Create a BunkerWeb API token (Biscuit) for use outside this server; returns only the token, a live credential to keep secret. Give username and password, or omit both to use the server's credentials. Needs an API user; lifetime is BunkerWeb's API_BISCUIT_TTL_SECONDS. Redaction may mask it.

Check that the BunkerWeb API answers (GET /ping, returns pong); needs no credentials. The fastest liveness probe. Use diagnose_bunkerweb to also check authentication, version and instances, ping_instances to reach the instances themselves.

Read-only report on the connected BunkerWeb: API reachability, authentication, version, MULTISITE and instance counts; service (a service ID) adds its existence, draft state and setting owners. A failed check shows as FAIL or null, not an error. Use ping_api for a bare probe.

List every registered BunkerWeb instance (hostname, name, port, method, status, last_seen). Cached up to 60 s. This is registration data, not a live check: use ping_instances for reachability, get_instance for one host.

Ping one instance (hostname) or every registered instance (hostname omitted) and return each answer; BunkerWeb replies 502 if any ping fails. Read-only. Use list_instances for registration data without pinging.

Stop one instance (hostname) or every registered instance (all=true), never both; stopped instances serve no traffic until restarted outside this API. 502 if a stop is not acknowledged. Use reload_instances to apply config instead. Acts on the instances immediately.

Fetch one registered instance by hostname (name, ports, server_name, method, status, last_seen); 404 if unknown. Cached up to 60 s. Use list_instances to find hostnames, ping_instances to test reachability.

Register an instance (hostname may carry a scheme and port, https://host:5443). Name defaults to 'manual instance', method to api; fails if it exists. Use update_instance to change one. Saved to the database; the scheduler applies it later; this tool cannot confirm it is live.

Change a registered instance's name, ports, HTTPS flag, server_name or method; omitted fields keep their value. Unknown or read-only instances are rejected. Use create_instance for a new host. Saved to the database; the scheduler applies it later; this tool cannot confirm it is live.

Unregister instances by hostname; use list_instances to find them. Hosts keep running (stop_instances halts them). Only UI/API-registered ones go; others come back as skipped, 404 if none can. Saved to the database; the scheduler applies it later; this tool cannot confirm it is live.

Reload configuration on one instance (hostname) or every registered instance (all=true), never both. test=true (default) checks the config first, then reloads; test=false reloads without the check. Returns only success or a 502 error. Use stop_instances to halt. Acts on the instances immediately.

List active bans as each instance reports them (ip, scope, service, kind, incl. CrowdSec entries), grouped per instance. Cached up to 30 s. Use it to check whether an IP is banned, or for the exact ip and service that unban_ips when writes are enabled needs.

Ban IPs on every instance: bans is a list of {ip, exp, reason, service}, exp in seconds (0 = permanent), service omitted for global. All IPs are validated before any is banned. Use unban_ips to lift a ban. Acts on the instances immediately.

Lift bans for IPs on every instance, globally or per service; match the scope list_bans shows. An IP also blocked by CrowdSec may be refused (409). Use list_bans first to find them. Acts on the instances immediately.

List services (id, method, is_draft, template, security mode, dates); with_drafts=false hides drafts. Cached up to 5 min. Use get_service for one service's settings, get_global_config for global ones.

Read one service's settings by ID (its first SERVER_NAME), with the method that set each; full=true adds defaults, with_drafts=false hides drafts. 404 if unknown. Cached up to 5 min. Use list_services to find IDs, get_global_config for global ones.

Create a service named by SERVER_NAME (first word becomes its ID) with optional unprefixed settings and a draft flag. Fails if the name or a server name is taken. Use update_service to change one. Saved to the database; the scheduler applies it later; this tool cannot confirm it is live.

Change a service's settings, rename it or set is_draft; needs MULTISITE=yes. Unknown or externally owned keys are skipped, and a receipt reads back the stored values. Use update_global_config for global. Saved to the database; the scheduler applies it later; this tool cannot confirm it is live.

