HTTP API Reference

CLI HTTP API v1

nself admin serve [--host 127.0.0.1] [--port 3857] [--allowed-host <name>]… [--timeout 300s] serves one listener. Non-loopback binds require an explicitly configured machine token of at least 32 bytes with no whitespace, and an allowed host on every start, and print a cleartext HTTP warning. Loopback starts resolve or create the machine token and print its file path only. Tokens are never arguments or request log fields. Weak non-loopback tokens are refused with E426 on every start; the Fix points to ~/.nself/mcp-token, created by running nself admin serve on loopback. The listening line prints only after the listener binds successfully. A bind failure returns an error without printing that line.

GET /openapi.json and POST /v1/commands/<token>/<token>… (cmdregistry.RoutePath) require Authorization: Bearer <token>. POST bodies are machine requests with Content-Type: application/json, at most 1 MiB. Requests have optional args (strings), flags (typed values), and confirm (server nonce or plan ID). A leaf plugin without declared parameters instead accepts argv. Unknown members and invalid types are rejected; callers cannot set invoker-owned consent or plan flags.

Document responses use application/json and preserve the envelope bytes from NSELF_V15=1 nself <path> --json. Confirmations and server refusals are v1 envelopes. X-Nself-Exit-Code carries the child exit status or the server error's exit class; X-Nself-Request-Id carries the invocation request ID. A success confirmation issued by the invoker requires HTTP 428 and a second request carrying the returned confirm. One server guard owns confirmations and the shared machine audit log; every call passes through internal/invoke. HTTP 428 comes only from trusted Result.Confirmation, never child data. Envelope keys error, code, class and data are matched exactly, including case.

config set, config trust and config trust dns are cli-only until they gain a confirmation round trip (D-0403/D-0402). They have no HTTP routes exposed or OpenAPI operations in v1.

Accept: application/x-ndjson requests exposed read commands whose effective output is stream, including document commands with an enabled stream override. Transport selection uses the command's effective output and request flags. A stream command selects NDJSON when that media type has positive quality. Other requests use documents when JSON or a JSON wildcard is acceptable; a document command accepting only NDJSON receives 406 E430. Mixed JSON and NDJSON Accept values keep document commands on JSON. Stream commands requested as JSON are refused by the invoker with E421. The response carries the child's JSON stream records and final envelope, flushes each write, and has no invocation timeout. The child is killed within 2 seconds after client disconnect. Once streaming begins the status is 200 and X-Nself-Exit-Code is a trailer carrying the child exit code only when invocation completes without an error. Cancellation or another invocation error sets it to -1. A refusal before the first byte is a normal JSON error response with its mapped status. If a child writes no bytes and returns empty stdout, the server answers with an E422 v1 error envelope and HTTP 502.

Status selection uses error code first: E420/E425/E430 → 400, E426 → 401, E429 → 403, E421/E432 → 404, E424/E460 → 409, E428 → 421, E431 → 503 with Retry-After: 1, E423 → 504. Confirmation success → 428. Remaining error classes map user → 422, auth → 403, destructive_blocked → 409, infra → 502, other → 500. A data envelope maps to 200, including state exits 10–12. HTTP request validation can specialize E430 to 405, 406, 413 or 415.

The host allowlist contains localhost, 127.0.0.1, [::1] and each --allowed-host, with the listener port. Host matching is case-insensitive. Invalid allowed-host values use E430 with Why: "an allowed host is a DNS name, an IPv4 literal or a bracketed IPv6 literal, without scheme, port or path" and Fix: pass --allowed-host <name>; the server adds the port itself. A present Origin must be http://<allowed host>:<port>; null is refused. Requests with more than one Origin header receive HTTP 403 and E429 before authentication. Host, Origin and authentication refusals always use an empty envelope command and a request ID computed from the empty path, independent of route existence. No Access-Control-* header is sent. Middleware order is Host, Origin, AuthHook, method, content type, size, strict decode, Accept, then a maximum of four in-flight invocations. Unknown registry paths return E432; existing but unexposed registry paths return E421 with the exposure reason in cause. Mounted handlers and OpenAPI use the same Host, Origin and AuthHook chain.

AuthHook.Authenticate(*http.Request) (Principal, error) permits P8 to add session authentication and CSRF checks on the same listener. P7 implements bearer authentication with constant-time token comparison. Empty tokens refuse every request. Authentication runs before any body read. Authentication refusals carry WWW-Authenticate: Bearer realm="nself".

