{"service":"fullstacked-cloud-docs","version":"1.22.3","environment":"live","generatedAt":"2026-10-24T09:39:33.057Z","formats":{"html":"https://docs.fullstacked.cloud/","markdown":"https://docs.fullstacked.cloud/?format=md","json":"https://docs.fullstacked.cloud/?format=json"},"services":{"console":"https://console.fullstacked.cloud","auth":"https://auth.fullstacked.cloud","git":"https://git.fullstacked.cloud","tunnels":"https://tunnels.fullstacked.cloud","tunnelsHost":"tunnels.fullstacked.cloud","mcp":"https://mcp.fullstacked.cloud","install":"https://install.fullstacked.cloud","docs":"https://docs.fullstacked.cloud"},"runtime":{"version":"1.0.0-alpha.1844","guide":"https://docs.fullstacked.cloud/runtime?format=md"},"dataEngineLimits":{"postgres":{"image":"postgres:18.6-alpine","port":5432,"memoryMB":256,"cpus":2,"pids":256},"redis":{"image":"redis:8.10.2-alpine","port":6379,"memoryMB":256,"cpus":1,"pids":128},"mongodb":{"image":"mongo:8.3.11-noble","port":27017,"memoryMB":512,"cpus":2,"pids":512},"s3":{"image":"rustfs/rustfs:1.0.0","port":9000,"memoryMB":768,"cpus":2,"pids":1024}},"projectRuntimeEnv":[{"name":"TUNNELS_HOST","injectedBy":"GET /api/v1/projects/:id/env","description":"Tunnels hub host for tunnel.register from fullstacked/tunnel."},{"name":"AUTH_HOST","injectedBy":"GET /api/v1/projects/:id/env","description":"Bare host of the Authentication service."},{"name":"AUTH_URL","injectedBy":"GET /api/v1/projects/:id/env","description":"Base URL of the Authentication service (GET ${AUTH_URL}/api/v1/me)."},{"name":"DOCS_URL","injectedBy":"GET /api/v1/projects/:id/env","description":"Base URL of this documentation (?format=md | ?format=json)."},{"name":"AUTH_TOKEN","injectedBy":"Client GUI / action runner at launch (in memory, never stored)","description":"The signed-in user's fsc_* bearer token: Authorization: Bearer ${AUTH_TOKEN}."}],"topics":[{"slug":"api-reference","title":"Platform API Reference","url":"https://docs.fullstacked.cloud/api-reference","markdownUrl":"https://docs.fullstacked.cloud/api-reference?format=md","jsonUrl":"https://docs.fullstacked.cloud/api-reference?format=json","markdown":"# Platform API Reference\n\nEvery public endpoint of the FullStacked Cloud fleet in this environment. Project code calls them with absolute URLs (`process.env.AUTH_URL`, ...) and `Authorization: Bearer ${process.env.AUTH_TOKEN}`. Machine-readable: `https://docs.fullstacked.cloud/api/v1/endpoints`.\n\n## auth (`https://auth.fullstacked.cloud`)\n\n| Method | Path | Auth | Summary |\n| :--- | :--- | :--- | :--- |\n| `GET` | `/api/v1/me` | Bearer fsc_* (AUTH_TOKEN) | Profile of the bearer's principal: identity only, never grants or resources. BYOA principals add authority_id and omit email_verified, plan and plan_name. |\n| `GET` | `/api/v1/user/access` | Bearer fsc_* (AUTH_TOKEN) | Effective access of the caller: principal, user, billing, groups, global_permissions and resources (projects, tunnels, data, mcp). Narrow with ?resource_type=projects\\|tunnels\\|data\\|mcp. |\n| `POST` | `/v1/auth/exchange/token` | Public (PKCE code_verifier) | Redeems a single-use fsc_exc_ exchange token with its PKCE code_verifier: a BYOA sign-in returns an fsc_ath_<slug>_ session token, a session handoff a fresh fsc_ses_ token. |\n| `POST` | `/v1/authorities/:id/token` | X-FullStacked-Authority-Key, or Bearer fsc_* of an authority administrator | Server-to-server: an enterprise IdP mints a PKCE-bound fsc_exc_ exchange token for { userId, email?, name?, groups?, ttl?, codeChallenge, metadata? }. |\n| `POST` | `/v1/authorities/:id/validate` | X-FullStacked-Authority-Key, or Bearer fsc_* of an authority administrator | Validates an fsc_ath_<slug>_ token issued for this authority and returns its claims (userId, email, name, groups, tokenId, issuedAt, expiresAt, metadata). |\n| `POST` | `/v1/authorities/:id/revoke` | X-FullStacked-Authority-Key, or Bearer fsc_* of an authority administrator | Revokes the authority's tokens by { userId }, by { token }, or { all: true }. |\n| `POST` | `/v1/auth/logout` | Bearer fsc_* | Revokes the bearer token and, unless { keepClerkSession: true }, its Clerk sign-in. |\n| `GET` | `/v1/tokens` | Bearer fsc_* (usr_ user) | Lists the caller's active tokens (sessions, PATs, agent and edge tokens); OAuth app connections are not included. |\n| `POST` | `/v1/tokens` | Bearer fsc_* (usr_ user) | Mints a token { type: \"pat\" \\| \"agent\" \\| \"edge\", name?, ttl?, scopes? (agent), edgeId? (edge) }; the raw token is returned once (201). |\n| `DELETE` | `/v1/tokens/:id` | Bearer fsc_* (usr_ user) | Revokes one of the caller's tokens. |\n| `GET` | `/v1/billing` | Bearer fsc_* | The caller's effective plan (base \\| pro), quota limits and counted usage. |\n| `GET` | `/v1/grants` | Bearer fsc_* (usr_ user) | Lists grants on assets the caller manages, filtered by ?principal_id=, ?resource_type= and ?resource_id=. |\n| `PUT` | `/v1/grants` | Bearer fsc_* (usr_ user) | Shares an asset: { principal (user id or email), resourceType, resourceId, permissions, branches?, tags? }. An unknown email becomes a pending invitation. |\n| `DELETE` | `/v1/grants` | Bearer fsc_* (usr_ user) | Removes a grant, keyed by principal, resource type and id (query or JSON body). |\n| `GET` | `/v1/devices` | Bearer fsc_* | The caller's registered Client GUI devices. |\n| `PATCH` | `/v1/devices/:id` | Bearer fsc_* | Renames one of the caller's devices ({ name }). |\n| `DELETE` | `/v1/devices/:id` | Bearer fsc_* | Forgets a device; it is registered again on its next report. |\n| `GET` | `/.well-known/oauth-authorization-server` | Public | OAuth 2.1 authorization server metadata (authorize, token, register and revoke endpoints) used by MCP clients. |\n\n## git (`https://git.fullstacked.cloud`)\n\n| Method | Path | Auth | Summary |\n| :--- | :--- | :--- | :--- |\n| `GET` | `/api/v1/projects/:id/env` | Bearer fsc_* | The project's resolved runtime environment: DATA_* wiring and tokens of linked instances, platform URLs (AUTH_URL, AUTH_HOST, TUNNELS_HOST, DOCS_URL) and custom variables. ?format=json\\|dotenv; never contains AUTH_TOKEN. |\n| `PUT` | `/api/v1/projects/:id/env` | Bearer fsc_* | Merges { variables?, mappings? } into the project's environment config (null removes a key). Needs write. |\n| `GET` | `/api/v1/projects/:id/actions` | Bearer fsc_* | Actions compiled in a release (?tag=, default the newest release the caller can access). |\n| `POST` | `/api/v1/projects/:id/actions/:name/run` | Bearer fsc_* | Runs a release's action with the caller's own token and data wiring; answers 200 with the run result even when the run failed or timed out. |\n| `GET` | `/api/v1/projects/:id/actions/runs` | Bearer fsc_* | Past action runs, filtered by ?tag=, ?action=, ?status= and ?limit=. |\n| `GET` | `/api/v1/projects/:id/actions/runs/:runId` | Bearer fsc_* | One action run. |\n| `GET` | `/api/v1/projects` | Bearer fsc_* | Projects the caller owns or holds any tier on (?filter= on title, name, description). |\n| `POST` | `/api/v1/projects` | Bearer fsc_* | Creates a project { name, title?, description?, default_branch?, template?, owner? } (201). |\n| `GET` | `/api/v1/projects/:id` | Bearer fsc_* | Project details (release-only consumers get the summary). |\n| `PATCH` | `/api/v1/projects/:id` | Bearer fsc_* | Updates { title?, description? } (write) or renames { name } (admin). |\n| `DELETE` | `/api/v1/projects/:id` | Bearer fsc_* | Deletes the project; needs admin and { confirm: \"<owner>/<name>\" }. |\n| `PUT` | `/api/v1/projects/:id/data-links` | Bearer fsc_* | Links a managed data instance to the project ({ data_instance: <UUID> }). |\n| `DELETE` | `/api/v1/projects/:id/data-links` | Bearer fsc_* | Unlinks a data instance (?data_instance=<UUID> or JSON body). |\n| `GET` | `/api/v1/projects/:id/branches` | Bearer fsc_* | Branches. |\n| `POST` | `/api/v1/projects/:id/branches` | Bearer fsc_* | Creates a branch { name, from? } (201). |\n| `GET` | `/api/v1/projects/:id/tags` | Bearer fsc_* | Tags. |\n| `POST` | `/api/v1/projects/:id/tags` | Bearer fsc_* | Creates a tag { name, message?, ref? } (201); a v* tag enqueues a release build. |\n| `POST` | `/api/v1/projects/:id/validate-diagrams` | Bearer fsc_* | Validates ```mermaid blocks in the branch's Markdown files ({ branch?, file_path? }). |\n| `GET` | `/api/v1/projects/:id/files` | Bearer fsc_* | Dev-state file tree (?branch=&path=&recursive=&ref=), submodules