [
      "string"
    ],
    "deploy": "string"
  },
  "accounts": [
    {
      "id": "string",
      "name": "string"
    }
  ],
  "error": {
    "type": "string",
    "code": "string",
    "message": "string",
    "param": "string",
    "retryable": true,
    "request_id": "string",
    "docs_url": "string"
  }
}
```

- `error` (`restoreDatabaseBranch.response.503.error`; object, required)
  - `type` (`restoreDatabaseBranch.response.503.error.type`; string, required)
  - `code` (`restoreDatabaseBranch.response.503.error.code`; string, required)
  - `message` (`restoreDatabaseBranch.response.503.error.message`; string, required)
  - `param` (`restoreDatabaseBranch.response.503.error.param`; string | null, required)
  - `retryable` (`restoreDatabaseBranch.response.503.error.retryable`; boolean, required)
  - `request_id` (`restoreDatabaseBranch.response.503.error.request_id`; string, required)
  - `docs_url` (`restoreDatabaseBranch.response.503.error.docs_url`; string | null, required)
- `move_id` (`restoreDatabaseBranch.response.503.move_id`; string, optional) — With `already_moving`: the move of the sandbox that is under way.
- `upgrade_id` (`restoreDatabaseBranch.response.503.upgrade_id`; string, optional) — With `upgrade_in_progress` (the key's upgrade that is not over), `upgrade_started` (the upgrade that has begun) and `rollback_gone` (the upgrade whose revert is refused): that upgrade.
  - pattern `^upg-[0-9a-hjkmnp-tv-z]{16}$`
- `move` (`restoreDatabaseBranch.response.503.move`; object, optional) — With `move_over`, `move_going_back` and `move_taken_over` (`POST /internal/moves/{id}/cancel`): the move, as it stands.
  - `object` (`restoreDatabaseBranch.response.503.move.object`; string, required)
  - `id` (`restoreDatabaseBranch.response.503.move.id`; string, required)
    - pattern `^mov-[0-9a-hjkmnp-tv-z]{16}$`
  - `sandbox_id` (`restoreDatabaseBranch.response.503.move.sandbox_id`; string, required)
  - `project_id` (`restoreDatabaseBranch.response.503.move.project_id`; string, required)
  - `from` (`restoreDatabaseBranch.response.503.move.from`; object, required)
    - `id` (`restoreDatabaseBranch.response.503.move.from.id`; string, required)
    - `name` (`restoreDatabaseBranch.response.503.move.from.name`; string | null, required) — Its name; null for a node that is off the books since.
  - `to` (`restoreDatabaseBranch.response.503.move.to`; object, required)
    - `id` (`restoreDatabaseBranch.response.503.move.to.id`; string, required)
    - `name` (`restoreDatabaseBranch.response.503.move.to.name`; string | null, required) — Its name; null for a node that is off the books since.
  - `epoch` (`restoreDatabaseBranch.response.503.move.epoch`; integer, required) — The epoch the table held the sandbox at when the move began: the old node releases it at it, the new one takes it over one on, the old one takes it back two on, and from the object store three on.
    - min 1
  - `step` (`restoreDatabaseBranch.response.503.move.step`; string, required) — Where it stands: `releasing` (the old node is asked to release it; the table has it there), `taking_over` (the new node is asked to take it over; the table has it there), `reclaiming` (the new node refused it, and the old one is asked to take it back), `restoring` (the old one kept nothing of it, and takes it over from the object store), `done` (on the new node), `failed` (where it was, or back there, or where a failure no time clears or an operator's cancel found it: `error` says why).
  - `why` (`restoreDatabaseBranch.response.503.move.why`; string, required) — What made it: the operator's move, an evacuation, a recovery.
  - `wake` (`restoreDatabaseBranch.response.503.move.wake`; boolean, required) — Whether the new node wakes it: as the call said, or as it was (it ran) when the move began.
  - `from_store` (`restoreDatabaseBranch.response.503.move.from_store`; boolean, required) — The new node takes it from the object store alone.