The server defaults to a 10-second ReadHeaderTimeout, 30-second ReadTimeout, 60-second IdleTimeout, and no WriteTimeout. Context cancellation shuts it down gracefully for up to 5 seconds before closing active HTTP connections. After the HTTP server stops, shutdown drains invocation handlers, including child cleanup and mutation audit writes, for up to 11 additional seconds (5-second document kill delay plus 5-second audit flock bound plus 1 second). Serve returns after the drain completes; a drain exceeding the cap logs one line. Each request logs one stderr line containing method, path truncated to 200 bytes, status, and duration in milliseconds. No body, header, query string or token is logged. Non-context invocation errors add one stderr line, invoke error: <Go error type name>. The error message is never logged, and the per-request line stays unchanged.

OpenAPI is 3.1.0 with info.version: "1", global bearer security and x-nself-experimental: true. Each exposed document command has one POST whose operationId is cmdregistry.ToolName, request schema is the machine params schema, 200 data references a copied <ToolName>_data component, 428 references the confirmation schema, and default references the error envelope. GET /openapi.json is also documented. OpenAPI v1 is document-only: stream-read commands are served as NDJSON but have no OpenAPI operation in v1. Stream-override flags are described by the stream contract above. Keys are sorted, indentation is two spaces, and the bytes end in a newline. There is no timestamp or CLI version. Under an isolated HOME and plugin directory, served bytes equal .github/openapi.json. Generation rejects exposed command paths whose cmdregistry.ToolName collides with another exposed path or exceeds 64 characters.

Synthetic request and response examples

All examples use fake values. The normal authenticated document request is:

POST /v1/commands/config/get HTTP/1.1
Host: 127.0.0.1:3857
Authorization: Bearer fake-token-0000
Content-Type: application/json
Accept: application/json

{"args":["BASE_DOMAIN"]}

Its 200 response has X-Nself-Exit-Code: 0 and a synthetic envelope:

{"schema_version":"1","command":"config get","data":{"key":"BASE_DOMAIN","value":"fake.example","masked":false,"file":".env"}}

The following request variants illustrate every status class. Error response bodies use the v1 envelope shown after the table; class and exit values follow the error registry. Request IDs shown in headers are synthetic.

HTTP	Request example	Response example
200	Normal request above; a state command can exit 10–12	Data envelope, X-Nself-Exit-Code: 10 for a state exit
400	Same POST, body {"unknown":true}	E420, class user, exit 1
401	Same POST, omit Authorization	E426, class auth, exit 3; WWW-Authenticate: Bearer realm="nself"
403	Same POST, Origin: null	E429, class user, exit 1; other auth errors use class auth
404	POST /v1/commands/nope	E432, class user, exit 1; config/set gives E421 and its exposure reason
405	GET /v1/commands/config/get	E430, class user, exit 1; Allow: POST
406	Same POST, Accept: text/html	E430, class user, exit 1
409	Destructive command POST with expired fake confirmation	E424, class destructive_blocked, exit 4; E460 also maps here
413	Same POST with a body larger than 1 MiB	E430, class user, exit 1
415	Same POST, Content-Type: text/plain	E430, class user, exit 1
421	Same POST, Host: evil.example:3857	E428, class user, exit 1
422	Valid machine request rejected by command validation	Error class user, exit 1
428	Destructive command POST without confirmation	Success confirmation envelope below, exit 0
500	Valid POST whose command reports an unclassified error	Error class other, exit 2
502	Valid POST whose child reports an infrastructure failure	Error class infra, exit 2
503	Fifth POST while four invocations are blocked	E431, class infra, exit 2; Retry-After: 1
504	Valid POST whose document child exceeds its timeout	E423, class infra, exit 2

An E432 example (replace code, message, class and exit for the other error rows):

{"schema_version":"1","command":"","error":{"code":"E432","message":"no such route","class":"user","exit_code":1}}

The synthetic confirmation response to a destructive POST without consent is:

{"schema_version":"1","command":"destroy","data":{"confirmation_required":true,"kind":"request","confirm":"0000000000000000000000000000000000000000000000000000000000000000","side_effect":"destructive","reason":"confirmation required","plan":null}}

Repeat the same request with that synthetic confirm value to illustrate the round trip; real confirmations must come from the running server. A streamed request uses Accept: application/x-ndjson and, when declared by the command, {"flags":{"follow":true}}. Records arrive as separate JSON lines followed by a final v1 envelope; the exit code arrives in the declared trailer.