included. |\n| `GET` | `/api/v1/projects/:id/files/content` | Bearer fsc_* | Reads a dev-state file (?branch=&path=&ref=). |\n| `PUT` | `/api/v1/projects/:id/files/content` | Bearer fsc_* | Writes a dev-state file { path, content, encoding?: utf-8 \\| base64, base_sha256?, branch? }, broadcast to live sync clients (needs dev_sync). |\n| `DELETE` | `/api/v1/projects/:id/files/content` | Bearer fsc_* | Deletes a dev-state file (?branch=&path=). |\n| `GET` | `/api/v1/projects/:id/diff` | Bearer fsc_* | Uncommitted dev-state changes against HEAD (?branch=). |\n| `POST` | `/api/v1/projects/:id/commit` | Bearer fsc_* | Commits the dev state { message, branch? } (201; needs write). |\n| `POST` | `/api/v1/projects/:id/stash` | Bearer fsc_* | Stashes the dev state { branch?, message? }. |\n| `POST` | `/api/v1/projects/:id/revert` | Bearer fsc_* | Discards dev-state changes back to HEAD { branch? }. |\n| `GET` | `/api/v1/projects/:id/releases` | Bearer fsc_* (optional on public release projects) | Release builds (v* tags) visible to the caller. |\n| `GET` | `/api/v1/projects/:id/releases/latest` | Bearer fsc_* (optional on public release projects) | Newest succeeded release, with its artifact for ?runtime=<version>. |\n| `GET` | `/api/v1/projects/:id/releases/tags/:tag` | Bearer fsc_* (optional on public release projects) | One release's metadata (?runtime=<version>). |\n| `GET` | `/api/v1/projects/:id/releases/tags/:tag/artifact` | Bearer fsc_* (optional on public release projects) | Downloads the release .tar.gz compiled for ?runtime=<version> (compiled on demand). |\n| `GET` | `/api/v1/projects/:id/releases/tags/:tag/log` | Bearer fsc_* (optional on public release projects) | The release's build log (text/plain). |\n| `WS` | `/api/v1/projects/:id/sync` | Bearer fsc_* (or the fsc-sync subprotocol token / ?access_token=) | Live dev-state file sync for ?branch= (default branch otherwise); needs dev_sync. |\n| `GET` | `/:owner/:repo/info/refs` | Basic (fsc_* token as password) or Bearer fsc_* | Git Smart HTTP for the git CLI (clone, fetch, push); POST git-upload-pack and git-receive-pack follow on the same path. |\n\n## tunnels (`https://tunnels.fullstacked.cloud`)\n\n| Method | Path | Auth | Summary |\n| :--- | :--- | :--- | :--- |\n| `WS` | `/` | Authorization: <fsc_* token>:<tun_* token> (Bearer prefix optional) | Multiplexed tunnel session dialed by fullstacked/tunnel: each registered tunnel keeps a WebSocket session (more under load), authenticated once at the upgrade, and every TCP/HTTP/WS connection to the tunnel name is a stream on it, to a data instance or Edge tunnel. |\n| `GET` | `/api/v1/edges` | Bearer fsc_* | Edge machines visible to the caller. |\n| `POST` | `/api/v1/edges` | Bearer fsc_* | Registers an Edge { name } (201); its daemon then authenticates with an fsc_edge_ token from auth POST /v1/tokens. |\n| `GET` | `/api/v1/edges/:id` | Bearer fsc_* | One Edge. |\n| `POST` | `/api/v1/edges/:id/roll` | Bearer fsc_* | Rotates an Edge's edg_ key (owner or can_register grantee): the lifeline is severed, tunnels and grants stay; the daemon needs a fresh fsc_edge_ token. |\n| `DELETE` | `/api/v1/edges/:id` | Bearer fsc_* | Deletes an Edge (owner or can_register grantee). |\n| `GET` | `/api/v1/tunnels` | Bearer fsc_* | LAN tunnels visible to the caller (?edgeId=); managed data tunnels are not listed. |\n| `POST` | `/api/v1/tunnels` | Bearer fsc_* | Creates a tunnel { name, edgeId, internalHost, internalPort } under an Edge the caller manages (201). |\n| `GET` | `/api/v1/tunnels/:id` | Bearer fsc_* | One tunnel. |\n| `POST` | `/api/v1/tunnels/test` | Bearer fsc_* | Reachability of { tunnelId }, { token }, or a candidate { edgeId, internalHost, internalPort }: for a tunnel under an Edge it reports whether the Edge daemon is connected, without probing the target. |\n| `POST` | `/api/v1/tunnels/:id/roll` | Bearer fsc_* | Rolls the tunnel's tun_ token. |\n| `DELETE` | `/api/v1/tunnels/:id` | Bearer fsc_* | Deletes a tunnel. |\n\n## data (`https://tunnels.fullstacked.cloud`)\n\n| Method | Path | Auth | Summary |\n| :--- | :--- | :--- | :--- |\n| `GET` | `/api/v1/data` | Bearer fsc_* | Managed data instances visible to the caller (?engine=). |\n| `POST` | `/api/v1/data/provision` | Bearer fsc_* | Provisions an isolated instance { engine: postgres \\| redis \\| mongodb \\| s3, label? } (201). |\n| `GET` | `/api/v1/data/:id` | Bearer fsc_* | One instance. |\n| `DELETE` | `/api/v1/data/:id` | Bearer fsc_* | Deprovisions an instance (owner only, 204). |\n| `GET` | `/api/v1/data/:id/connection` | Bearer fsc_* | Connection parameters, DATA_* variables and fullstacked/tunnel snippets for ?access_level=rw\\|ro within the caller's permission. |\n| `GET` | `/api/v1/data/:id/schema` | Bearer fsc_* | Introspects tables, keys, collections or buckets (?schema=). |\n| `POST` | `/api/v1/data/:id/query` | Bearer fsc_* | Runs one operation: { sql, params? } (postgres), { command } (redis), { operation, collection, ... } (mongodb) or { operation, key?, prefix?, ... } (s3). |\n\n## mcp (`https://mcp.fullstacked.cloud`)\n\n| Method | Path | Auth | Summary |\n| :--- | :--- | :--- | :--- |\n| `POST` | `/mcp` | Bearer fsc_* (OAuth-connected AI apps hold agent tokens) | Streamable HTTP JSON-RPC 2.0 MCP endpoint: docs_list / docs_get (this documentation, open to every token), projects_*, data_*, tunnels_*, users_* and auth_get_my_access tools, plus fullstacked:// resources (fullstacked://docs/{topic} included). |\n| `DELETE` | `/mcp` | Bearer fsc_* | Terminates the MCP session named by the Mcp-Session-Id header (204). |\n| `GET` | `/sse` | Bearer fsc_* | HTTP+SSE transport (2024-11-05): opens the event stream and announces the /messages?sessionId= endpoint. |\n| `POST` | `/messages` | Bearer fsc_* | Posts a JSON-RPC message for an SSE session (?sessionId=); answered on the stream. |\n| `GET` | `/.well-known/oauth-protected-resource` | Public | RFC 9728 protected resource metadata pointing AI apps to the Auth OAuth server. |\n| `GET` | `/api/v1/audit` | Bearer fsc_* | The caller's own agent audit trail of MCP tool calls (?limit=, default 100). |\n\n## install (`https://install.fullstacked.cloud`)\n\n| Method | Path | Auth | Summary |\n| :--- | :--- | :--- | :--- |\n| `GET` | `/` | Public | The Client GUI installer: an ES module evaluated by the FullStacked runtime through exec; ?force=1 reinstalls. |\n| `GET` | `/deeplink` | Public | HTML launcher that opens the installer in the FullStacked runtime (?authority=&auth= for a BYOA sign-in). |\n| `GET` | `/v1/install-deeplink` | Public (30 requests/minute per IP) | A signed exec deeplink for the installer, valid one hour (?authority=&auth= must name a registered authority URL). |\n| `GET` | `/manifest.json` | Public | Runtime-aware Client GUI release manifest (?runtime=<version>). |\n| `GET` | `/releases/:file` | Public | Downloads a Client GUI archive cloud-client-v<version>-rt.<runtime>.tar.gz. |\n\n## docs (`https://docs.fullstacked.cloud`)\n\n| Method | Path | Auth | Summary |\n| :--- | :--- | :--- | :--- |\n| `GET` | `/` | Public | The documentation portal: HTML, ?format=md (Markdown for agents) or ?format=json. |\n| `GET` | `/:topic` | Public | One topic guide (runtime, project-runtime, me, data, ...) as HTML, md or json. |\n| `GET` | `/api/v1/endpoints` | Public | This endpoint catalog as JSON. |\n| `GET` | `/healthz` | Public | Health check. |\n| `GET` | `/version` | Public | Service version. |\n\n## Details\n\n### GET /api/v1/me\n\nProfile of the bearer's principal: identity only, never grants or resources. BYOA principals add authority_id and omit email_verified, plan and plan_name.\n\n- **Service**: `auth` (`https://auth.fullstacked.cloud`)\n- **Auth**: Bearer fsc_* (AUTH_TOKEN)\n- **Aliases**: `/v1/me`\n- **In project code**: `${process.env.AUTH_URL}/api/v1/me`\n- **Pitfall**: A relative fetch(\"/api/v1/me\") reads the project's own static files: always prefix process.env.AUTH_URL.