  - `release` (`restoreDatabaseBranch.response.503.move.release`; object | null, required) — What the old node's release answered (sandboxd/openapi/openapi.json, `releaseSandbox`), without the release's key; null before it answered.
  - `takeover` (`restoreDatabaseBranch.response.503.move.takeover`; object | null, required) — What the takeover that ended it answered (`takeoverSandbox` of the node's document): where its disk and memory came from (`source`), how long each took (`ms`), `memory`; null before.
  - `error` (`restoreDatabaseBranch.response.503.move.error`; one of, required) — Why it failed, of one that failed (the new node's refusal, where it was taken back to the old node); null, of one that is done; of one under way, what the step it is at was last told where it is asked again.
    - one of: `object`, `null`
  - `attempts` (`restoreDatabaseBranch.response.503.move.attempts`; integer, required) — How many times the step it is at was asked without an answer that settles it.
    - min 0
  - `next_attempt_at` (`restoreDatabaseBranch.response.503.move.next_attempt_at`; string | null, required) — When that step is asked again; null where it is not waiting.
    - format `date-time`
  - `batch` (`restoreDatabaseBranch.response.503.move.batch`; string | null, required) — The evacuation (`evc-…`) or recovery (`rcv-…`) it is of.
  - `created_at` (`restoreDatabaseBranch.response.503.move.created_at`; string, required)
    - format `date-time`
  - `updated_at` (`restoreDatabaseBranch.response.503.move.updated_at`; string, required)
    - format `date-time`
  - `ended_at` (`restoreDatabaseBranch.response.503.move.ended_at`; string | null, required)
    - format `date-time`
- `lease_until` (`restoreDatabaseBranch.response.503.lease_until`; string, optional) — With `lease_held`: until when the node may still hold the lease it was granted last, and the time after it for the node to have seen it run out (`recoverNode` is refused until then).
  - format `date-time`
- `active` (`restoreDatabaseBranch.response.503.active`; object | null, optional) — With `standby`: the active copy, as the standby last read the lease; null while no copy holds it.
  - `name` (`restoreDatabaseBranch.response.503.active.name`; string, required)
  - `url` (`restoreDatabaseBranch.response.503.active.url`; string, required)
  - `term` (`restoreDatabaseBranch.response.503.active.term`; integer, required)
    - min 1
- `allowed_hosts` (`restoreDatabaseBranch.response.503.allowed_hosts`; array | null, optional) — With `secret_host_not_allowed`: the hosts the secret may go to, as the secret has them; null where it was given none (the node's `SecretHosts`).
- `problems` (`restoreDatabaseBranch.response.503.problems`; array<object>, optional) — With `invalid_definition`: every problem of the definition, each where it is and what it is.
  - `at` (`restoreDatabaseBranch.response.503.problems.at`; string, required) — Where in the definition, a dotted path (`services.web.port`); empty for the whole of it.
  - `message` (`restoreDatabaseBranch.response.503.problems.message`; string, required)
- `report` (`restoreDatabaseBranch.response.503.report`; object, optional) — With `compose_refused`: the import's report, which says what is refused, why, and what to change.
  - `object` (`restoreDatabaseBranch.response.503.report.object`; string, required)
    - one of `"compose_import"`
  - `name` (`restoreDatabaseBranch.response.503.report.name`; string | null, required) — The model's `name`: each service's label `compose.project`. Null: it has none.
  - `dry_run` (`restoreDatabaseBranch.response.503.report.dry_run`; boolean, required)
  - `strict` (`restoreDatabaseBranch.response.503.report.strict`; boolean, required)
  - `profiles` (`restoreDatabaseBranch.response.503.report.profiles`; array<string>, required)
  - `treatments` (`restoreDatabaseBranch.response.503.report.treatments`; object, required) — How many items of the report have each treatment.