Operations

One row per operation of the committed OpenAPI document. Side effect is the highest class the operation reaches through its exposed flags; streaming says when Accept: application/x-ndjson selects NDJSON.

Method	Path	Summary	Side effect	Streaming
GET	/openapi.json	Read this OpenAPI document	read	no
POST	/v1/commands/add	Install a plugin or bundle	remote	no
POST	/v1/commands/admin	Manage the nSelf Admin dashboard	read	no
POST	/v1/commands/admin/health	Check Admin service liveness	read	no
POST	/v1/commands/admin/logs	Tail Admin container logs	read	with follow
POST	/v1/commands/admin/projects	Manage multi-project admin configuration	read	no
POST	/v1/commands/admin/projects/add	Add a project to the admin multi-project config	write	no
POST	/v1/commands/admin/projects/list	List configured admin projects	read	no
POST	/v1/commands/admin/projects/remove	Remove a project from admin config	write	no
POST	/v1/commands/admin/start	Start the Admin service	write	no
POST	/v1/commands/admin/stop	Stop the Admin container	write	no
POST	/v1/commands/backup	Backup operations: create, list, restore, verify, prune, config, status, init-key	read	no
POST	/v1/commands/backup/config	View backup configuration	write	no
POST	/v1/commands/backup/create	Create a new backup	remote	no
POST	/v1/commands/backup/drill	Run a DR drill: restore latest backup into scratch DB and measure RTO	write	no
POST	/v1/commands/backup/init-key	Generate age encryption keypair for backups	write	no
POST	/v1/commands/backup/list	List available backups	read	no
POST	/v1/commands/backup/pitr	Point-in-time recovery: enable, disable, status, base-backup, restore	read	no
POST	/v1/commands/backup/pitr/base-backup	Take a manual pg_basebackup snapshot now	write	no
POST	/v1/commands/backup/pitr/disable	Stop WAL archiving (removes PITR config snippet)	write	no
POST	/v1/commands/backup/pitr/enable	Configure WAL archiving and enable PITR	write	no
POST	/v1/commands/backup/pitr/restore	Restore database to a specific point in time	destructive	no
POST	/v1/commands/backup/pitr/status	Show PITR retention window, segment count, and latest WAL timestamp	read	no
POST	/v1/commands/backup/prune	Remove old backups by retention policy	destructive	no
POST	/v1/commands/backup/restore	Restore from a backup	destructive	no
POST	/v1/commands/backup/restore-remote	Restore a backup directly from a remote URL	destructive	no
POST	/v1/commands/backup/resume	Resume an interrupted streaming backup	write	no
POST	/v1/commands/backup/schedule	Schedule recurring streaming backups via systemd timers	write	no
POST	/v1/commands/backup/status	Show backup subsystem status	read	no
POST	/v1/commands/backup/verify	Verify backup integrity	write	no
POST	/v1/commands/build	Compose your infrastructure from .env	write	no
POST	/v1/commands/clean	Remove generated artifacts (docker-compose.yml, nginx configs, build cache)	destructive	no
POST	/v1/commands/config	Manage project configuration	read	no
POST	/v1/commands/config/bundles	Manage and inspect nSelf plugin bundles	read	no
POST	/v1/commands/config/bundles/info	Show bundle details, plugins, and license status	read	no
POST	/v1/commands/config/bundles/install	Install every plugin in a bundle (license-gated, atomic rollback on failure)	write	no
POST	/v1/commands/config/bundles/list	List all available nSelf plugin bundles	read	no
POST	/v1/commands/config/env	Multi-environment management: switch, list, diff, copy	read	no
POST	/v1/commands/config/env/copy	Scaffold a new environment from an existing one	write	no
POST	/v1/commands/config/env/diff	Compare two environment configs side-by-side	read	no
POST	/v1/commands/config/env/explain	Show the effective .env cascade and which file wins	read	no
POST	/v1/commands/config/env/list	List available environments	read	no
POST	/v1/commands/config/env/show	Show current environment config (secrets redacted)	read	no
POST	/v1/commands/config/env/target	Manage control-plane server targets	read	no
POST	/v1/commands/config/env/target/add	Add a server to an environment	remote	no
POST	/v1/commands/config/env/target/list	List servers in the control-plane inventory	read	no
POST	/v1/commands/config/env/target/migrate	Migrate legacy NSELF_DEPLOY_HOST_* env vars to control-plane.yaml	write	no