\n\nResponse:\n\n```json\n{\n  \"status\": \"success\",\n  \"data\": {\n    \"id\": \"usr_0123456789abcdef01234567\",\n    \"username\": \"alice\",\n    \"slug\": \"alice\",\n    \"name\": \"Alice\",\n    \"email\": \"alice@example.com\",\n    \"email_verified\": true,\n    \"avatar_url\": null,\n    \"type\": \"user\",\n    \"status\": \"active\",\n    \"plan\": \"base\",\n    \"plan_name\": \"Base\",\n    \"has_run_client_gui\": true,\n    \"restricted\": false,\n    \"created_at\": \"2026-09-20T14:32:00.000Z\"\n  }\n}\n```\n\nindexTs:\n\n```ts\nconst res = await fetch(`${process.env.AUTH_URL}/api/v1/me`, {\n    headers: { Authorization: `Bearer ${process.env.AUTH_TOKEN}` },\n});\nconst { data: user } = await res.json();\n```\n\ncurl:\n\n```bash\ncurl -sS -H \"Authorization: Bearer $AUTH_TOKEN\" \"https://auth.fullstacked.cloud/api/v1/me\"\n```\n\n### GET /api/v1/user/access\n\nEffective access of the caller: principal, user, billing, groups, global_permissions and resources (projects, tunnels, data, mcp). Narrow with ?resource_type=projects|tunnels|data|mcp.\n\n- **Service**: `auth` (`https://auth.fullstacked.cloud`)\n- **Auth**: Bearer fsc_* (AUTH_TOKEN)\n- **In project code**: `${process.env.AUTH_URL}/api/v1/user/access`\n\ncurl:\n\n```bash\ncurl -sS -H \"Authorization: Bearer $AUTH_TOKEN\" \"https://auth.fullstacked.cloud/api/v1/user/access?resource_type=projects\"\n```\n\n### POST /v1/auth/exchange/token\n\nRedeems a single-use fsc_exc_ exchange token with its PKCE code_verifier: a BYOA sign-in returns an fsc_ath_<slug>_ session token, a session handoff a fresh fsc_ses_ token.\n\n- **Service**: `auth` (`https://auth.fullstacked.cloud`)\n- **Auth**: Public (PKCE code_verifier)\n- **In project code**: `${process.env.AUTH_URL}/v1/auth/exchange/token`\n\nRequest:\n\n```json\n{\n  \"exchangeToken\": \"fsc_exc_...\",\n  \"codeVerifier\": \"...\"\n}\n```\n\n### POST /v1/authorities/:id/token\n\nServer-to-server: an enterprise IdP mints a PKCE-bound fsc_exc_ exchange token for { userId, email?, name?, groups?, ttl?, codeChallenge, metadata? }.\n\n- **Service**: `auth` (`https://auth.fullstacked.cloud`)\n- **Auth**: X-FullStacked-Authority-Key, or Bearer fsc_* of an authority administrator\n\n### POST /v1/authorities/:id/validate\n\nValidates an fsc_ath_<slug>_ token issued for this authority and returns its claims (userId, email, name, groups, tokenId, issuedAt, expiresAt, metadata).\n\n- **Service**: `auth` (`https://auth.fullstacked.cloud`)\n- **Auth**: X-FullStacked-Authority-Key, or Bearer fsc_* of an authority administrator\n\nRequest:\n\n```json\n{\n  \"token\": \"fsc_ath_acme_...\"\n}\n```\n\ncurl:\n\n```bash\ncurl -sS -X POST -H \"X-FullStacked-Authority-Key: $AUTHORITY_KEY\" -H \"Content-Type: application/json\" -d '{\"token\":\"fsc_ath_...\"}' \"https://auth.fullstacked.cloud/v1/authorities/<authorityId>/validate\"\n```\n\n### POST /v1/authorities/:id/revoke\n\nRevokes the authority's tokens by { userId }, by { token }, or { all: true }.\n\n- **Service**: `auth` (`https://auth.fullstacked.cloud`)\n- **Auth**: X-FullStacked-Authority-Key, or Bearer fsc_* of an authority administrator\n\n### POST /v1/auth/logout\n\nRevokes the bearer token and, unless { keepClerkSession: true }, its Clerk sign-in.\n\n- **Service**: `auth` (`https://auth.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\nResponse:\n\n```json\n{\n  \"status\": \"revoked\"\n}\n```\n\n### GET /v1/tokens\n\nLists the caller's active tokens (sessions, PATs, agent and edge tokens); OAuth app connections are not included.\n\n- **Service**: `auth` (`https://auth.fullstacked.cloud`)\n- **Auth**: Bearer fsc_* (usr_ user)\n\n### POST /v1/tokens\n\nMints a token { type: \"pat\" | \"agent\" | \"edge\", name?, ttl?, scopes? (agent), edgeId? (edge) }; the raw token is returned once (201).\n\n- **Service**: `auth` (`https://auth.fullstacked.cloud`)\n- **Auth**: Bearer fsc_* (usr_ user)\n\n### DELETE /v1/tokens/:id\n\nRevokes one of the caller's tokens.\n\n- **Service**: `auth` (`https://auth.fullstacked.cloud`)\n- **Auth**: Bearer fsc_* (usr_ user)\n\n### GET /v1/billing\n\nThe caller's effective plan (base | pro), quota limits and counted usage.\n\n- **Service**: `auth` (`https://auth.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### GET /v1/grants\n\nLists grants on assets the caller manages, filtered by ?principal_id=, ?resource_type= and ?resource_id=.\n\n- **Service**: `auth` (`https://auth.fullstacked.cloud`)\n- **Auth**: Bearer fsc_* (usr_ user)\n\n### PUT /v1/grants\n\nShares an asset: { principal (user id or email), resourceType, resourceId, permissions, branches?, tags? }. An unknown email becomes a pending invitation.\n\n- **Service**: `auth` (`https://auth.fullstacked.cloud`)\n- **Auth**: Bearer fsc_* (usr_ user)\n\n### DELETE /v1/grants\n\nRemoves a grant, keyed by principal, resource type and id (query or JSON body).\n\n- **Service**: `auth` (`https://auth.fullstacked.cloud`)\n- **Auth**: Bearer fsc_* (usr_ user)\n\n### GET /v1/devices\n\nThe caller's registered Client GUI devices.\n\n- **Service**: `auth` (`https://auth.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### PATCH /v1/devices/:id\n\nRenames one of the caller's devices ({ name }).\n\n- **Service**: `auth` (`https://auth.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### DELETE /v1/devices/:id\n\nForgets a device; it is registered again on its next report.\n\n- **Service**: `auth` (`https://auth.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### GET /.well-known/oauth-authorization-server\n\nOAuth 2.1 authorization server metadata (authorize, token, register and revoke endpoints) used by MCP clients.\n\n- **Service**: `auth` (`https://auth.fullstacked.cloud`)\n- **Auth**: Public\n- **Aliases**: `/.well-known/openid-configuration`\n\n### GET /api/v1/projects/:id/env\n\nThe project's resolved runtime environment: DATA_* wiring and tokens of linked instances, platform URLs (AUTH_URL, AUTH_HOST, TUNNELS_HOST, DOCS_URL) and custom variables. ?format=json|dotenv; never contains AUTH_TOKEN.\n\n- **Service**: `git` (`https://git.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\ncurl:\n\n```bash\ncurl -sS -H \"Authorization: Bearer $AUTH_TOKEN\" \"https://git.fullstacked.cloud/api/v1/projects/<projectId>/env?format=dotenv\"\n```\n\n### PUT /api/v1/projects/:id/env\n\nMerges { variables?, mappings? } into the project's environment config (null removes a key). Needs write.\n\n- **Service**: `git` (`https://git.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\nRequest:\n\n```json\n{\n  \"variables\": {\n    \"API_BASE\": \"https://example.com\"\n  }\n}\n```\n\n### GET /api/v1/projects/:id/actions\n\nActions compiled in a release (?tag=, default the newest release the caller can access).\n\n- **Service**: `git` (`https://git.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### POST /api/v1/projects/:id/actions/:name/run\n\nRuns a release's action with the caller's own token and data wiring; answers 200 with the run result even when the run failed or timed out.\n\n- **Service**: `git` (`https://git.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\nRequest:\n\n```json\n{\n  \"tag\": \"v1.0.0\",\n  \"params\": {\n    \"customerId\": \"cus_123\"\n  }\n}\n```\n\ncurl:\n\n```bash\ncurl -sS -X POST -H \"Authorization: Bearer $AUTH_TOKEN\" -H \"Content-Type: application/json\" -d '{\"tag\":\"v1.0.0\",\"params\":{\"customerId\":\"cus_123\"}}' \"https://git.fullstacked.cloud/api/v1/projects/<projectId>/actions/sync-orders/run\"\n```\n\n### GET /api/v1/projects/:id/actions/runs\n\nPast action runs, filtered by ?tag=, ?action=, ?status= and ?limit=.\n\n- **Service**: `git` (`https://git.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### GET /api/v1/projects/:id/actions/runs/:runId\n\nOne action run.\n\n- **Service**: `git` (`https://git.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### GET /api/v1/projects\n\nProjects the caller owns or holds any tier on (?filter= on title, name, description).\n\n- **Service**: `git` (`https://git.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### POST /api/v1/projects\n\nCreates a project { name, title?, description?, default_branch?, template?, owner? } (201).\n\n- **Service**: `git` (`https://git.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### GET /api/v1/projects/:id\n\nProject details (release-only consumers get the summary).\n\n- **Service**: `git` (`https://git.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### PATCH /api/v1/projects/:id\n\nUpdates { title?, description? } (write) or renames { name } (admin).\n\n- **Service**: `git` (`https://git.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### DELETE /api/v1/projects/:id\n\nDeletes the project; needs admin and { confirm: \"<owner>/<name>\" }.\n\n- **Service**: `git` (`https://git.