Get fleet overview: worker counts, stack counts, container counts, failed stacks, recent deployments, fleet CPU/memory averages

Check API health and database connectivity

Get the deployed lattice-api version string. Use to check deploy drift against GitHub tags/commits (e.g. for /howfarbehind).

List all workers with status, IP, Docker version, runner version, last heartbeat

Get detailed worker info including metrics

Get recent worker metrics (CPU, memory, disk, network)

List all stacks with status, worker assignment, and deployment strategy

Get full stack details including compose YAML and env vars

List containers with status, image, ports, health. Filter by stack or status

Get full container details including config, health, env vars, ports

Get recent container logs (stdout/stderr)

Get container lifecycle events (start, stop, restart, health changes)

List deployments with status, strategy, timing. Filter by stack or status

Get deployment details including container-level status

Get deployment logs: pull, create, start, swap, rollback events with timing

Get recent audit log entries (who did what, when). Filter by user, action, or resource type to answer 'who deleted X' without scanning.

Deploy a stack (all containers or specific ones)

Restart all containers in a stack

Stop all containers in a stack

Start all containers in a stack

Update stack configuration (name, description, strategy, worker, etc.)

Start a stopped container

Stop a running container

Restart a container

Force kill a container

Pause a running container

Unpause a paused container

Remove a container entirely

Recreate a container (remove and create fresh)

Reboot a worker machine

Upgrade worker runner to latest version

Stop all containers on a worker

Start all containers on a worker

Update the Lattice API container. Pass version to deploy or roll back to a specific tag; omit it to take whatever the compose file resolves to. Returns 'already up to date' without restarting when the resolved image is the one already running

Update the Lattice web container. Pass version to deploy or roll back to a specific tag; omit it to take whatever the compose file resolves to

Rollback a deployment to its previous state

List all API tokens

Create a new API token for AI tools or automation

Delete an API token

List managed database instances with engine, version, status, worker and health. Filter by worker, engine or status

Get one database instance: engine, port, limits, snapshot schedule, retention and backup destination

Provision a database instance on a worker. Creates a real container. Omit port to have a free one allocated automatically — that is the recommended path; a port already in use returns 409 naming the conflict

Update a database instance's configuration. Only the fields you pass are changed

Delete a database instance record. Destructive — data is lost unless a snapshot exists. Check lattice_list_database_snapshots first

Start, stop, restart or remove a database instance's container. 'remove' destroys the container — data survives only if the volume or a snapshot does

Get a database instance's host, port, database and username. Contains no secrets — prefer this over the credential tools when you only need to know where a database lives

Reveal a database instance's live credentials. Every call is audited and recorded against the instance. Returns the application user by default; set include_root only when root access is genuinely required. Passwords come back masked to their first two characters — enough to confirm which credential is deployed, not enough to use. Set LATTICE_ALLOW_SECRET_VALUES=1 in the MCP server env to get the real values, or read them from the Lattice UI

DEPRECATED — returns root credentials from a plain GET. Use lattice_reveal_database_credentials instead, which is audited and scoped

Get a database instance's lifecycle history — every status transition, failure, reconciliation, console open and credential reveal. START HERE when a database is in an unexpected state: this is what explains how it got there

Get a database container's stdout/stderr. Use together with lattice_get_database_events when diagnosing a failed or degraded instance — the events say what happened, the logs say why

Get worker-emitted lifecycle messages for a database container, including provisioning progress and the reason a create failed

Authorise an interactive console session against a running database and return the worker, container and SQL client command to run. The session itself runs over the admin WebSocket, so this returns the authorisation, not a live shell

List host ports already claimed on a worker (by databases and by stack containers) and get a free suggestion. Check this before pinning a database to a specific port

List snapshots for a database instance, with size and creation time. Check this before deleting or restoring an instance

Take a snapshot of a database instance now, outside its schedule

Restore a database instance from one of its snapshots. Overwrites current data irreversibly — take a fresh snapshot first if the present state matters

Delete a database snapshot. Destructive — that restore point is gone

List configured backup destinations that database snapshots can be shipped to

Get one backup destination's configuration

Create a backup destination. config is a free-form object whose shape depends on type (e.g. an S3 destination takes bucket, region, endpoint and credentials)

Update a backup destination. Passing config replaces the whole object, it does not merge

Delete a backup destination. Instances pointing at it lose their backup target. Destructive

Test connectivity and credentials for a backup destination without writing a real backup. The test is dispatched over the worker's WebSocket, so worker_id is required and that worker must be connected

List configured container registries

Add a container registry

Update a registry's URL, type, credentials or active flag

Delete a registry. Containers pulling from it fail on their next deploy. Destructive

Test a saved registry's stored credentials

Test registry credentials before saving them

List repositories available in a registry — what images exist to deploy

List the tags published for one repository. Use this to answer 'what version can I deploy' or 'is the image my CI just built actually in the registry'

Search across workers, stacks and containers by name in one call. Faster than listing each type and filtering when you only have a partial name

Get detected fleet anomalies — restart loops, unhealthy containers, resource spikes, offline workers. The best first call when asked whether anything is wrong

Get aggregated fleet-wide CPU, memory, disk and network metrics over a time range

Get runner versions across workers and which are outdated. Use before lattice_upgrade_worker to see what actually needs upgrading

Re-poll every worker for its current runner version, refreshing what lattice_get_versions reports

Get a single container's CPU, memory and network metrics over time

Get the user this API token authenticates as, including role

Create an empty stack. Add containers with lattice_create_container, or use lattice_import_compose to create one from compose YAML

Delete a stack and every container in it. Destructive and not recoverable — export it first with lattice_export_stack if you might want it back

List the containers belonging to one stack

Replace a stack's compose YAML. This rewrites the stored definition but does not deploy — call lattice_deploy_stack afterwards

Reconcile a stack's container records against its stored compose YAML, reporting which containers changed and why

Create a new stack from a docker-compose YAML document

Export a stack's full definition — stack settings plus every container config — as a portable JSON document. Take one before any destructive stack change

Recreate a stack from a document produced by lattice_export_stack

Save an existing stack's configuration as a reusable template

List a stack's deploy tokens — the credentials CI uses to trigger deployments. Token values are never returned; last_used_at reveals whether CI is actually reaching Lattice

Create a deploy token for a stack. The plaintext is returned once and this server masks it to its first two characters, so the usable value never enters a transcript — read it from the Lattice UI, or set LATTICE_ALLOW_SECRET_VALUES=1. Used as https:///api/deploy/?container=

Delete a deploy token. Any CI pipeline using it stops being able to deploy. Destructive

Approve a deployment that is waiting on manual approval

Add a container definition to a stack. Creates the record only — deploy the stack to actually start it. JSON-shaped fields are passed as strings, matching the API

Update a container definition. Changes the stored record — redeploy or recreate the container for them to take effect

Delete a container definition and its running container. Destructive — lattice_stop_container only stops it

Register a worker. The machine still needs the runner installed and a worker token before it connects

Update a worker's name, hostname, IP, status, labels or active flag

Delete a worker. Every stack pinned to it becomes undeployable. Destructive

Get live per-container resource stats from one worker

List a worker's registration tokens. Values are never returned

Create a registration token for a worker, used by the runner to connect. Plaintext is returned once and this server masks it to its first two characters — read the usable value from the Lattice UI, or set LATTICE_ALLOW_SECRET_VALUES=1