POST	/v1/commands/config/env/target/probe	Resolve runtime capability for one or more targets	read	no
POST	/v1/commands/config/env/target/remove	Remove a server from an environment	write	no
POST	/v1/commands/config/env/use	Switch active environment	write	no
POST	/v1/commands/config/explain	Explain where a configuration key comes from	read	no
POST	/v1/commands/config/features	Manage CLI-built-in feature flags	read	no
POST	/v1/commands/config/features/disable	Disable a feature flag (records an override)	write	no
POST	/v1/commands/config/features/enable	Enable a feature flag (records an override)	write	no
POST	/v1/commands/config/features/list	List all registered feature flags with effective state	read	no
POST	/v1/commands/config/features/status	Show the effective state for a single flag	read	no
POST	/v1/commands/config/get	Get a single configuration value	read	no
POST	/v1/commands/config/import	Import config from a file into .env	destructive	no
POST	/v1/commands/config/list	List all known config keys with current values	read	no
POST	/v1/commands/config/oauth	Manage OAuth provider tokens	read	no
POST	/v1/commands/config/oauth/refresh	Trigger immediate OAuth token refresh for a provider	remote	no
POST	/v1/commands/config/plugins/audit-tables	Audit np_* table row counts and multi-tenant isolation compliance	read	no
POST	/v1/commands/config/plugins/compat-check	Check installed plugins against the current CLI version	read	no
POST	/v1/commands/config/plugins/count	Show the authoritative plugin counts (free, pro, advertised)	read	no
POST	/v1/commands/config/plugins/disable	Disable a plugin (excluded from compose on next build)	write	no
POST	/v1/commands/config/plugins/enable	Re-enable a previously disabled plugin	write	no
POST	/v1/commands/config/plugins/info	Show detailed plugin information	read	no
POST	/v1/commands/config/plugins/inventory	List installed plugins with version, tier, and status	read	no
POST	/v1/commands/config/plugins/list	List available and installed plugins	read	no
POST	/v1/commands/config/plugins/outdated	List installed plugins with a newer version available	read	no
POST	/v1/commands/config/plugins/refresh	Force refresh the registry cache	write	no
POST	/v1/commands/config/plugins/search	Search plugins by name, description, or tag	read	no
POST	/v1/commands/config/plugins/start	Start a plugin service	write	no
POST	/v1/commands/config/plugins/status	Show plugin status	read	no
POST	/v1/commands/config/plugins/stop	Stop a plugin service	write	no
POST	/v1/commands/config/plugins/update	Update a specific plugin or all plugins	write	no
POST	/v1/commands/config/plugins/updates	Check for available plugin updates	read	no
POST	/v1/commands/config/secrets	Manage encrypted project secrets (age encryption)	read	no
POST	/v1/commands/config/secrets/audit	Report secrets that haven't been rotated in >90 days	read	no
POST	/v1/commands/config/secrets/init	Generate age key and set up .secrets/ directory	write	no
POST	/v1/commands/config/secrets/lint	Check for plaintext secrets in git-tracked files	read	no
POST	/v1/commands/config/secrets/list	List all secrets for an environment	read	no
POST	/v1/commands/config/secrets/list-schedules	List all rotation schedule statuses (alias for: secrets schedule)	read	no
POST	/v1/commands/config/secrets/recipients	Manage age recipients of one secret store	read	no
POST	/v1/commands/config/secrets/rekey	Re-encrypt all secrets, removing a team member's key	destructive	no
POST	/v1/commands/config/secrets/retire	Retire the _PREVIOUS variant of a dual-window rotated secret	destructive	no
POST	/v1/commands/config/secrets/rotate	Rotate a secret to a new value	destructive	no
POST	/v1/commands/config/secrets/rotation-log	Show rotation event log	read	no
POST	/v1/commands/config/secrets/schedule	Add a rotation schedule or show all schedule statuses	write	no
POST	/v1/commands/config/secrets/set	Set a secret value (prompts if value not provided)	destructive	no
POST	/v1/commands/config/secrets/verify	Verify that a named secret exists in the store	read	no
POST	/v1/commands/config/services	Manage optional services	read	no
POST	/v1/commands/config/services/add	Scaffold a custom service (CS_N slot) into the current project	write	no
