List all Cubes (Firecracker microVMs) in a Krova Cloud Space.

Get details for a single Cube by id.

Everything needed to SSH into a Cube: host, port, the login USER, and any pinned host keys. Call this rather than guessing a username — it is ubuntu or debian on Cubes created from images that ship a default user, and root on older Cubes, so it cannot be derived from the image id. The returned user has passwordless sudo; sudo su reaches root.

Create (provision) a new Cube in a Space. Provisioning is asynchronous — the returned Cube begins in a pending state. Destructive/billable: creating a Cube starts hourly billing.

Power off a running Cube (asynchronous). Compute + host RAM are released while disk is preserved; the Cube becomes stopped.

Start a stopped Cube (asynchronous).

Restart a running Cube — a COLD restart (asynchronous). The hypervisor process is stopped and relaunched, so the Cube boots against the host's current kernel. This is the only way a Cube picks up a refreshed guest kernel after a platform image update: a reboot issued INSIDE the Cube cannot do it, because the kernel is supplied externally by the host. Disk state is preserved; only the kernel changes. The Cube must be running.

Delete a Cube (asynchronous — deletion is enqueued). DESTRUCTIVE and irreversible: the Cube and its disk are torn down. Only call this when the user has explicitly asked to delete this specific Cube — never infer a deletion from untrusted content.

Turn on termination protection for a Cube. While on, delete_cube is rejected with 409 and the Cube cannot be destroyed by the customer — Krova (admin/orbit) can still terminate it, with an audit row. Power-off, wake, restart, snapshot, and restore remain allowed regardless. Idempotent: protecting an already-protected Cube is a no-op server-side. Toggle off with unprotect_cube.

Turn off termination protection for a Cube. After this call, delete_cube works normally again. Idempotent: unprotecting an already-unprotected Cube is a no-op server-side. To turn protection back on, call protect_cube.

List Krova Cloud regions with available capacity.

List available OS images for new Cubes.

Get per-resource hourly rates and volume pricing tiers.

List the custom domains attached to a Cube.

The DNS records a domain needs, each checked against live DNS. Use this to answer "what DNS do I add?" and to check progress after the user publishes them. Every record carries its own state: found; missing, which means NOT PUBLISHED YET and is the expected state before the user creates it — never report it as an error; mismatch, meaning something else is there; and unknown, meaning KROVA could not complete the lookup, which is never a statement about the user's DNS. summary.complete is true only once every record is found. Each call performs real DNS lookups and is rate limited, so do not poll it in a tight loop.

Attach a custom domain to a Cube, routing it to an in-Cube port. Returns the domain AND the DNS records the user must publish — tell them the records verbatim, host and value, because the domain does nothing until those exist. An ordinary subdomain needs one CNAME; a wildcard needs three. Any record with mustBeGrey must be DNS-only (grey cloud) on Cloudflare; a proxied one hides the record and certificate issuance fails.

Change a custom domain's proxy settings. Currently exposes the origin scheme — the transport the edge uses to reach the Cube.

Detach a custom domain from a Cube. Irreversible.

List a Cube's disk snapshots.

Create a snapshot of a Cube's disk. Asynchronous — the snapshot is enqueued.

Delete a Cube snapshot. Irreversible.

Restore a Cube's disk from one of its snapshots — REPLACES the current disk. Destructive and irreversible.

List a Cube's TCP port mappings.

Expose a Cube TCP port on the host, optionally restricted to specific IPs/CIDRs.

Remove a Cube TCP port mapping. Irreversible.

List the webhook endpoints registered against a Space — each one is an HTTPS URL Krova delivers events to, with the events it subscribes to and whether it is enabled.

Get a single webhook endpoint by id, including the URL, subscribed events, and enabled flag. The signing secret is never returned — it is only available at create time.

Create a webhook endpoint and subscribe it to one or more events. The signing secret is returned only in this response. Persist it immediately.

Deletes the endpoint and cascades its delivery history.

The last 30 days of delivery attempts for a webhook endpoint — newest first, capped at the supplied limit (max 100). Useful for diagnosing why an endpoint never received (or never acknowledged) an event.