deploykit_docs

docs API Reference

API Reference

The tRPC API that powers the dashboard, plus the REST and Socket.IO endpoints around it.

tRPC Architecture

DeployKit's API is built with tRPC 11 on Fastify 5. The dashboard uses exactly the same procedures you can call, with input validated by Zod schemas shared between client and server. Everything is served on your panel domain:

  • Procedures live under /trpc/<router>.<procedure>, e.g. /trpc/application.deploy
  • Queries are GET requests with the input as URL-encoded JSON in ?input=
  • Mutations are POST requests with a JSON body; Content-Type: application/json is mandatory (other types get 415)
  • No data transformer is used: inputs and outputs are plain JSON, and successful responses are wrapped as {"result":{"data":...}}
  • Request bodies are capped at 1 MiB (4 MiB for config.import)

Authentication

Requests are authenticated with a JWT access token in the Authorization header. There are no separate API keys — scripts log in as a user and act with that user's role. Access tokens last 15 minutes and refresh tokens 7 days; every refresh returns a new pair and invalidates the old refresh token.

bash
# Log in — returns { user, accessToken, refreshToken }
curl -s https://deploy.example.com/trpc/auth.login \
  -H 'Content-Type: application/json' \
  -d '{"email":"admin@example.com","password":"..."}'

# Query: list your projects
curl -s https://deploy.example.com/trpc/project.list \
  -H "Authorization: Bearer $ACCESS_TOKEN"

# Query with input
curl -s -G https://deploy.example.com/trpc/application.byId \
  --data-urlencode 'input={"id":"<application-uuid>"}' \
  -H "Authorization: Bearer $ACCESS_TOKEN"

# Mutation: trigger a deploy
curl -s https://deploy.example.com/trpc/application.deploy \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"id":"<application-uuid>"}'

# Refresh when the access token expires
curl -s https://deploy.example.com/trpc/auth.refresh \
  -H 'Content-Type: application/json' \
  -d '{"refreshToken":"<refresh_token>"}'

auth.login and auth.register are limited to 10 requests per minute per IP, and all API routes to 200 per minute. auth.register only works while the instance has no users.

Access Levels

Each procedure is public, authenticated, operator-only or admin-only by global role. Most project resources (applications, databases, stacks, game servers) are open to any authenticated user at the procedure level and then checked against the caller's role in the owning project: non-members get NOT_FOUND, members without enough rights get FORBIDDEN. Running code (tasks, game console, file writes, mods) needs both a global operator role and operator rights in the project. See Users & RBAC.

Available Routers

auth

Registration, login, logout, token refresh, profile

Procedures: hasUsers, register, login, refresh (public) · me, logout, changePassword, updateProfile

project

Projects that group apps, databases, stacks and game servers

Procedures: list, byId · create, update, updateStatusPage (operator) · delete (admin)

projectMember

Per-project role management

Procedures: list, add, updateRole, remove, myRole, availableUsers

application

Application lifecycle: config, env vars, domains, deploys, rollback, previews, maintenance

Procedures: byId, create, update, delete, updateEnvVars, addDomain, removeDomain, deploy, deployBranch, rollback, start, stop, setMaintenance, logs, stats, instances, deployments, listPreviews, deletePreview

database

Database provisioning, backups and restore

Procedures: byId, create, delete, start, stop, stats, updateBackupConfig, triggerBackup, listBackups, deleteBackup, restoreBackup

compose

Docker Compose stacks

Procedures: list, byId, containers, containerLogs, deployments, create, deployFromTemplate, updateComposeFile, updateEnvVars, addDomain, removeDomain, deploy, stop, start, restart, delete

template

One-click template catalogue

Procedures: list, byId · import (operator) · registry, refreshCatalog (admin)

gameServer

Game servers, with nested catalog, files, backups and mods routers

Procedures: listByProject, byId, stats, create, update, start, stop, restart, delete, consoleSend · catalog.{list, byId, refresh} · files.{list, read, write, mkdir, delete, rename} · backups.{list, create, restore, delete, updateConfig} · mods.{sources, sourcesForGame, search, searchModpacks, versions, list, checkUpdates, add, update, remove, setModpack, applyChanges}

task

Scheduled tasks and one-off commands

Procedures: list, previewCron, runs, runOutput · create, update, delete, runNow, runAdHoc (operator)

server

Servers: SSH connections, Docker setup, image cleanup

Procedures: list, byId · testConnection, healthCheck (operator) · create, createLocal, update, delete, installDocker, pruneImages, pruneImagesAll (admin)

sshKey

SSH key catalogue (admin only)

Procedures: list, byId, generate, create, update, delete

github

GitHub App registration, installations and repositories

Procedures: status, listInstallations, listRepositories, listBranches · startManifest, completeManifest, connectExisting, test, syncInstallation, syncInstallations, disconnect (admin)

config

Configuration export and import as YAML (all mutations)

Procedures: exportInstance, import (admin) · exportProject (project operator)

metrics

Metric history and alert rules

Procedures: history, timeseries, listRules, recentEvents, alertStats · createRule, updateRule (operator) · deleteRule (admin)

logs

Persistent log search

Procedures: search

notification

Notification channels

Procedures: list, byId, availableEvents · create, update, delete, toggle, test (operator)

user

User management and role assignment (admin only)

Procedures: list, create, updateRole, resetPassword, delete

audit

Audit log querying (admin only)

Procedures: list, stats

settings

Instance settings: CurseForge / Steam API keys (admin only)

Procedures: modKeys.status, modKeys.set

dashboard

Overview statistics

Procedures: summary

status

Public status page data (no login)

Procedures: getPublic

REST Endpoints

A few endpoints sit outside tRPC: Git provider webhooks (verified by signature or token, see Webhooks; limited to 120 requests per minute per IP) and streamed game server file transfers (Bearer token, project access checked).

POST/api/webhooks/github
POST/api/webhooks/gitlab
POST/api/webhooks/generic
POST/api/game-servers/:id/files/upload
GET/api/game-servers/:id/files/download
GET/api/game-servers/:id/backups/:backupId/download

Real-Time Events (Socket.IO)

Socket.IO is served at path /ws and authenticates with the access token passed as auth.token in the handshake. Clients join rooms with subscribe:deployment, subscribe:logs, subscribe:metrics and subscribe:task-run (each checked against project access) and receive events such as deploy:status, deploy:log, container:log, metrics:update, task:status and alert:fired. The web terminal also runs over this connection. Only WEB_URL is accepted as an origin.