POST	/v1/commands/config/services/configure	Configure service settings (e.g. email provider presets)	write	no
POST	/v1/commands/config/services/disable	Disable an optional service	write	no
POST	/v1/commands/config/services/enable	Enable an optional service	write	no
POST	/v1/commands/config/services/list	List all optional services with enabled/disabled status	read	no
POST	/v1/commands/config/services/ps	Show status of all nSelf stack services	read	no
POST	/v1/commands/config/services/restart	Restart a named nSelf service	write	no
POST	/v1/commands/config/services/scale	Set the replica count for a named service	write	no
POST	/v1/commands/config/services/start	Start a named nSelf service	write	no
POST	/v1/commands/config/services/stop	Stop a named nSelf service (container preserved)	write	no
POST	/v1/commands/config/services/update	Pull the latest image for a service and restart it	write	no
POST	/v1/commands/config/services/upgrade	Pin a service to a specific image version	write	no
POST	/v1/commands/config/set	Update a configuration value (writes to .env)	destructive	no
POST	/v1/commands/config/show	Show all config key=value pairs (masked by default)	read	no
POST	/v1/commands/config/telemetry	Manage CLI telemetry preferences	read	no
POST	/v1/commands/config/telemetry/off	Disable telemetry (writes to ~/.nself/config.toml)	write	no
POST	/v1/commands/config/telemetry/on	Enable telemetry (writes to ~/.nself/config.toml)	write	no
POST	/v1/commands/config/telemetry/status	Show current telemetry state and anonymous install-ID	read	no
POST	/v1/commands/config/trust/ssl	Manage SSL certificates	read	no
POST	/v1/commands/config/trust/ssl/add	Provision an SSL certificate for a single domain	remote	no
POST	/v1/commands/config/trust/ssl/renew	Renew SSL certificates and reload the serving proxy	remote	no
POST	/v1/commands/config/trust/ssl/setup	Set up SSL certificates via DNS-01 challenge	remote	no
POST	/v1/commands/config/trust/ssl/status	Show SSL certificate status	read	no
POST	/v1/commands/config/trust/status	Show trusted cert CAs, last rotation date, and expiry warnings	read	no
POST	/v1/commands/config/validate	Validate configuration against all registered rules	read	no
POST	/v1/commands/db	Database operations: migrations, backups, restore, seed, shell	read	no
POST	/v1/commands/db/backup	Create pg_dump backup	write	no
POST	/v1/commands/db/backup-sync	Sync local backups to remote storage (cross-region)	remote	no
POST	/v1/commands/db/backup-sync-status	Show cross-region backup sync status	read	no
POST	/v1/commands/db/backup/list	List available backups with size and date	read	no
POST	/v1/commands/db/drift	Schema drift detection: scan np_* tables for Theme 25 column compliance	read	no
POST	/v1/commands/db/drift/fix	Generate migration SQL to fix Theme 25 column drift	write	no
POST	/v1/commands/db/drift/scan	Scan np_* tables for missing Theme 25 columns	read	no
POST	/v1/commands/db/drop	Drop the project database (DESTRUCTIVE)	destructive	no
POST	/v1/commands/db/export	Export a portable bundle from a started project	read	no
POST	/v1/commands/db/fk-index	Audit and create indexes for foreign key columns	read	no
POST	/v1/commands/db/fk-index/apply	Create missing FK indexes	write	no
POST	/v1/commands/db/fk-index/audit	Find FK columns without supporting indexes	read	no
POST	/v1/commands/db/generate	Generate type-safe client SDK types from the live Hasura schema	write	no
POST	/v1/commands/db/generate/vector-search	Generate a k-NN search function for a vector column and track it in Hasura	write	no
POST	/v1/commands/db/hasura	Hasura metadata operations	read	no
POST	/v1/commands/db/hasura/apply-ref	Apply Hasura metadata from a specific git ref	write	no
POST	/v1/commands/db/hasura/console	Open Hasura Console	read	no
POST	/v1/commands/db/hasura/diff	Compare live Hasura metadata against on-disk files	read	no
POST	/v1/commands/db/hasura/git-status	Show git status of the hasura/metadata/ directory	read	no
POST	/v1/commands/db/hasura/metadata	Manage Hasura metadata	read	no
POST	/v1/commands/db/hasura/metadata-drift	Detect drift between live Hasura metadata and committed files	read	no
POST	/v1/commands/db/hasura/metadata/apply	Apply Hasura metadata	remote	no
POST	/v1/commands/db/hasura/metadata/export	Export Hasura metadata to git-friendly sorted YAML	write	no