Delete a service and all its settings, not reversible; wizard-managed services are refused. Use update_service with is_draft=true to take one offline instead. Saved to the database; the scheduler applies it later; this tool cannot confirm it is live.

Read global settings; full=true adds defaults, methods=true adds the method that set each. Cached up to 10 min. Use get_service for one service's settings.

Set global settings from key-value pairs; settings you omit are kept, values are stored as strings. Use update_service for one service's settings. Saved to the database; the scheduler applies it later; this tool cannot confirm it is live.

List custom config snippets (service, type, name, draft flag), optionally with content, across every scope unless filtered. Use get_config to read one snippet in full.

Read one custom config snippet with its content, by service, type and name; 404 if unknown. Use list_configs to find snippets.

Create one custom config snippet from text (method api); fails if the name exists or the service is unknown. Use create_configs_from_files to upload files. Saved to the database; the scheduler applies it later; this tool cannot confirm it is live.

Edit, rename or move a snippet from text; omitted fields keep their value. UI/API-managed or template-derived only; templates cannot be renamed. A no-op is rejected. Use update_config_from_file for files. Saved to the database; the scheduler applies it later; this tool cannot confirm it is live.

Delete config snippets: configs is a list of {service, type, name}, service 'global' for global ones. Only UI/API-managed ones go; others come back as skipped, 404 if none. Use list_configs to find them. Saved to the database; the scheduler applies it later; this tool cannot confirm it is live.

Create snippets from base64 files ({filename, content_base64}) sharing one type and service; each is named after its sanitized file stem and bad files are reported, not fatal. Use create_config for text. Saved to the database; the scheduler applies it later; this tool cannot confirm it is live.

Replace a snippet from a base64 file ({filename, content_base64}); without new_name the stem renames it. UI/API-managed or template-derived only; templates cannot be renamed. Use update_config for text. Saved to the database; the scheduler applies it later; this tool cannot confirm it is live.

List installed plugins, filtered by type (all, external, ui, pro). type=ui lists the IDs accepted by uninstall_plugin when writes are enabled. Use list_jobs for jobs.

Install UI plugins from base64 archives ({filename, content_base64}; .zip, .tar.gz, .tar.xz with plugin.json). An existing plugin ID is refused; bad archives are reported. Uninstall first to replace. Saved to the database; the scheduler applies it later; this tool cannot confirm it is live.

Uninstall one UI-installed plugin by plugin_id; external and pro plugins are refused, 404 if absent. Use list_plugins type=ui to find IDs, install_plugins to add one (uninstall first to replace). Saved to the database; the scheduler applies it later; this tool cannot confirm it is live.

List files that scheduler jobs cached (service, plugin, job, file name, checksum, last_update). with_data inlines text only; binary files show a placeholder, so read them with get_cache_file download=true. Use get_cache_file to read one.

Delete job cache files: files is a list of {service, plugin, job_name, file_name} service omitted for global. Use list_cache_files to find the keys. Missing files are reported per file; run_jobs regenerates them. Queued for the scheduler; this tool cannot confirm it ran.

Read one job cache file by service, plugin, job_name and file_name as list_cache_files shows. Returns printable text; download=true returns base64 bytes instead. 404 if missing; sensitive files are refused when secret redaction is on. Use list_cache_files to find files.

List scheduler jobs with their run history and cache metadata. Use list_cache_files for the files they wrote, and run_jobs when writes are enabled to trigger them.

Trigger every job of the listed plugins (jobs: {plugin, name}; name is informational, all of a plugin's jobs run), e.g. after delete_cache_files. Returns only 'Jobs scheduled'; use list_jobs to check results. Queued for the scheduler; this tool cannot confirm it ran.

Search the official BunkerWeb documentation by meaning, in any language. Returns up to limit sections with title, URL, category, relevance and content, one per document. Use it for how-to and setting questions; use the API tools to read live state. Lower min_score if nothing matches.