    - `done` (`restoreDatabaseBranch.response.503.report.treatments.done`; integer, required)
      - min 0
    - `adapted` (`restoreDatabaseBranch.response.503.report.treatments.adapted`; integer, required)
      - min 0
    - `ignored` (`restoreDatabaseBranch.response.503.report.treatments.ignored`; integer, required)
      - min 0
    - `refused` (`restoreDatabaseBranch.response.503.report.treatments.refused`; integer, required)
      - min 0
  - `items` (`restoreDatabaseBranch.response.503.report.items`; array<object>, required) — The model's top-level elements: `name`, each volume, network, config and secret, extensions.
    - `at` (`restoreDatabaseBranch.response.503.report.items.at`; string, required) — Where in the model: of a service, its attribute (`ports[0]`, `depends_on.db`, `environment.KEY`), empty for the service as a whole; of the top level, the element (`volumes.db-data`).
    - `treatment` (`restoreDatabaseBranch.response.503.report.items.treatment`; string, required) — `done`: it means the same on the platform; `adapted`: the platform does the same another way; `ignored`: it matters to a local run alone (refused with `strict`); `refused`: the platform cannot do it, and doing without it would let the program go wrong quietly.
      - one of `"done"`, `"adapted"`, `"ignored"`, `"refused"`
    - `why` (`restoreDatabaseBranch.response.503.report.items.why`; string, required)
    - `change` (`restoreDatabaseBranch.response.503.report.items.change`; string | null, required) — Of one that is refused: what to change. Null otherwise.
  - `services` (`restoreDatabaseBranch.response.503.report.services`; array<object>, required) — The services the import takes, in the model's order.
    - `name` (`restoreDatabaseBranch.response.503.report.services.name`; string, required) — The service's name, which is its app's.
    - `app_id` (`restoreDatabaseBranch.response.503.report.services.app_id`; string | null, required) — Its app. Null: a dry run of a service the project does not have.
      - pattern `^app-`
    - `status` (`restoreDatabaseBranch.response.503.report.services.status`; string, required) — What the import does (or, in a dry run, would do) to its app: makes it, writes what changed, or nothing.
      - one of `"created"`, `"changed"`, `"unchanged"`
    - `kind` (`restoreDatabaseBranch.response.503.report.services.kind`; string, required) — `job`: a service of the model waits for it to complete, and it runs to its end in each deploy that needs it.
      - one of `"service"`, `"job"`
    - `stateful` (`restoreDatabaseBranch.response.503.report.services.stateful`; boolean, required) — It mounts a volume of its own: one instance, which has the volume.
    - `version` (`restoreDatabaseBranch.response.503.report.services.version`; boolean, required) — Whether the import's deploy makes a version of it: what its version would be made of, its references resolved, is not what its current version is.
    - `items` (`restoreDatabaseBranch.response.503.report.services.items`; array<object>, required)
      - `at` (`restoreDatabaseBranch.response.503.report.services.items.at`; string, required) — Where in the model: of a service, its attribute (`ports[0]`, `depends_on.db`, `environment.KEY`), empty for the service as a whole; of the top level, the element (`volumes.db-data`).
      - `treatment` (`restoreDatabaseBranch.response.503.report.services.items.treatment`; string, required) — `done`: it means the same on the platform; `adapted`: the platform does the same another way; `ignored`: it matters to a local run alone (refused with `strict`); `refused`: the platform cannot do it, and doing without it would let the program go wrong quietly.
        - one of `"done"`, `"adapted"`, `"ignored"`, `"refused"`
      - `why` (`restoreDatabaseBranch.response.503.report.services.items.why`; string, required)
      - `change` (`restoreDatabaseBranch.response.503.report.services.items.change`; string | null, required) — Of one that is refused: what to change. Null otherwise.
    - `app` (`restoreDatabaseBranch.response.503.report.services.app`; object, required) — The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
      - `image` (`restoreDatabaseBranch.response.503.report.services.app.image`; string | null, required) — What the app's next version is made of, with the seven fields after it: its newest version's, with what was changed since. `null`: the app has no image, and no version.