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### PUT /api/v1/projects/:id/data-links\n\nLinks a managed data instance to the project ({ data_instance: <UUID> }).\n\n- **Service**: `git` (`https://git.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### DELETE /api/v1/projects/:id/data-links\n\nUnlinks a data instance (?data_instance=<UUID> or JSON body).\n\n- **Service**: `git` (`https://git.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### GET /api/v1/projects/:id/branches\n\nBranches.\n\n- **Service**: `git` (`https://git.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### POST /api/v1/projects/:id/branches\n\nCreates a branch { name, from? } (201).\n\n- **Service**: `git` (`https://git.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### GET /api/v1/projects/:id/tags\n\nTags.\n\n- **Service**: `git` (`https://git.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### POST /api/v1/projects/:id/tags\n\nCreates a tag { name, message?, ref? } (201); a v* tag enqueues a release build.\n\n- **Service**: `git` (`https://git.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### POST /api/v1/projects/:id/validate-diagrams\n\nValidates ```mermaid blocks in the branch's Markdown files ({ branch?, file_path? }).\n\n- **Service**: `git` (`https://git.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### GET /api/v1/projects/:id/files\n\nDev-state file tree (?branch=&path=&recursive=&ref=), submodules included.\n\n- **Service**: `git` (`https://git.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### GET /api/v1/projects/:id/files/content\n\nReads a dev-state file (?branch=&path=&ref=).\n\n- **Service**: `git` (`https://git.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### PUT /api/v1/projects/:id/files/content\n\nWrites a dev-state file { path, content, encoding?: utf-8 | base64, base_sha256?, branch? }, broadcast to live sync clients (needs dev_sync).\n\n- **Service**: `git` (`https://git.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### DELETE /api/v1/projects/:id/files/content\n\nDeletes a dev-state file (?branch=&path=).\n\n- **Service**: `git` (`https://git.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### GET /api/v1/projects/:id/diff\n\nUncommitted dev-state changes against HEAD (?branch=).\n\n- **Service**: `git` (`https://git.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### POST /api/v1/projects/:id/commit\n\nCommits the dev state { message, branch? } (201; needs write).\n\n- **Service**: `git` (`https://git.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### POST /api/v1/projects/:id/stash\n\nStashes the dev state { branch?, message? }.\n\n- **Service**: `git` (`https://git.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### POST /api/v1/projects/:id/revert\n\nDiscards dev-state changes back to HEAD { branch? }.\n\n- **Service**: `git` (`https://git.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### GET /api/v1/projects/:id/releases\n\nRelease builds (v* tags) visible to the caller.\n\n- **Service**: `git` (`https://git.fullstacked.cloud`)\n- **Auth**: Bearer fsc_* (optional on public release projects)\n\n### GET /api/v1/projects/:id/releases/latest\n\nNewest succeeded release, with its artifact for ?runtime=<version>.\n\n- **Service**: `git` (`https://git.fullstacked.cloud`)\n- **Auth**: Bearer fsc_* (optional on public release projects)\n\n### GET /api/v1/projects/:id/releases/tags/:tag\n\nOne release's metadata (?runtime=<version>).\n\n- **Service**: `git` (`https://git.fullstacked.cloud`)\n- **Auth**: Bearer fsc_* (optional on public release projects)\n\n### GET /api/v1/projects/:id/releases/tags/:tag/artifact\n\nDownloads the release .tar.gz compiled for ?runtime=<version> (compiled on demand).\n\n- **Service**: `git` (`https://git.fullstacked.cloud`)\n- **Auth**: Bearer fsc_* (optional on public release projects)\n\n### GET /api/v1/projects/:id/releases/tags/:tag/log\n\nThe release's build log (text/plain).\n\n- **Service**: `git` (`https://git.fullstacked.cloud`)\n- **Auth**: Bearer fsc_* (optional on public release projects)\n\n### WS /api/v1/projects/:id/sync\n\nLive dev-state file sync for ?branch= (default branch otherwise); needs dev_sync.\n\n- **Service**: `git` (`https://git.fullstacked.cloud`)\n- **Auth**: Bearer fsc_* (or the fsc-sync subprotocol token / ?access_token=)\n\n### GET /:owner/:repo/info/refs\n\nGit Smart HTTP for the git CLI (clone, fetch, push); POST git-upload-pack and git-receive-pack follow on the same path.\n\n- **Service**: `git` (`https://git.fullstacked.cloud`)\n- **Auth**: Basic (fsc_* token as password) or Bearer fsc_*\n\nshell:\n\n```bash\ngit clone https://git.fullstacked.cloud/<owner>/<name>.git\n```\n\n### WS /\n\nMultiplexed tunnel session dialed by fullstacked/tunnel: each registered tunnel keeps a WebSocket session (more under load), authenticated once at the upgrade, and every TCP/HTTP/WS connection to the tunnel name is a stream on it, to a data instance or Edge tunnel.\n\n- **Service**: `tunnels` (`https://tunnels.fullstacked.cloud`)\n- **Auth**: Authorization: <fsc_* token>:<tun_* token> (Bearer prefix optional)\n- **In project code**: `${process.env.TUNNELS_HOST}`\n- **Pitfall**: Pass both halves joined by ':': the user's AUTH_TOKEN and the env's <ENGINE>_DATA_TOKEN or <PREFIX>_TUNNEL_TOKEN (a tun_ token).\n\nindexTs:\n\n```ts\nimport tunnel from \"fullstacked/tunnel\";\n\nconst pgHost = await tunnel.register({\n    host: process.env.TUNNELS_HOST,\n    authorization: `${process.env.AUTH_TOKEN}:${process.env.PG_DATA_TOKEN}`,\n});\n```\n\n### GET /api/v1/edges\n\nEdge machines visible to the caller.\n\n- **Service**: `tunnels` (`https://tunnels.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### POST /api/v1/edges\n\nRegisters an Edge { name } (201); its daemon then authenticates with an fsc_edge_ token from auth POST /v1/tokens.\n\n- **Service**: `tunnels` (`https://tunnels.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### GET /api/v1/edges/:id\n\nOne Edge.\n\n- **Service**: `tunnels` (`https://tunnels.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### POST /api/v1/edges/:id/roll\n\nRotates an Edge's edg_ key (owner or can_register grantee): the lifeline is severed, tunnels and grants stay; the daemon needs a fresh fsc_edge_ token.\n\n- **Service**: `tunnels` (`https://tunnels.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### DELETE /api/v1/edges/:id\n\nDeletes an Edge (owner or can_register grantee).\n\n- **Service**: `tunnels` (`https://tunnels.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### GET /api/v1/tunnels\n\nLAN tunnels visible to the caller (?edgeId=); managed data tunnels are not listed.\n\n- **Service**: `tunnels` (`https://tunnels.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### POST /api/v1/tunnels\n\nCreates a tunnel { name, edgeId, internalHost, internalPort } under an Edge the caller manages (201).\n\n- **Service**: `tunnels` (`https://tunnels.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### GET /api/v1/tunnels/:id\n\nOne tunnel.\n\n- **Service**: `tunnels` (`https://tunnels.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### POST /api/v1/tunnels/test\n\nReachability of { tunnelId }, { token }, or a candidate { edgeId, internalHost, internalPort }: for a tunnel under an Edge it reports whether the Edge daemon is connected, without probing the target.\n\n- **Service**: `tunnels` (`https://tunnels.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### POST /api/v1/tunnels/:id/roll\n\nRolls the tunnel's tun_ token.\n\n- **Service**: `tunnels` (`https://tunnels.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### DELETE /api/v1/tunnels/:id\n\nDeletes a tunnel.\n\n- **Service**: `tunnels` (`https://tunnels.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### GET /api/v1/data\n\nManaged data instances visible to the caller (?engine=).\n\n- **Service**: `data` (`https://tunnels.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\ncurl:\n\n```bash\ncurl -sS -H \"Authorization: Bearer $AUTH_TOKEN\" \"https://tunnels.fullstacked.cloud/api/v1/data\"\n```\n\n### POST /api/v1/data/provision\n\nProvisions an isolated instance { engine: postgres | redis | mongodb | s3, label? } (201).\n\n- **Service**: `data` (`https://tunnels.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\nRequest:\n\n```json\n{\n  \"engine\": \"postgres\"\n}\n```\n\n### GET /api/v1/data/:id\n\nOne instance.