POST	/v1/commands/db/hasura/metadata/reload	Reload metadata cache	write	no
POST	/v1/commands/db/hasura/permissions	Read Hasura table permissions	read	no
POST	/v1/commands/db/hasura/schema	Read the Hasura GraphQL schema	read	no
POST	/v1/commands/db/hasura/snapshot	Capture or compare Hasura metadata snapshots	write	no
POST	/v1/commands/db/hasura/sync	Export live Hasura metadata and commit to git	write	no
POST	/v1/commands/db/hasura/validate	Validate Hasura metadata consistency and permission coverage	read	no
POST	/v1/commands/db/image/switch	Move the database to the pgvector Postgres image (the old volume is kept)	destructive	no
POST	/v1/commands/db/import/appwrite	Import and verify data from appwrite	write	no
POST	/v1/commands/db/import/firebase	Generate nSelf migration artifacts from a Firebase export	write	no
POST	/v1/commands/db/import/hasura-cloud	Import and verify data from hasura-cloud	write	no
POST	/v1/commands/db/import/nhost	Import and verify data from nhost	write	no
POST	/v1/commands/db/import/nself	Import and verify a portable bundle written by nself db export	write	no
POST	/v1/commands/db/import/postgres	Import and verify data from postgres	write	no
POST	/v1/commands/db/import/supabase	Migrate a Supabase project to nSelf	write	no
POST	/v1/commands/db/lint	Check RLS policies on tenant-scoped tables	read	no
POST	/v1/commands/db/list	List databases in the project Postgres instance	read	no
POST	/v1/commands/db/migrate	Manage database migrations	read	no
POST	/v1/commands/db/migrate/apply	Apply a specific migration file (G-008)	write	no
POST	/v1/commands/db/migrate/audit	Audit migrations for idempotency, rollback files, and checksum drift	read	no
POST	/v1/commands/db/migrate/baseline	Record migration(s) as applied WITHOUT running their SQL	write	no
POST	/v1/commands/db/migrate/create	Create new migration file	write	no
POST	/v1/commands/db/migrate/down	Revert last migration	destructive	no
POST	/v1/commands/db/migrate/generate	Generate a SQL migration from a natural-language description	write	no
POST	/v1/commands/db/migrate/idempotent	Check and optionally rewrite a migration file to be idempotent	write	no
POST	/v1/commands/db/migrate/lint	Refuse migrations with many unguarded CREATE TABLE statements	read	no
POST	/v1/commands/db/migrate/status	Show migration status	read	no
POST	/v1/commands/db/migrate/up	Apply pending migrations	remote	no
POST	/v1/commands/db/pgbouncer	PgBouncer connection pooler operations	read	no
POST	/v1/commands/db/pgbouncer/generate	Write PgBouncer config files to .nself/pgbouncer/	write	no
POST	/v1/commands/db/pgbouncer/status	Show PgBouncer runtime status (SHOW STATS via psql)	read	no
POST	/v1/commands/db/pitr	Point-in-time recovery: status, enable, test, restore	read	no
POST	/v1/commands/db/pitr/enable	Write PITR configuration to .nself/pitr/	write	no
POST	/v1/commands/db/pitr/restore	Restore database to a point in time (--target RFC3339)	destructive	no
POST	/v1/commands/db/pitr/status	Show PITR/WAL archiving status	read	no
POST	/v1/commands/db/pitr/test	Verify WAL archiving is working	write	no
POST	/v1/commands/db/reconcile	Push repo-declared Hasura metadata (permissions, relationships, table tracking) to a live instance	write	no
POST	/v1/commands/db/reset	Drop and recreate database (DESTRUCTIVE)	destructive	no
POST	/v1/commands/db/reset-checksum	Reset stored checksum for a migration (dangerous)	destructive	no
POST	/v1/commands/db/restore	Restore from backup	destructive	no
POST	/v1/commands/db/restore-drill	Run a non-destructive restore drill	write	no
POST	/v1/commands/db/restore-drill-list	List past restore drill results	read	no
POST	/v1/commands/db/rls	Row-Level Security management: audit, apply, rollback	read	no
POST	/v1/commands/db/rls/apply	Enable RLS and apply default policies on tables that are missing them	write	no
POST	/v1/commands/db/rls/apply-table	Enable RLS and apply default policies on a specific table	write	no
POST	/v1/commands/db/rls/audit	List tables with their RLS and policy state	read	no
POST	/v1/commands/db/rls/rollback	Print rollback SQL that removes RLS policies and disables RLS	read	no
POST	/v1/commands/db/seed	Database seeding: run, list, verify, graph	write	no
POST	/v1/commands/db/seed/fixtures	Manage seed fixtures	read	no