      - `image_pull_secret` (`restoreDatabaseBranch.response.503.report.services.app.image_pull_secret`; string | null, required) — The name of the secret that holds the credentials of the image's registry. No answer has its value. `null`: none.
      - `start_command` (`restoreDatabaseBranch.response.503.report.services.app.start_command`; any of, required)
        - any of: `StartCommand`, `null`
      - `start_args` (`restoreDatabaseBranch.response.503.report.services.app.start_args`; any of, required) — What follows the image's ENTRYPOINT in the place of its CMD. `null`: the image's CMD, or the whole of `start_command`.
        - any of: `array<string>`, `null`
      - `port` (`restoreDatabaseBranch.response.503.report.services.app.port`; integer | null, required)
      - `ready` (`restoreDatabaseBranch.response.503.report.services.app.ready`; object, required) — How to tell that an instance is up, which a version's template is saved after: exactly one of the three. The first two are asked from outside the instance, so the service has to listen on every address (`0.0.0.0`).
        - `http` (`restoreDatabaseBranch.response.503.report.services.app.ready.http`; string, optional) — A path, beginning with `/`: a `GET` of it on the app's port is answered with a status from 200 to 399.
        - `tcp` (`restoreDatabaseBranch.response.503.report.services.app.ready.tcp`; boolean, optional) — The app's port takes a connection.
          - one of `true`
        - `command` (`restoreDatabaseBranch.response.503.report.services.app.ready.command`; one of, optional) — A command that succeeds in the instance. It is run by the instance's shell: a list of arguments is written as one line for it.
          - one of: `string`, `array<string>`
      - `env` (`restoreDatabaseBranch.response.503.report.services.app.env`; map<string>, required)
      - `secrets` (`restoreDatabaseBranch.response.503.report.services.app.secrets`; map<string>, required) — Names of secrets. No answer has a value.
      - `size` (`restoreDatabaseBranch.response.503.report.services.app.size`; object, required) — What one instance may use at most. It is billed by what it uses.
        - `vcpus` (`restoreDatabaseBranch.response.503.report.services.app.size.vcpus`; integer, required)
          - min 1
        - `memory_bytes` (`restoreDatabaseBranch.response.503.report.services.app.size.memory_bytes`; integer, required) — An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400 `invalid_field` (param `size.memory_bytes`): no node would make an instance of it, as none makes a sandbox of it (the node's `SandboxLimitsCreate.memory_bytes`).
          - min 134217728
      - `volumes` (`restoreDatabaseBranch.response.503.report.services.app.volumes`; array<object>, required)
        - `volume` (`restoreDatabaseBranch.response.503.report.services.app.volumes.volume`; string, required)
        - `path` (`restoreDatabaseBranch.response.503.report.services.app.volumes.path`; string, required)
        - `read_only` (`restoreDatabaseBranch.response.503.report.services.app.volumes.read_only`; boolean, required)
        - `nocopy` (`restoreDatabaseBranch.response.503.report.services.app.volumes.nocopy`; unknown, optional) — There only where it was given as `true`.
      - `kind` (`restoreDatabaseBranch.response.503.report.services.app.kind`; string, required)
      - `files` (`restoreDatabaseBranch.response.503.report.services.app.files`; array<object>, required)
        - `path` (`restoreDatabaseBranch.response.503.report.services.app.files.path`; string, required)
        - `mode` (`restoreDatabaseBranch.response.503.report.services.app.files.mode`; integer, required)
        - `uid` (`restoreDatabaseBranch.response.503.report.services.app.files.uid`; integer, required)
        - `gid` (`restoreDatabaseBranch.response.503.report.services.app.files.gid`; integer, required)
        - `content` (`restoreDatabaseBranch.response.503.report.services.app.files.content`; string, optional)
        - `secret` (`restoreDatabaseBranch.response.503.report.services.app.files.secret`; string, optional)
      - `user` (`restoreDatabaseBranch.response.503.report.services.app.user`; string | null, required)
      - `working_dir` (`restoreDatabaseBranch.response.503.report.services.app.working_dir`; string | null, required)
      - `stop` (`restoreDatabaseBranch.response.503.report.services.app.stop`; any of, required)
        - any of: `ServiceStop`, `null`
      - `hostname` (`restoreDatabaseBranch.response.503.report.services.app.hostname`; string | null, required)
      - `regions` (`restoreDatabaseBranch.response.503.report.services.app.regions`; array<string>, required) — In the order na, eu, ap.