\n\n- **Service**: `data` (`https://tunnels.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### DELETE /api/v1/data/:id\n\nDeprovisions an instance (owner only, 204).\n\n- **Service**: `data` (`https://tunnels.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### GET /api/v1/data/:id/connection\n\nConnection parameters, DATA_* variables and fullstacked/tunnel snippets for ?access_level=rw|ro within the caller's permission.\n\n- **Service**: `data` (`https://tunnels.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### GET /api/v1/data/:id/schema\n\nIntrospects tables, keys, collections or buckets (?schema=).\n\n- **Service**: `data` (`https://tunnels.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### POST /api/v1/data/:id/query\n\nRuns one operation: { sql, params? } (postgres), { command } (redis), { operation, collection, ... } (mongodb) or { operation, key?, prefix?, ... } (s3).\n\n- **Service**: `data` (`https://tunnels.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\nRequest:\n\n```json\n{\n  \"sql\": \"select now()\"\n}\n```\n\n### POST /mcp\n\nStreamable HTTP JSON-RPC 2.0 MCP endpoint: docs_list / docs_get (this documentation, open to every token), projects_*, data_*, tunnels_*, users_* and auth_get_my_access tools, plus fullstacked:// resources (fullstacked://docs/{topic} included).\n\n- **Service**: `mcp` (`https://mcp.fullstacked.cloud`)\n- **Auth**: Bearer fsc_* (OAuth-connected AI apps hold agent tokens)\n\nmcpUrl:\n\n```ts\nhttps://mcp.fullstacked.cloud/mcp\n```\n\n### DELETE /mcp\n\nTerminates the MCP session named by the Mcp-Session-Id header (204).\n\n- **Service**: `mcp` (`https://mcp.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### GET /sse\n\nHTTP+SSE transport (2024-11-05): opens the event stream and announces the /messages?sessionId= endpoint.\n\n- **Service**: `mcp` (`https://mcp.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### POST /messages\n\nPosts a JSON-RPC message for an SSE session (?sessionId=); answered on the stream.\n\n- **Service**: `mcp` (`https://mcp.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### GET /.well-known/oauth-protected-resource\n\nRFC 9728 protected resource metadata pointing AI apps to the Auth OAuth server.\n\n- **Service**: `mcp` (`https://mcp.fullstacked.cloud`)\n- **Auth**: Public\n- **Aliases**: `/.well-known/oauth-protected-resource/mcp`, `/.well-known/oauth-protected-resource/sse`\n\n### GET /api/v1/audit\n\nThe caller's own agent audit trail of MCP tool calls (?limit=, default 100).\n\n- **Service**: `mcp` (`https://mcp.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\n### GET /\n\nThe Client GUI installer: an ES module evaluated by the FullStacked runtime through exec; ?force=1 reinstalls.\n\n- **Service**: `install` (`https://install.fullstacked.cloud`)\n- **Auth**: Public\n\nshell:\n\n```bash\nexec https://install.fullstacked.cloud\n```\n\n### GET /deeplink\n\nHTML launcher that opens the installer in the FullStacked runtime (?authority=&auth= for a BYOA sign-in).\n\n- **Service**: `install` (`https://install.fullstacked.cloud`)\n- **Auth**: Public\n\n### GET /v1/install-deeplink\n\nA signed exec deeplink for the installer, valid one hour (?authority=&auth= must name a registered authority URL).\n\n- **Service**: `install` (`https://install.fullstacked.cloud`)\n- **Auth**: Public (30 requests/minute per IP)\n\n### GET /manifest.json\n\nRuntime-aware Client GUI release manifest (?runtime=<version>).\n\n- **Service**: `install` (`https://install.fullstacked.cloud`)\n- **Auth**: Public\n\n### GET /releases/:file\n\nDownloads a Client GUI archive cloud-client-v<version>-rt.<runtime>.tar.gz.\n\n- **Service**: `install` (`https://install.fullstacked.cloud`)\n- **Auth**: Public\n- **Aliases**: `/dist/:file`\n\n### GET /\n\nThe documentation portal: HTML, ?format=md (Markdown for agents) or ?format=json.\n\n- **Service**: `docs` (`https://docs.fullstacked.cloud`)\n- **Auth**: Public\n\ncurl:\n\n```bash\ncurl -sS \"https://docs.fullstacked.cloud/?format=md\"\n```\n\n### GET /:topic\n\nOne topic guide (runtime, project-runtime, me, data, ...) as HTML, md or json.\n\n- **Service**: `docs` (`https://docs.fullstacked.cloud`)\n- **Auth**: Public\n\n### GET /api/v1/endpoints\n\nThis endpoint catalog as JSON.\n\n- **Service**: `docs` (`https://docs.fullstacked.cloud`)\n- **Auth**: Public\n\n### GET /healthz\n\nHealth check.\n\n- **Service**: `docs` (`https://docs.fullstacked.cloud`)\n- **Auth**: Public\n\n### GET /version\n\nService version.\n\n- **Service**: `docs` (`https://docs.fullstacked.cloud`)\n- **Auth**: Public"}],"endpoints":[{"service":"auth","topic":"me","id":"auth.me","method":"GET","path":"/api/v1/me","aliases":["/v1/me"],"auth":"Bearer fsc_* (AUTH_TOKEN)","summary":"Profile of the bearer's principal: identity only, never grants or resources. BYOA principals add authority_id and omit email_verified, plan and plan_name.","inProjectUrlExpression":"${process.env.AUTH_URL}/api/v1/me","commonPitfall":"A relative fetch(\"/api/v1/me\") reads the project's own static files: always prefix process.env.AUTH_URL.","responseExample":{"status":"success","data":{"id":"usr_0123456789abcdef01234567","username":"alice","slug":"alice","name":"Alice","email":"alice@example.com","email_verified":true,"avatar_url":null,"type":"user","status":"active","plan":"base","plan_name":"Base","has_run_client_gui":true,"restricted":false,"created_at":"2026-09-20T14:32:00.000Z"}},"codeExamples":{"indexTs":"const res = await fetch(`${process.env.AUTH_URL}/api/v1/me`, {\n    headers: { Authorization: `Bearer ${process.env.AUTH_TOKEN}` },\n});\nconst { data: user } = await res.json();","curl":"curl -sS -H \"Authorization: Bearer $AUTH_TOKEN\" \"https://auth.fullstacked.cloud/api/v1/me\""},"fullUrl":"https://auth.fullstacked.cloud/api/v1/me"},{"service":"auth","topic":"me","id":"auth.userAccess","method":"GET","path":"/api/v1/user/access","auth":"Bearer fsc_* (AUTH_TOKEN)","summary":"Effective access of the caller: principal, user, billing, groups, global_permissions and resources (projects, tunnels, data, mcp). Narrow with ?resource_type=projects|tunnels|data|mcp.","inProjectUrlExpression":"${process.env.AUTH_URL}/api/v1/user/access","codeExamples":{"curl":"curl -sS -H \"Authorization: Bearer $AUTH_TOKEN\" \"https://auth.fullstacked.cloud/api/v1/user/access?resource_type=projects\""},"fullUrl":"https://auth.fullstacked.cloud/api/v1/user/access"},{"service":"auth","topic":"auth-byoa","id":"auth.exchangeToken","method":"POST","path":"/v1/auth/exchange/token","auth":"Public (PKCE code_verifier)","summary":"Redeems a single-use fsc_exc_ exchange token with its PKCE code_verifier: a BYOA sign-in returns an fsc_ath_<slug>_ session token, a session handoff a fresh fsc_ses_ token.","inProjectUrlExpression":"${process.env.AUTH_URL}/v1/auth/exchange/token","requestExample":{"exchangeToken":"fsc_exc_...","codeVerifier":"..."},"fullUrl":"https://auth.fullstacked.cloud/v1/auth/exchange/token"},{"service":"auth","topic":"auth-byoa","id":"auth.authorityToken","method":"POST","path":"/v1/authorities/:id/token","auth":"X-FullStacked-Authority-Key, or Bearer fsc_* of an authority administrator","summary":"Server-to-server: an enterprise IdP mints a PKCE-bound fsc_exc_ exchange token for { userId, email?, name?, groups?, ttl?, codeChallenge, metadata? }.","fullUrl":"https://auth.fullstacked.cloud/v1/authorities/:id/token"},{"service":"auth","topic":"auth-byoa","id":"auth.authorityValidate","method":"POST","path":"/v1/authorities/:id/validate","auth":"X-FullStacked-Authority-Key, or Bearer fsc_* of an authority administrator","summary":"Validates an fsc_ath_<slug>_ token issued for this authority and returns its claims (userId, email, name, groups, tokenId, issuedAt, expiresAt, metadata).","requestExample":{"token":"fsc_ath_acme_..."},"codeExamples":{"curl":"curl -sS -X POST -H \"X-FullStacked-Authority-Key: $AUTHORITY_KEY\" -H \"Content-Type: application/json\" -d '{\"token\":\"fsc_ath_...