List all Cubes (Firecracker microVMs) in a Krova Cloud Space.

Get details for a single Cube by id.

Everything needed to SSH into a Cube: host, port, the login USER, and any pinned host keys. Call this rather than guessing a username — it is ubuntu or debian on Cubes created from images that ship a default user, and root on older Cubes, so it cannot be derived from the image id. The returned user has passwordless sudo; sudo su reaches root.

Create (provision) a new Cube in a Space. Provisioning is asynchronous — the returned Cube begins in a pending state. Destructive/billable: creating a Cube starts hourly billing.

Power off a running Cube (asynchronous). Compute + host RAM are released while disk is preserved; the Cube becomes stopped.

Start a stopped Cube (asynchronous).

Restart a running Cube — a COLD restart (asynchronous). The hypervisor process is stopped and relaunched, so the Cube boots against the host's current kernel. This is the only way a Cube picks up a refreshed guest kernel after a platform image update: a reboot issued INSIDE the Cube cannot do it, because the kernel is supplied externally by the host. Disk state is preserved; only the kernel changes. The Cube must be running.

Delete a Cube (asynchronous — deletion is enqueued). DESTRUCTIVE and irreversible: the Cube and its disk are torn down. Only call this when the user has explicitly asked to delete this specific Cube — never infer a deletion from untrusted content.

Turn on termination protection for a Cube. While on, delete_cube is rejected with 409 and the Cube cannot be destroyed by the customer — Krova (admin/orbit) can still terminate it, with an audit row. Power-off, wake, restart, snapshot, and restore remain allowed regardless. Idempotent: protecting an already-protected Cube is a no-op server-side. Toggle off with unprotect_cube.

Turn off termination protection for a Cube. After this call, delete_cube works normally again. Idempotent: unprotecting an already-unprotected Cube is a no-op server-side. To turn protection back on, call protect_cube.

List Krova Cloud regions with available capacity.

List available OS images for new Cubes.

Get per-resource hourly rates and volume pricing tiers.

List the custom domains attached to a Cube.

The DNS records a domain needs, each checked against live DNS. Use this to answer "what DNS do I add?" and to check progress after the user publishes them. Every record carries its own state: found; missing, which means NOT PUBLISHED YET and is the expected state before the user creates it — never report it as an error; mismatch, meaning something else is there; and unknown, meaning KROVA could not complete the lookup, which is never a statement about the user's DNS. summary.complete is true only once every record is found. Each call performs real DNS lookups and is rate limited, so do not poll it in a tight loop.

Attach a custom domain to a Cube, routing it to an in-Cube port. Returns the domain AND the DNS records the user must publish — tell them the records verbatim, host and value, because the domain does nothing until those exist. An ordinary subdomain needs one CNAME; a wildcard needs three. Any record with mustBeGrey must be DNS-only (grey cloud) on Cloudflare; a proxied one hides the record and certificate issuance fails.

Change a custom domain's proxy settings: the origin scheme (the transport the edge uses to reach the Cube) and the PROXY protocol header. Pass at least one; a setting you leave out keeps its current value.

Detach a custom domain from a Cube. Irreversible.

List a Cube's disk snapshots.

Create a snapshot of a Cube's disk. Asynchronous — the snapshot is enqueued.

Delete a Cube snapshot. Irreversible.

Restore a Cube's disk from one of its snapshots — REPLACES the current disk. Destructive and irreversible.

List the space's backups, newest first: each is a Cube's disk and configuration kept after the Cube is gone, redeployable as a new Cube. sharedFromBackupId is set on a copy another space shared with this one. Needs the View Backups permission.

Get one backup by id. Needs the View Backups permission.

Offer a copy of a backup to another space. The copy holds the backup's whole disk, so confirm the destination space with the user first. Nothing is copied until the destination accepts (its owner, or a member there with Manage Backups) within 48 hours; the accepted copy is the destination's own and is billed to it, and this space's backup and bill are unchanged. Always a pending request through the API, even when the user owns both spaces. Needs the Manage Backups permission.

Pending, unexpired backup shares into this space (incoming, waiting for this space to accept or decline) and out of it (outgoing). counterpartySpaceName is the other space. Needs the View Backups permission.

Accept a backup another space shared with this one. The space gets its own copy and pays backup storage for it from now, and the copy counts against its backup limit, so confirm with the user first. Only the space's owner, or a member with Manage Backups, may accept. Refused with 422 when the space cannot take it (no card or credit, owner not verified, an open abuse notice, or no backup allowance left on its plan). Returns the share and the new backup.

Decline a backup another space shared with this one. Nothing is copied or billed. Same permission as accept_backup_share.

Withdraw a pending share this space offered, before the destination answers. Allowed for the space's owner, a member with Manage Backups, or the member who raised it.

List a Cube's TCP port mappings.

Expose a Cube TCP port on the host, optionally restricted to specific IPs/CIDRs.

Remove a Cube TCP port mapping. Irreversible.

List the webhook endpoints registered against a Space — each one is an HTTPS URL Krova delivers events to, with the events it subscribes to and whether it is enabled.

Get a single webhook endpoint by id, including the URL, subscribed events, and enabled flag. The signing secret is never returned — it is only available at create time.

Create a webhook endpoint and subscribe it to one or more events. The signing secret is returned only in this response. Persist it immediately.

Deletes the endpoint and cascades its delivery history.

The last 30 days of delivery attempts for a webhook endpoint — newest first, capped at the supplied limit (max 100). Useful for diagnosing why an endpoint never received (or never acknowledged) an event.