      - `scale` (`restoreDatabaseBranch.response.503.report.services.app.scale`; object, required)
        - `min_instances` (`restoreDatabaseBranch.response.503.report.services.app.scale.min_instances`; integer, required) — How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share `max_instances` (two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At most `max_instances`, where that is given, and at most what the account's plan lets an app ask for in a region (`caps.app_instances.limit`: 5, 50 and 500): more is refused, 403 `plan_cap_reached`.
          - min 0
        - `max_instances` (`restoreDatabaseBranch.response.503.report.services.app.scale.max_instances`; integer | null, required) — How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (`caps.app_instances.limit`: 5 on the free plan, 50 on `p20`, 200 on `p100`, 500 on `p300`, 1,000 on `p1000`, 2,000 on `p2000`): more is refused, 403 `plan_cap_reached`, and what an app asked for on a plan that let it is kept, and held to the plan's number. `null`: the plan's number for an app that names none (`caps.app_instances.default`: 2, 10, 20, 50, 100 and 200), or `min_instances` where that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.
          - min 1
        - `concurrency` (`restoreDatabaseBranch.response.503.report.services.app.scale.concurrency`; integer | null, required) — A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more. `null`, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.
          - min 1; max 1000
        - `sleep_after_ms` (`restoreDatabaseBranch.response.503.report.services.app.scale.sleep_after_ms`; integer, required) — After how long without a request an instance stops. One that stays stopped is deleted by its node after `delete_after_ms`, and the next request that needs an instance gets a new one; the instances `min_instances` keeps awake are neither stopped nor deleted.
          - min 0; max 600000
        - `sleep_notice_ms` (`restoreDatabaseBranch.response.503.report.services.app.scale.sleep_notice_ms`; integer | null, required) — How long before an instance stops for being idle the programs connected to its guest's `/run/sbx/awake` are sent the line `sleep N`, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).
          - min 0; max 60000
        - `sleep_hold_max_ms` (`restoreDatabaseBranch.response.503.report.services.app.scale.sleep_hold_max_ms`; integer, required) — How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to `/run/sbx/awake` and sends `+` before it answers a request whose work goes on after the answer, and `-` (or closes the connection, or dies) when that work is done; the instance stops `sleep_after_ms` after the last hold is lowered. Past this time it stops whatever holds it, the programs connected told `sleep N cap` first where `sleep_notice_ms` asks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).
          - min 0; max 900000
        - `delete_after_ms` (`restoreDatabaseBranch.response.503.report.services.app.scale.delete_after_ms`; integer | null, required) — After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400 `invalid_field`), and an instance that is to stay warm is one of `min_instances`. `null`, which is what it is when nothing is said: the hour of the nodes (`--app-delete-after-seconds`). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, which `keys.delete_after_idle_ms` is for.
          - min 1000; max 3600000
        - `suspend_after_ms` (`restoreDatabaseBranch.response.503.report.services.app.scale.suspend_after_ms`; integer | null, optional) — How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's `suspend_after_seconds` is its app's.
          - min 1000; max 86400000
        - `wake_daily_at` (`restoreDatabaseBranch.response.503.report.services.app.scale.wake_daily_at`; string | null, optional) — A time of day in UTC, `HH:MM`, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server's `pg_cron` jobs, whatever this says. Null (the default): none. A database's `wake_daily_at` is its app's.