POST	/v1/commands/db/seed/fixtures/list	List available fixtures	read	no
POST	/v1/commands/db/seed/fixtures/manifest	Show or store a fixture manifest	write	no
POST	/v1/commands/db/seed/fixtures/run	Run a specific fixture	write	no
POST	/v1/commands/db/seed/fixtures/verify	Verify fixture checksums against a stored manifest	read	no
POST	/v1/commands/db/seed/graph	Show seed dependency graph	read	no
POST	/v1/commands/db/seed/list	List available seeds and fixtures	read	no
POST	/v1/commands/db/seed/matrix	Show the seed environment/file matrix	read	no
POST	/v1/commands/db/seed/run	Execute seeds for current environment	destructive	no
POST	/v1/commands/db/seed/verify	Verify a fixture is deterministic (dry-run replay check)	read	no
POST	/v1/commands/db/soft-delete	Manage soft-delete (deleted_at) patterns across tables	read	no
POST	/v1/commands/db/soft-delete/apply	Add deleted_at column, index, and active view to a table	write	no
POST	/v1/commands/db/soft-delete/audit	Audit tables for soft-delete status	read	no
POST	/v1/commands/db/soft-delete/generate	Print soft-delete migration SQL to stdout	write	no
POST	/v1/commands/db/verify	Verify what a Hasura role can actually reach via role-scoped introspection	read	no
POST	/v1/commands/db/verify-checksums	Verify migration file checksums against stored values	read	no
POST	/v1/commands/deploy	Deploy the stack to a target environment	remote	no
POST	/v1/commands/deploy/access	Manage SSH key access on an already-deployed server	read	no
POST	/v1/commands/deploy/access/grant	Grant a person SSH key access to a host	remote	no
POST	/v1/commands/deploy/access/list	List who has SSH key access to a host	read	no
POST	/v1/commands/deploy/access/revoke	Revoke a person's SSH key access to a host	remote	no
POST	/v1/commands/deploy/check-access	Verify access to configured deploy targets (deprecated: use 'nself env target probe')	read	no
POST	/v1/commands/deploy/environments	List configured deploy environments and server capabilities	read	no
POST	/v1/commands/deploy/health	Run health checks against a target deployment	read	no
POST	/v1/commands/deploy/ops	Deploy with the ops profile to the ops server	remote	no
POST	/v1/commands/deploy/promote	Promote a canary or an environment	remote	no
POST	/v1/commands/deploy/promote-env	Promote one environment to another (e.g. staging to prod)	remote	no
POST	/v1/commands/deploy/promote-env/rollback	Rollback to pre-promotion backup	destructive	no
POST	/v1/commands/deploy/rollback	Roll back the last deployment for a target	destructive	no
POST	/v1/commands/deploy/security/setup	Apply baseline server hardening	read	no
POST	/v1/commands/deploy/status	Show deployment status for a target	read	no
POST	/v1/commands/deploy/targets	List deploy targets without connecting to them	read	no
POST	/v1/commands/deploy/web	Build web apps locally and deploy prebuilt output to Vercel	remote	no
POST	/v1/commands/doctor	Run comprehensive system diagnostics	write	no
POST	/v1/commands/doctor/heal	Run targeted self-healing routines for nSelf components	write	no
POST	/v1/commands/doctor/images	Check availability of every locked image	read	no
POST	/v1/commands/doctor/report	Write a redacted support bundle (tar.gz) to share in an issue	read	no
POST	/v1/commands/doctor/security/audit	Run a read-only security audit	read	no
POST	/v1/commands/doctor/security/status	Show current security posture	read	no
POST	/v1/commands/help/capabilities	Search commands and plugins by what you want to do	read	no
POST	/v1/commands/help/topics	Browse help topics (quickstart, plugins, license, envs, doctor, errors)	read	no
POST	/v1/commands/init	Initialize a new nSelf project	write	no
POST	/v1/commands/init/template	Browse and publish full-stack app templates	read	no
POST	/v1/commands/init/template/info	Show detail for a single template	read	no
POST	/v1/commands/init/template/list	List available app templates	read	no
POST	/v1/commands/init/template/publish	Submit a template to the nSelf registry	remote	no
POST	/v1/commands/init/template/update	Apply incremental migrations for the installed template	destructive	no
POST	/v1/commands/license	Manage license keys for nSelf product bundles	read	no
POST	/v1/commands/license/account	Manage your nSelf account, sessions, licenses, team, and devices	read	no