\"}' \"https://auth.fullstacked.cloud/v1/authorities/<authorityId>/validate\""},"fullUrl":"https://auth.fullstacked.cloud/v1/authorities/:id/validate"},{"service":"auth","topic":"auth-byoa","id":"auth.authorityRevoke","method":"POST","path":"/v1/authorities/:id/revoke","auth":"X-FullStacked-Authority-Key, or Bearer fsc_* of an authority administrator","summary":"Revokes the authority's tokens by { userId }, by { token }, or { all: true }.","fullUrl":"https://auth.fullstacked.cloud/v1/authorities/:id/revoke"},{"service":"auth","topic":"api-reference","id":"auth.logout","method":"POST","path":"/v1/auth/logout","auth":"Bearer fsc_*","summary":"Revokes the bearer token and, unless { keepClerkSession: true }, its Clerk sign-in.","responseExample":{"status":"revoked"},"fullUrl":"https://auth.fullstacked.cloud/v1/auth/logout"},{"service":"auth","topic":"api-reference","id":"auth.listTokens","method":"GET","path":"/v1/tokens","auth":"Bearer fsc_* (usr_ user)","summary":"Lists the caller's active tokens (sessions, PATs, agent and edge tokens); OAuth app connections are not included.","fullUrl":"https://auth.fullstacked.cloud/v1/tokens"},{"service":"auth","topic":"api-reference","id":"auth.createToken","method":"POST","path":"/v1/tokens","auth":"Bearer fsc_* (usr_ user)","summary":"Mints a token { type: \"pat\" | \"agent\" | \"edge\", name?, ttl?, scopes? (agent), edgeId? (edge) }; the raw token is returned once (201).","fullUrl":"https://auth.fullstacked.cloud/v1/tokens"},{"service":"auth","topic":"api-reference","id":"auth.revokeToken","method":"DELETE","path":"/v1/tokens/:id","auth":"Bearer fsc_* (usr_ user)","summary":"Revokes one of the caller's tokens.","fullUrl":"https://auth.fullstacked.cloud/v1/tokens/:id"},{"service":"auth","topic":"api-reference","id":"auth.billing","method":"GET","path":"/v1/billing","auth":"Bearer fsc_*","summary":"The caller's effective plan (base | pro), quota limits and counted usage.","fullUrl":"https://auth.fullstacked.cloud/v1/billing"},{"service":"auth","topic":"api-reference","id":"auth.listGrants","method":"GET","path":"/v1/grants","auth":"Bearer fsc_* (usr_ user)","summary":"Lists grants on assets the caller manages, filtered by ?principal_id=, ?resource_type= and ?resource_id=.","fullUrl":"https://auth.fullstacked.cloud/v1/grants"},{"service":"auth","topic":"api-reference","id":"auth.putGrant","method":"PUT","path":"/v1/grants","auth":"Bearer fsc_* (usr_ user)","summary":"Shares an asset: { principal (user id or email), resourceType, resourceId, permissions, branches?, tags? }. An unknown email becomes a pending invitation.","fullUrl":"https://auth.fullstacked.cloud/v1/grants"},{"service":"auth","topic":"api-reference","id":"auth.deleteGrant","method":"DELETE","path":"/v1/grants","auth":"Bearer fsc_* (usr_ user)","summary":"Removes a grant, keyed by principal, resource type and id (query or JSON body).","fullUrl":"https://auth.fullstacked.cloud/v1/grants"},{"service":"auth","topic":"api-reference","id":"auth.listDevices","method":"GET","path":"/v1/devices","auth":"Bearer fsc_*","summary":"The caller's registered Client GUI devices.","fullUrl":"https://auth.fullstacked.cloud/v1/devices"},{"service":"auth","topic":"api-reference","id":"auth.renameDevice","method":"PATCH","path":"/v1/devices/:id","auth":"Bearer fsc_*","summary":"Renames one of the caller's devices ({ name }).","fullUrl":"https://auth.fullstacked.cloud/v1/devices/:id"},{"service":"auth","topic":"api-reference","id":"auth.removeDevice","method":"DELETE","path":"/v1/devices/:id","auth":"Bearer fsc_*","summary":"Forgets a device; it is registered again on its next report.","fullUrl":"https://auth.fullstacked.cloud/v1/devices/:id"},{"service":"auth","topic":"api-reference","id":"auth.oauthMetadata","method":"GET","path":"/.well-known/oauth-authorization-server","aliases":["/.well-known/openid-configuration"],"auth":"Public","summary":"OAuth 2.1 authorization server metadata (authorize, token, register and revoke endpoints) used by MCP clients.","fullUrl":"https://auth.fullstacked.cloud/.well-known/oauth-authorization-server"},{"service":"git","topic":"project-runtime","auth":"Bearer fsc_*","id":"git.getEnv","method":"GET","path":"/api/v1/projects/:id/env","summary":"The project's resolved runtime environment: DATA_* wiring and tokens of linked instances, platform URLs (AUTH_URL, AUTH_HOST, TUNNELS_HOST, DOCS_URL) and custom variables. ?format=json|dotenv; never contains AUTH_TOKEN.","codeExamples":{"curl":"curl -sS -H \"Authorization: Bearer $AUTH_TOKEN\" \"https://git.fullstacked.cloud/api/v1/projects/<projectId>/env?format=dotenv\""},"fullUrl":"https://git.fullstacked.cloud/api/v1/projects/:id/env"},{"service":"git","topic":"project-runtime","auth":"Bearer fsc_*","id":"git.setEnv","method":"PUT","path":"/api/v1/projects/:id/env","summary":"Merges { variables?, mappings? } into the project's environment config (null removes a key). Needs write.","requestExample":{"variables":{"API_BASE":"https://example.com"}},"fullUrl":"https://git.fullstacked.cloud/api/v1/projects/:id/env"},{"service":"git","topic":"actions","auth":"Bearer fsc_*","id":"git.listActions","method":"GET","path":"/api/v1/projects/:id/actions","summary":"Actions compiled in a release (?tag=, default the newest release the caller can access).","fullUrl":"https://git.fullstacked.cloud/api/v1/projects/:id/actions"},{"service":"git","topic":"actions","auth":"Bearer fsc_*","id":"git.runAction","method":"POST","path":"/api/v1/projects/:id/actions/:name/run","summary":"Runs a release's action with the caller's own token and data wiring; answers 200 with the run result even when the run failed or timed out.","requestExample":{"tag":"v1.0.0","params":{"customerId":"cus_123"}},"codeExamples":{"curl":"curl -sS -X POST -H \"Authorization: Bearer $AUTH_TOKEN\" -H \"Content-Type: application/json\" -d '{\"tag\":\"v1.0.0\",\"params\":{\"customerId\":\"cus_123\"}}' \"https://git.fullstacked.cloud/api/v1/projects/<projectId>/actions/sync-orders/run\""},"fullUrl":"https://git.fullstacked.cloud/api/v1/projects/:id/actions/:name/run"},{"service":"git","topic":"actions","auth":"Bearer fsc_*","id":"git.listActionRuns","method":"GET","path":"/api/v1/projects/:id/actions/runs","summary":"Past action runs, filtered by ?tag=, ?action=, ?status= and ?limit=.","fullUrl":"https://git.fullstacked.cloud/api/v1/projects/:id/actions/runs"},{"service":"git","topic":"actions","auth":"Bearer fsc_*","id":"git.getActionRun","method":"GET","path":"/api/v1/projects/:id/actions/runs/:runId","summary":"One action run.","fullUrl":"https://git.fullstacked.cloud/api/v1/projects/:id/actions/runs/:runId"},{"service":"git","topic":"api-reference","auth":"Bearer fsc_*","id":"git.listProjects","method":"GET","path":"/api/v1/projects","summary":"Projects the caller owns or holds any tier on (?filter= on title, name, description).","fullUrl":"https://git.fullstacked.cloud/api/v1/projects"},{"service":"git","topic":"api-reference","auth":"Bearer fsc_*","id":"git.createProject","method":"POST","path":"/api/v1/projects","summary":"Creates a project { name, title?, description?, default_branch?, template?, owner? } (201).","fullUrl":"https://git.fullstacked.cloud/api/v1/projects"},{"service":"git","topic":"api-reference","auth":"Bearer fsc_*","id":"git.getProject","method":"GET","path":"/api/v1/projects/:id","summary":"Project details (release-only consumers get the summary).","fullUrl":"https://git.fullstacked.cloud/api/v1/projects/:id"},{"service":"git","topic":"api-reference","auth":"Bearer fsc_*","id":"git.updateProject","method":"PATCH","path":"/api/v1/projects/:id","summary":"Updates { title?, description? } (write) or renames { name } (admin).","fullUrl":"https://git.fullstacked.cloud/api/v1/projects/:id"},{"service":"git","topic":"api-reference","auth":"Bearer fsc_*","id":"git.deleteProject","method":"DELETE","path":"/api/v1/projects/:id","summary":"Deletes the project; needs admin and { confirm: \"<owner>/<name>\" }.","fullUrl":"https://git.fullstacked.cloud/api/v1/projects/:id"},{"service":"git","topic":"api-reference","auth":"Bearer fsc_*","id":"git.linkData","method":"PUT","path":"/api/v1/projects/:id/data-links","summary":"Links a managed data instance to the project ({ data_instance: <UUID> }).","fullUrl":"https://git.fullstacked.cloud/api/v1/projects/:id/data-links"},{"service":"git","topic":"api-reference","auth":"Bearer fsc_*","id":"git.unlinkData","method":"DELETE","path":"/api/v1/projects/:id/data-links","summary":"Unlinks a data instance (?data_instance=<UUID> or JSON body).","fullUrl":"https://git.fullstacked.cloud/api/v1/projects/:id/data-links"},{"service":"git","topic":"api-reference","auth":"Bearer fsc_*","id":"git.listBranches","method":"GET","path":"/api/v1/projects/:id/branches","summary":"Branches.","fullUrl":"https://git.fullstacked.cloud/api/v1/projects/:id/branches"},{"service":"git","topic":"api-reference","auth":"Bearer