          - pattern `^([01][0-9]|2[0-3]):[0-5][0-9]$`
      - `keys` (`restoreDatabaseBranch.response.503.report.services.app.keys`; any of, required)
        - any of: `object`, `null`
      - `egress` (`restoreDatabaseBranch.response.503.report.services.app.egress`; object | null, required) — Egress rules as a sandbox has them (`default`, `allow`, `deny`, `http`, `inject`), null when there are none; kept as the calls gave them (a `PATCH` merges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).
        - `default` (`restoreDatabaseBranch.response.503.report.services.app.egress.default`; string | null, optional)
          - one of `"allow"`, `"deny"`, `null`
        - `allow` (`restoreDatabaseBranch.response.503.report.services.app.egress.allow`; array | null, optional)
        - `deny` (`restoreDatabaseBranch.response.503.report.services.app.egress.deny`; array | null, optional)
        - `http` (`restoreDatabaseBranch.response.503.report.services.app.egress.http`; array | null, optional)
        - `inject` (`restoreDatabaseBranch.response.503.report.services.app.egress.inject`; array | null, optional)
        - `deny_ports` (`restoreDatabaseBranch.response.503.report.services.app.egress.deny_ports`; array | null, optional) — Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
      - `metadata` (`restoreDatabaseBranch.response.503.report.services.app.metadata`; map<string>, required)
      - `logs` (`restoreDatabaseBranch.response.503.report.services.app.logs`; object, required) — What the app's log has, each part as it was given or at its default (`AppLogSettings`).
        - `output` (`restoreDatabaseBranch.response.503.report.services.app.logs.output`; boolean, required)
        - `keep` (`restoreDatabaseBranch.response.503.report.services.app.logs.keep`; boolean, required)
        - `requests` (`restoreDatabaseBranch.response.503.report.services.app.logs.requests`; object, required)
          - `sample_rate` (`restoreDatabaseBranch.response.503.report.services.app.logs.requests.sample_rate`; number, required)
            - min 0; max 1
          - `keep_errors` (`restoreDatabaseBranch.response.503.report.services.app.logs.requests.keep_errors`; boolean, required)
      - `public` (`restoreDatabaseBranch.response.503.report.services.app.public`; boolean, required) — Whether it answers at its default domain (`url`).
      - `depends_on` (`restoreDatabaseBranch.response.503.report.services.app.depends_on`; array<object>, required)
        - `service` (`restoreDatabaseBranch.response.503.report.services.app.depends_on.service`; string, required)
        - `condition` (`restoreDatabaseBranch.response.503.report.services.app.depends_on.condition`; string, required)
      - `network` (`restoreDatabaseBranch.response.503.report.services.app.network`; object, required)
        - `aliases` (`restoreDatabaseBranch.response.503.report.services.app.network.aliases`; array<string>, required)
        - `endpoint_mode` (`restoreDatabaseBranch.response.503.report.services.app.network.endpoint_mode`; string, required)
      - `drives` (`restoreDatabaseBranch.response.503.report.services.app.drives`; array<object>, optional) — The Drives its instance mounts (`AppCreate.drives`): none, `[]`, where it names none.
        - `drive` (`restoreDatabaseBranch.response.503.report.services.app.drives.drive`; string, required)
        - `path` (`restoreDatabaseBranch.response.503.report.services.app.drives.path`; string, required)
        - `mode` (`restoreDatabaseBranch.response.503.report.services.app.drives.mode`; string, required)
      - `key_drives` (`restoreDatabaseBranch.response.503.report.services.app.key_drives`; array<object>, optional) — The Drives each key's instance has of its own (`AppCreate.key_drives`): none, `[]`, where it gives none.
        - `name` (`restoreDatabaseBranch.response.503.report.services.app.key_drives.name`; string, required)
        - `path` (`restoreDatabaseBranch.response.503.report.services.app.key_drives.path`; string, required)
        - `size_bytes` (`restoreDatabaseBranch.response.503.report.services.app.key_drives.size_bytes`; integer | null, required)
          - format `int64`
        - `nocopy` (`restoreDatabaseBranch.response.503.report.services.app.key_drives.nocopy`; unknown, optional) — There only where it was given as `true`.