POST	/v1/commands/license/account/devices	List and revoke registered devices	read	no
POST	/v1/commands/license/account/licenses	List and manage account licenses	read	no
POST	/v1/commands/license/account/status	Show current account summary	read	no
POST	/v1/commands/license/account/team	Manage team members	read	no
POST	/v1/commands/license/add	Add one or more license keys	write	no
POST	/v1/commands/license/clear	Remove all saved license keys	destructive	no
POST	/v1/commands/license/health	Validate format, ping server, and report cache integrity	read	no
POST	/v1/commands/license/import	Import a previously exported license cache file	write	no
POST	/v1/commands/license/list	Show all configured licenses (alias for status)	read	no
POST	/v1/commands/license/migrate	Migrate legacy license key to a nSelf account	remote	no
POST	/v1/commands/license/refresh	Force-refresh license validation against ping.nself.org	write	no
POST	/v1/commands/license/remove	Remove a license key by value or product name	destructive	no
POST	/v1/commands/license/restore	Reactivate dormant plugins with a new license key	write	no
POST	/v1/commands/license/revalidate	Force a fresh validation against ping.nself.org and update the cache	write	no
POST	/v1/commands/license/revoke	Mark local license as revoked and wipe the stored key	destructive	no
POST	/v1/commands/license/set	Replace all keys with a single key	destructive	no
POST	/v1/commands/license/show	Display license tier, bundles, plugins, and cache expiry	read	no
POST	/v1/commands/license/simulate-offline	Simulate being offline for N days (testing only)	write	no
POST	/v1/commands/license/status	Show all configured licenses and plugin coverage	read	no
POST	/v1/commands/license/upgrade	Open pricing page in browser	read	no
POST	/v1/commands/license/validate	Validate key against ping.nself.org	read	no
POST	/v1/commands/logs	View and filter service logs	read	with follow
POST	/v1/commands/mcp/setup	Print or write the MCP client config and AGENTS.md for this project	write	no
POST	/v1/commands/remove	Remove an installed plugin or bundle	destructive	no
POST	/v1/commands/reset	Stop containers, remove all data volumes, and clean generated files	destructive	no
POST	/v1/commands/restart	Smart restart with config change detection	write	no
POST	/v1/commands/start	Boot your nSelf stack	write	no
POST	/v1/commands/status	Show health status of all services	read	no
POST	/v1/commands/status/health	Health check management with continuous monitoring	read	no
POST	/v1/commands/status/health/check	Run all health checks	read	no
POST	/v1/commands/status/health/config	Show health check settings	read	no
POST	/v1/commands/status/health/endpoint	Check an HTTP endpoint	read	no
POST	/v1/commands/status/health/history	Show last 20 health checks	read	no
POST	/v1/commands/status/health/service	Check a single service	read	no
POST	/v1/commands/status/urls	Display all service URLs with route conflict detection	read	no
POST	/v1/commands/stop	Gracefully shut down all services or specific services	destructive	no
POST	/v1/commands/update	Update the nSelf CLI and admin UI	write	no
POST	/v1/commands/update/images	Refresh Docker image digests from registries	write	no
POST	/v1/commands/update/project/detect	Detect v1 artifacts in the current project	read	no
POST	/v1/commands/update/project/from-bash	Migrate a v0.9.9 Bash-era project to the current nSelf CLI	write	no
POST	/v1/commands/update/project/from-v099	Migrate v0.9.9 home-level state (license key, channel, ssh keys) to v1.x layout	write	no
POST	/v1/commands/update/project/rollback	Restore a v1 backup created by migrate run	destructive	no
POST	/v1/commands/update/project/run	Migrate v1 project to v2	write	no
POST	/v1/commands/update/stack	Upgrade the stack with a verified backup and resumable steps	destructive	no
POST	/v1/commands/update/upgrade	Upgrade the nSelf CLI (detects install method)	write	no
POST	/v1/commands/update/verify-sbom	Verify the SBOM signature for a CLI release	read	no

Plugin commands. Installed plugins add routes by the same RoutePath rule. This page is generated from the builtin registry alone, so it never lists them; each plugin's wiki page lists its own in its machine-surface region, for example the CI plugin page.