fsc_*","id":"git.createBranch","method":"POST","path":"/api/v1/projects/:id/branches","summary":"Creates a branch { name, from? } (201).","fullUrl":"https://git.fullstacked.cloud/api/v1/projects/:id/branches"},{"service":"git","topic":"api-reference","auth":"Bearer fsc_*","id":"git.listTags","method":"GET","path":"/api/v1/projects/:id/tags","summary":"Tags.","fullUrl":"https://git.fullstacked.cloud/api/v1/projects/:id/tags"},{"service":"git","topic":"api-reference","auth":"Bearer fsc_*","id":"git.createTag","method":"POST","path":"/api/v1/projects/:id/tags","summary":"Creates a tag { name, message?, ref? } (201); a v* tag enqueues a release build.","fullUrl":"https://git.fullstacked.cloud/api/v1/projects/:id/tags"},{"service":"git","topic":"api-reference","auth":"Bearer fsc_*","id":"git.validateDiagrams","method":"POST","path":"/api/v1/projects/:id/validate-diagrams","summary":"Validates ```mermaid blocks in the branch's Markdown files ({ branch?, file_path? }).","fullUrl":"https://git.fullstacked.cloud/api/v1/projects/:id/validate-diagrams"},{"service":"git","topic":"api-reference","auth":"Bearer fsc_*","id":"git.listFiles","method":"GET","path":"/api/v1/projects/:id/files","summary":"Dev-state file tree (?branch=&path=&recursive=&ref=), submodules included.","fullUrl":"https://git.fullstacked.cloud/api/v1/projects/:id/files"},{"service":"git","topic":"api-reference","auth":"Bearer fsc_*","id":"git.readFile","method":"GET","path":"/api/v1/projects/:id/files/content","summary":"Reads a dev-state file (?branch=&path=&ref=).","fullUrl":"https://git.fullstacked.cloud/api/v1/projects/:id/files/content"},{"service":"git","topic":"api-reference","auth":"Bearer fsc_*","id":"git.writeFile","method":"PUT","path":"/api/v1/projects/:id/files/content","summary":"Writes a dev-state file { path, content, encoding?: utf-8 | base64, base_sha256?, branch? }, broadcast to live sync clients (needs dev_sync).","fullUrl":"https://git.fullstacked.cloud/api/v1/projects/:id/files/content"},{"service":"git","topic":"api-reference","auth":"Bearer fsc_*","id":"git.deleteFile","method":"DELETE","path":"/api/v1/projects/:id/files/content","summary":"Deletes a dev-state file (?branch=&path=).","fullUrl":"https://git.fullstacked.cloud/api/v1/projects/:id/files/content"},{"service":"git","topic":"api-reference","auth":"Bearer fsc_*","id":"git.diff","method":"GET","path":"/api/v1/projects/:id/diff","summary":"Uncommitted dev-state changes against HEAD (?branch=).","fullUrl":"https://git.fullstacked.cloud/api/v1/projects/:id/diff"},{"service":"git","topic":"api-reference","auth":"Bearer fsc_*","id":"git.commit","method":"POST","path":"/api/v1/projects/:id/commit","summary":"Commits the dev state { message, branch? } (201; needs write).","fullUrl":"https://git.fullstacked.cloud/api/v1/projects/:id/commit"},{"service":"git","topic":"api-reference","auth":"Bearer fsc_*","id":"git.stash","method":"POST","path":"/api/v1/projects/:id/stash","summary":"Stashes the dev state { branch?, message? }.","fullUrl":"https://git.fullstacked.cloud/api/v1/projects/:id/stash"},{"service":"git","topic":"api-reference","auth":"Bearer fsc_*","id":"git.revert","method":"POST","path":"/api/v1/projects/:id/revert","summary":"Discards dev-state changes back to HEAD { branch? }.","fullUrl":"https://git.fullstacked.cloud/api/v1/projects/:id/revert"},{"service":"git","topic":"api-reference","auth":"Bearer fsc_* (optional on public release projects)","id":"git.listReleases","method":"GET","path":"/api/v1/projects/:id/releases","summary":"Release builds (v* tags) visible to the caller.","fullUrl":"https://git.fullstacked.cloud/api/v1/projects/:id/releases"},{"service":"git","topic":"api-reference","auth":"Bearer fsc_* (optional on public release projects)","id":"git.latestRelease","method":"GET","path":"/api/v1/projects/:id/releases/latest","summary":"Newest succeeded release, with its artifact for ?runtime=<version>.","fullUrl":"https://git.fullstacked.cloud/api/v1/projects/:id/releases/latest"},{"service":"git","topic":"api-reference","auth":"Bearer fsc_* (optional on public release projects)","id":"git.getRelease","method":"GET","path":"/api/v1/projects/:id/releases/tags/:tag","summary":"One release's metadata (?runtime=<version>).","fullUrl":"https://git.fullstacked.cloud/api/v1/projects/:id/releases/tags/:tag"},{"service":"git","topic":"api-reference","auth":"Bearer fsc_* (optional on public release projects)","id":"git.releaseArtifact","method":"GET","path":"/api/v1/projects/:id/releases/tags/:tag/artifact","summary":"Downloads the release .tar.gz compiled for ?runtime=<version> (compiled on demand).","fullUrl":"https://git.fullstacked.cloud/api/v1/projects/:id/releases/tags/:tag/artifact"},{"service":"git","topic":"api-reference","auth":"Bearer fsc_* (optional on public release projects)","id":"git.releaseLog","method":"GET","path":"/api/v1/projects/:id/releases/tags/:tag/log","summary":"The release's build log (text/plain).","fullUrl":"https://git.fullstacked.cloud/api/v1/projects/:id/releases/tags/:tag/log"},{"service":"git","topic":"api-reference","auth":"Bearer fsc_* (or the fsc-sync subprotocol token / ?access_token=)","id":"git.sync","method":"WS","path":"/api/v1/projects/:id/sync","summary":"Live dev-state file sync for ?branch= (default branch otherwise); needs dev_sync.","fullUrl":"https://git.fullstacked.cloud/api/v1/projects/:id/sync"},{"service":"git","topic":"api-reference","auth":"Basic (fsc_* token as password) or Bearer fsc_*","id":"git.smartHttp","method":"GET","path":"/:owner/:repo/info/refs","summary":"Git Smart HTTP for the git CLI (clone, fetch, push); POST git-upload-pack and git-receive-pack follow on the same path.","codeExamples":{"shell":"git clone https://git.fullstacked.cloud/<owner>/<name>.git"},"fullUrl":"https://git.fullstacked.cloud/:owner/:repo/info/refs"},{"service":"tunnels","topic":"tunnels","auth":"Authorization: <fsc_* token>:<tun_* token> (Bearer prefix optional)","id":"tunnels.session","method":"WS","path":"/","summary":"Multiplexed tunnel session dialed by fullstacked/tunnel: each registered tunnel keeps a WebSocket session (more under load), authenticated once at the upgrade, and every TCP/HTTP/WS connection to the tunnel name is a stream on it, to a data instance or Edge tunnel.","inProjectUrlExpression":"${process.env.TUNNELS_HOST}","commonPitfall":"Pass both halves joined by ':': the user's AUTH_TOKEN and the env's <ENGINE>_DATA_TOKEN or <PREFIX>_TUNNEL_TOKEN (a tun_ token).","codeExamples":{"indexTs":"import tunnel from \"fullstacked/tunnel\";\n\nconst pgHost = await tunnel.register({\n    host: process.env.TUNNELS_HOST,\n    authorization: `${process.env.AUTH_TOKEN}:${process.env.PG_DATA_TOKEN}`,\n});"},"fullUrl":"https://tunnels.fullstacked.cloud/"},{"service":"tunnels","topic":"tunnels","auth":"Bearer fsc_*","id":"tunnels.listEdges","method":"GET","path":"/api/v1/edges","summary":"Edge machines visible to the caller.","fullUrl":"https://tunnels.fullstacked.cloud/api/v1/edges"},{"service":"tunnels","topic":"tunnels","auth":"Bearer fsc_*","id":"tunnels.createEdge","method":"POST","path":"/api/v1/edges","summary":"Registers an Edge { name } (201); its daemon then authenticates with an fsc_edge_ token from auth POST /v1/tokens.","fullUrl":"https://tunnels.fullstacked.cloud/api/v1/edges"},{"service":"tunnels","topic":"tunnels","auth":"Bearer fsc_*","id":"tunnels.getEdge","method":"GET","path":"/api/v1/edges/:id","summary":"One Edge.","fullUrl":"https://tunnels.fullstacked.cloud/api/v1/edges/:id"},{"service":"tunnels","topic":"tunnels","auth":"Bearer fsc_*","id":"tunnels.rollEdge","method":"POST","path":"/api/v1/edges/:id/roll","summary":"Rotates an Edge's edg_ key (owner or can_register grantee): the lifeline is severed, tunnels and grants stay; the daemon needs a fresh fsc_edge_ token.","fullUrl":"https://tunnels.fullstacked.cloud/api/v1/edges/:id/roll"},{"service":"tunnels","topic":"tunnels","auth":"Bearer fsc_*","id":"tunnels.deleteEdge","method":"DELETE","path":"/api/v1/edges/:id","summary":"Deletes an Edge (owner or can_register grantee).","fullUrl":"https://tunnels.fullstacked.cloud/api/v1/edges/:id"},{"service":"tunnels","topic":"tunnels","auth":"Bearer fsc_*","id":"tunnels.listTunnels","method":"GET","path":"/api/v1/tunnels","summary":"LAN tunnels visible