      - `runtime` (`restoreDatabaseBranch.response.503.report.services.app.runtime`; any of, optional) — Its runtime settings (`AppCreate.runtime`). `null`: none.
        - any of: `Runtime`, `null`
      - `traces` (`restoreDatabaseBranch.response.503.report.services.app.traces`; object, optional) — What the app's requests' traces have, each part as it was given or at its default (`AppTraceSettings`): no span where `sample_rate` is 0.
        - `sample_rate` (`restoreDatabaseBranch.response.503.report.services.app.traces.sample_rate`; number, required)
          - min 0; max 1
        - `trust_incoming` (`restoreDatabaseBranch.response.503.report.services.app.traces.trust_incoming`; boolean, required)
  - `volumes` (`restoreDatabaseBranch.response.503.report.volumes`; array<object>, required) — The volumes of the project the services mount.
    - `model` (`restoreDatabaseBranch.response.503.report.volumes.model`; string | null, required) — Its name in the model. Null: made for a path a stateful service mounts with no volume named.
    - `name` (`restoreDatabaseBranch.response.503.report.volumes.name`; string, required) — Its name in the project.
    - `id` (`restoreDatabaseBranch.response.503.report.volumes.id`; string | null, required) — Null: not made yet (`to_make`).
      - pattern `^vol-`
    - `shared` (`restoreDatabaseBranch.response.503.report.volumes.shared`; boolean, required) — Several services mount it, or one with several instances: every instance of each mounts it at once.
    - `status` (`restoreDatabaseBranch.response.503.report.volumes.status`; string, required) — `to_make`: the import makes it (a dry run says so of what it would make); `made`: this import made it; `there`: an earlier import made it, or a volume of its name was there; `external`: the model names it `external`, and the project has it.
      - one of `"to_make"`, `"made"`, `"there"`, `"external"`
    - `used_by` (`restoreDatabaseBranch.response.503.report.volumes.used_by`; array<string>, required)
  - `secrets` (`restoreDatabaseBranch.response.503.report.secrets`; array<object>, required) — The secrets of the model that services are granted.
    - `model` (`restoreDatabaseBranch.response.503.report.secrets.model`; string, required) — Its name in the model.
    - `name` (`restoreDatabaseBranch.response.503.report.secrets.name`; string, required) — The project's secret that holds it: the model's name, with each character a secret's name does not take written as an underscore.
    - `there` (`restoreDatabaseBranch.response.503.report.secrets.there`; boolean, required) — Whether the project has it. An import (not a dry run) with one that is not there is refused 404 `secret_not_found`.
    - `used_by` (`restoreDatabaseBranch.response.503.report.secrets.used_by`; array<string>, required)
  - `left_out` (`restoreDatabaseBranch.response.503.report.left_out`; array<object>, required) — The services of profiles that are not turned on, which the import does not touch.
    - `name` (`restoreDatabaseBranch.response.503.report.left_out.name`; string, required)
    - `profiles` (`restoreDatabaseBranch.response.503.report.left_out.profiles`; array<string>, required)
  - `absent` (`restoreDatabaseBranch.response.503.report.absent`; array<string>, required) — The project's services that the model does not have: kept as they are.
  - `deploy` (`restoreDatabaseBranch.response.503.report.deploy`; string | null, required) — The deploy the import made (`GET /v1/deploys/{id}`). Null: a dry run, or nothing would get a version.
    - pattern `^dpl-`
- `accounts` (`restoreDatabaseBranch.response.503.accounts`; array<object>, optional) — With `sole_owner`: the accounts the user is the only owner of.
  - `id` (`restoreDatabaseBranch.response.503.accounts.id`; string, required)
    - pattern `^acct-[0-9a-hjkmnp-tv-z]{16}$`
  - `name` (`restoreDatabaseBranch.response.503.accounts.name`; string, required)


Source: https://glac.ai/docs/api/databases/restore-database-branch/index.md