Panel version, OS, CPU cores, CPU usage and physical memory totals. Use this first to confirm connectivity and see what the box looks like.

Capacity and inode usage for every mounted partition. Use before any operation that writes large files, uploads a certificate, or imports a database dump.

Realtime CPU, memory, load average and cumulative network traffic counters.

Number of install/compile tasks still running. Poll this after asking the panel to install software instead of guessing when a long operation finished.

Report whether a newer panel release is available. Read-only when called without force.

Installed MySQL version and whether the service is running.

All PHP sites with id, domain, root path, remark, expiry and backup count. This is the entry point for any site operation, since most actions need a numeric site id.

Fetch a single site record by id. Cheaper and more reliable than paging the whole list when the id is already known.

Available site groups/classification ids, with id 0 being the default group.

Every domain bound to a site, including the port each one answers on.

Absolute root directory of a site, without listing every site.

Every PHP version installed on the panel, with the "00" pseudo-version meaning pure static. Pass one of these versions when creating a site.

Which PHP version a specific site currently runs.

Named rewrite rule templates shipped with the panel (wordpress, laravel5, thinkphp, ...).

Contents of one rewrite template, so a rule can be reviewed before it is applied to a live site.

Raw nginx or apache vhost file for a site. Useful for debugging a 502 or a rewrite that is not taking effect.

Whether SSL is deployed for a site, plus certificate subject and expiry when present.

The .user.ini anti-cross-site protection flag, access-log flag and the current run directory of a site.

What a site deletion would take with it: associated domains, databases, FTP accounts and root directory. Always call this before site_delete so the user can see the blast radius.

All SSL certificates uploaded to the panel, with the hash needed to deploy one to a site.

All MySQL databases known to the panel, with user, access host and size.

Table names, engines, row counts and total size for a database. Use this to confirm a schema landed before pointing an app at it.

Hosts a database user is allowed to connect from, plus its SSL mode.

Backup files recorded for a database, newest first.

Databases that were deleted and can still be restored. Use db_delete_check first: the panel keeps them recoverable.

The record the panel would remove, so a deletion can be confirmed against the right database.

Create a PHP site, optionally with an FTP account and a MySQL database in one call. The panel generates passwords; the response returns them once, so capture them for the user rather than logging them.

Delete a site. Run site_delete_check first and show the user what would be lost. The panel keeps a recycle bin for some resources, but do not rely on it.

Bring a stopped site back online.

Take a site offline without deleting it.

Bind an extra domain to an existing site. Newline-separated values add several at once. The site name must also be added to DNS.

Unbind one domain from a site, leaving the site itself intact.

Switch a site to another installed PHP version. Extensions available in one version may be missing in another, so verify afterwards.

Change the directory nginx resolves requests against, for apps whose entry point lives in a subdirectory such as /public. The directory must already exist inside the site root.

Toggle the .user.ini cross-site protection for a site.

Write the rewrite config for a site and reload nginx. Overwrites the current rule, so read the existing one first when changing something live.

Change which filenames nginx treats as directory indexes, comma separated.

Start a site backup. Poll panel_install_task_count or site_backups to see when it finishes.

Backup records for a site, newest first.

Create a MySQL database and user. Pass 127.0.0.1 as the access host unless the app connects from another machine, in which case pass that machine ip or % for any host.

Set a new password for an existing database user. Update the application config in the same change, or the app will lose the database.

Change which hosts a database user may connect from.

Start a database backup. The result lands in the panel backup directory.

Delete a database. The panel moves it to the recycle bin rather than dropping it immediately, but treat it as destructive and confirm with db_delete_check first.

Run OPTIMIZE TABLE on one or more tables of a database.

Run REPAIR TABLE on one or more tables of a database, for recovering from a crash.

Pull databases that exist in MySQL but are not tracked by the panel into the panel inventory. Safe and non-destructive to existing records.

Restore a deleted database using the rname shown by db_recycle_bin.

Import a .sql file that already exists on the panel host into a database. The file must be on the panel machine, not uploaded by this server.

Store a PEM certificate and private key in the panel. Returns the hash used by ssl_deploy.

Bind a stored certificate to one or more sites, replacing their current SSL configuration.

Remove the SSL configuration from a site, returning it to plain HTTP.

Read the MySQL root password, or set a new one when password is supplied. This is the highest-privilege credential on the box: the server refuses to expose it unless AAPANEL_ALLOW_DANGEROUS is set.

Set a new MySQL root password. Every existing root login, cron job and monitoring agent that used the old password will stop working.

Write any file the panel user can write, including vhost and nginx configs. This bypasses every validation in the site tools, so the server refuses it unless AAPANEL_ALLOW_DANGEROUS is set.

Read any file readable by the panel user, including /www/server/panel/config.json and database files. Refused unless AAPANEL_ALLOW_DANGEROUS is set.

Install a panel update. Refused unless AAPANEL_ALLOW_DANGEROUS is set.

Report the panel address, whether the connection works, the panel version, and which modes are active (read-only, dangerous operations). Safe to call at any time; it reveals no secrets.

Every operation this server exposes, with its risk level. Use it to discover what is possible and which operations are currently blocked by the server mode.