to the caller (?edgeId=); managed data tunnels are not listed.","fullUrl":"https://tunnels.fullstacked.cloud/api/v1/tunnels"},{"service":"tunnels","topic":"tunnels","auth":"Bearer fsc_*","id":"tunnels.createTunnel","method":"POST","path":"/api/v1/tunnels","summary":"Creates a tunnel { name, edgeId, internalHost, internalPort } under an Edge the caller manages (201).","fullUrl":"https://tunnels.fullstacked.cloud/api/v1/tunnels"},{"service":"tunnels","topic":"tunnels","auth":"Bearer fsc_*","id":"tunnels.getTunnel","method":"GET","path":"/api/v1/tunnels/:id","summary":"One tunnel.","fullUrl":"https://tunnels.fullstacked.cloud/api/v1/tunnels/:id"},{"service":"tunnels","topic":"tunnels","auth":"Bearer fsc_*","id":"tunnels.testTunnel","method":"POST","path":"/api/v1/tunnels/test","summary":"Reachability of { tunnelId }, { token }, or a candidate { edgeId, internalHost, internalPort }: for a tunnel under an Edge it reports whether the Edge daemon is connected, without probing the target.","fullUrl":"https://tunnels.fullstacked.cloud/api/v1/tunnels/test"},{"service":"tunnels","topic":"tunnels","auth":"Bearer fsc_*","id":"tunnels.rollTunnel","method":"POST","path":"/api/v1/tunnels/:id/roll","summary":"Rolls the tunnel's tun_ token.","fullUrl":"https://tunnels.fullstacked.cloud/api/v1/tunnels/:id/roll"},{"service":"tunnels","topic":"tunnels","auth":"Bearer fsc_*","id":"tunnels.deleteTunnel","method":"DELETE","path":"/api/v1/tunnels/:id","summary":"Deletes a tunnel.","fullUrl":"https://tunnels.fullstacked.cloud/api/v1/tunnels/:id"},{"service":"data","topic":"data","auth":"Bearer fsc_*","id":"data.list","method":"GET","path":"/api/v1/data","summary":"Managed data instances visible to the caller (?engine=).","codeExamples":{"curl":"curl -sS -H \"Authorization: Bearer $AUTH_TOKEN\" \"https://tunnels.fullstacked.cloud/api/v1/data\""},"fullUrl":"https://tunnels.fullstacked.cloud/api/v1/data"},{"service":"data","topic":"data","auth":"Bearer fsc_*","id":"data.provision","method":"POST","path":"/api/v1/data/provision","summary":"Provisions an isolated instance { engine: postgres | redis | mongodb | s3, label? } (201).","requestExample":{"engine":"postgres"},"fullUrl":"https://tunnels.fullstacked.cloud/api/v1/data/provision"},{"service":"data","topic":"data","auth":"Bearer fsc_*","id":"data.get","method":"GET","path":"/api/v1/data/:id","summary":"One instance.","fullUrl":"https://tunnels.fullstacked.cloud/api/v1/data/:id"},{"service":"data","topic":"data","auth":"Bearer fsc_*","id":"data.deprovision","method":"DELETE","path":"/api/v1/data/:id","summary":"Deprovisions an instance (owner only, 204).","fullUrl":"https://tunnels.fullstacked.cloud/api/v1/data/:id"},{"service":"data","topic":"data","auth":"Bearer fsc_*","id":"data.connection","method":"GET","path":"/api/v1/data/:id/connection","summary":"Connection parameters, DATA_* variables and fullstacked/tunnel snippets for ?access_level=rw|ro within the caller's permission.","fullUrl":"https://tunnels.fullstacked.cloud/api/v1/data/:id/connection"},{"service":"data","topic":"data","auth":"Bearer fsc_*","id":"data.schema","method":"GET","path":"/api/v1/data/:id/schema","summary":"Introspects tables, keys, collections or buckets (?schema=).","fullUrl":"https://tunnels.fullstacked.cloud/api/v1/data/:id/schema"},{"service":"data","topic":"data","auth":"Bearer fsc_*","id":"data.query","method":"POST","path":"/api/v1/data/:id/query","summary":"Runs one operation: { sql, params? } (postgres), { command } (redis), { operation, collection, ... } (mongodb) or { operation, key?, prefix?, ... } (s3).","requestExample":{"sql":"select now()"},"fullUrl":"https://tunnels.fullstacked.cloud/api/v1/data/:id/query"},{"service":"mcp","topic":"api-reference","id":"mcp.post","method":"POST","path":"/mcp","auth":"Bearer fsc_* (OAuth-connected AI apps hold agent tokens)","summary":"Streamable HTTP JSON-RPC 2.0 MCP endpoint: docs_list / docs_get (this documentation, open to every token), projects_*, data_*, tunnels_*, users_* and auth_get_my_access tools, plus fullstacked:// resources (fullstacked://docs/{topic} included).","codeExamples":{"mcpUrl":"https://mcp.fullstacked.cloud/mcp"},"fullUrl":"https://mcp.fullstacked.cloud/mcp"},{"service":"mcp","topic":"api-reference","id":"mcp.delete","method":"DELETE","path":"/mcp","auth":"Bearer fsc_*","summary":"Terminates the MCP session named by the Mcp-Session-Id header (204).","fullUrl":"https://mcp.fullstacked.cloud/mcp"},{"service":"mcp","topic":"api-reference","id":"mcp.sse","method":"GET","path":"/sse","auth":"Bearer fsc_*","summary":"HTTP+SSE transport (2024-11-05): opens the event stream and announces the /messages?sessionId= endpoint.","fullUrl":"https://mcp.fullstacked.cloud/sse"},{"service":"mcp","topic":"api-reference","id":"mcp.messages","method":"POST","path":"/messages","auth":"Bearer fsc_*","summary":"Posts a JSON-RPC message for an SSE session (?sessionId=); answered on the stream.","fullUrl":"https://mcp.fullstacked.cloud/messages"},{"service":"mcp","topic":"api-reference","id":"mcp.resourceMetadata","method":"GET","path":"/.well-known/oauth-protected-resource","aliases":["/.well-known/oauth-protected-resource/mcp","/.well-known/oauth-protected-resource/sse"],"auth":"Public","summary":"RFC 9728 protected resource metadata pointing AI apps to the Auth OAuth server.","fullUrl":"https://mcp.fullstacked.cloud/.well-known/oauth-protected-resource"},{"service":"mcp","topic":"api-reference","id":"mcp.audit","method":"GET","path":"/api/v1/audit","auth":"Bearer fsc_*","summary":"The caller's own agent audit trail of MCP tool calls (?limit=, default 100).","fullUrl":"https://mcp.fullstacked.cloud/api/v1/audit"},{"service":"install","topic":"api-reference","id":"install.script","method":"GET","path":"/","auth":"Public","summary":"The Client GUI installer: an ES module evaluated by the FullStacked runtime through exec; ?force=1 reinstalls.","codeExamples":{"shell":"exec https://install.fullstacked.cloud"},"fullUrl":"https://install.fullstacked.cloud/"},{"service":"install","topic":"api-reference","id":"install.deeplinkPage","method":"GET","path":"/deeplink","auth":"Public","summary":"HTML launcher that opens the installer in the FullStacked runtime (?authority=&auth= for a BYOA sign-in).","fullUrl":"https://install.fullstacked.cloud/deeplink"},{"service":"install","topic":"api-reference","id":"install.signedDeeplink","method":"GET","path":"/v1/install-deeplink","auth":"Public (30 requests/minute per IP)","summary":"A signed exec deeplink for the installer, valid one hour (?authority=&auth= must name a registered authority URL).","fullUrl":"https://install.fullstacked.cloud/v1/install-deeplink"},{"service":"install","topic":"api-reference","id":"install.manifest","method":"GET","path":"/manifest.json","auth":"Public","summary":"Runtime-aware Client GUI release manifest (?runtime=<version>).","fullUrl":"https://install.fullstacked.cloud/manifest.json"},{"service":"install","topic":"api-reference","id":"install.release","method":"GET","path":"/releases/:file","aliases":["/dist/:file"],"auth":"Public","summary":"Downloads a Client GUI archive cloud-client-v<version>-rt.<runtime>.tar.gz.","fullUrl":"https://install.fullstacked.cloud/releases/:file"},{"service":"docs","topic":"api-reference","id":"docs.index","method":"GET","path":"/","auth":"Public","summary":"The documentation portal: HTML, ?format=md (Markdown for agents) or ?format=json.","codeExamples":{"curl":"curl -sS \"https://docs.fullstacked.cloud/?format=md\""},"fullUrl":"https://docs.fullstacked.cloud/"},{"service":"docs","topic":"api-reference","id":"docs.topic","method":"GET","path":"/:topic","auth":"Public","summary":"One topic guide (runtime, project-runtime, me, data, ...) as HTML, md or json.","fullUrl":"https://docs.fullstacked.cloud/:topic"},{"service":"docs","topic":"api-reference","id":"docs.endpoints","method":"GET","path":"/api/v1/endpoints","auth":"Public","summary":"This endpoint catalog as JSON.","fullUrl":"https://docs.fullstacked.cloud/api/v1/endpoints"},{"service":"docs","topic":"api-reference","id":"docs.healthz","method":"GET","path":"/healthz","auth":"Public","summary":"Health check.","fullUrl":"https://docs.fullstacked.cloud/healthz"},{"service":"docs","topic":"api-reference","id":"docs.version","method":"GET","path":"/version","auth":"Public","summary":"Service version.","fullUrl":"https://docs.fullstacked.cloud/version"}]}