Run402

Delete a project data snapshot and release its CAS references.

Delete a secret from a project.

Schedule the KMS key for a signer for deletion (7-day AWS minimum window). Refused if the signer has on-chain balance ≥ dust — drain first.

Release a custom subdomain. The URL will stop serving content.

Delete a published app version.

Demote a user from project_admin role by email. Reverts to default authenticated role. Requires service_key.

Unified apply primitive. Accepts a structured ReleaseSpec — database (migrations + expose), value-free secrets.require/delete declarations, functions, site, site.public_paths, subdomains, and routes.replace web routes — with explicit replace vs patch semantics per resource. Migration entries use id for immutable versioned SQL or name for generated/idempotent content-tracked SQL; name compiles client-side to <name>_<sha256(sql)[0:16]>. Use site.public_paths for clean static URLs such as /events backed by release asset events.html; explicit mode does not expose /events.html unless separately declared, while mode: 'implicit' restores filename-derived reachability and can widen access. Route entries map exact/final-wildcard browser paths like /admin and /admin/* to Node 22 Fetch Request -> Response functions, or exact GET/HEAD method-aware static aliases such as /events to { type: 'static', file: 'events.html' }; intentional read-only GET/HEAD wildcard function routes may set acknowledge_readonly: true. Direct /functions/v1/:name remains API-key protected. Secret values must be set first with set_secret, never placed in deploy specs. All bytes ride through CAS (no inline-body cap). Returns release_id, URLs, warnings, and a structured progress-event log. Stops before upload/commit on confirmation-required warnings unless reviewed codes are passed with allow_warning_codes or allow_warnings is true.

Read-only authenticated diagnostics for a Run402 public URL or host/path pair. Explains whether the current live release would serve the URL, including match, diagnostic body status, static manifest/cache metadata when returned, structured warnings for ignored query/fragment, and next steps. This does not fetch bytes, purge cache, mutate deploy state, or expose internal CAS URLs.

Fetch the recorded phase-event stream for a deploy operation. Returns the same `DeployEvent` shapes the `deploy` tool emits inline during an in-flight deploy — useful for inspecting a deploy after the fact (e.g., a deploy that the agent didn't observe directly, or one being resumed from a different process).

Deploy a serverless function (Node 22) to a project. Handler signature: export default async (req: Request) => Response. The function can `import { db, adminDb, auth, email, ai } from '@run402/functions'` — auto-bundled by the platform. Additional npm packages are bundled at deploy time when listed in `deps` (bare names resolve to latest; pinned/range specs are honored verbatim; `@run402/functions` and `run402-functions` rejected; max 30 entries; native binaries rejected). For schedule/email background triggers, prefer a unified deploy manifest with `functions.replace.<name>.triggers[]` so every trigger creates a durable function run. The response includes `runtime_version` (the bundled `@run402/functions` version — surface as 'Functions runtime version', never bare 'runtime'), `deps_resolved` (map of dep name → installed concrete version), and an optional top-level `warnings` array (sibling to the function record).

List recent deploy operations for a project. Returns operation_id, status, release_id, and timestamps. Use this to build deploy-history UIs or to find a recent operation_id to feed into `deploy_resume` / `deploy_events`. Pass `limit` to bound the result set; the gateway also returns a `cursor` for pagination when there are more.

Run a persisted apply plan against a contained branch and return the rehearsal report. Source project and plan stay untouched.

Fetch the current-live release inventory for a project. Returns `release_id: null` with an empty current-live inventory when no release is active yet. Use this before deploy diffs to understand what is currently serving. Canonical SDK errors are preserved.

Diff two release targets for a project. `from` may be `empty`, `active`, or a release id; `to` may be `active` or a release id. Returns release-to-release diff buckets and `migrations.applied_between_releases`. Semantic gateway errors such as invalid targets, same-release diffs, or no active release are preserved.

Fetch a release inventory by id. Returns release metadata, effective/desired state kind, site path inventory, function inventory, secret keys, subdomains, and applied migrations. Use `site_limit` to cap large site inventories. Canonical SDK errors are preserved.

Resume a deploy operation that ended in `activation_pending` or `schema_settling` (e.g. transient gateway failure between SQL commit and the pointer-swap activation). The gateway re-runs only the failed phase forward — SQL is never replayed. Idempotent: calling on an already-terminal operation returns the snapshot without re-running.

Deploy a static site (HTML/CSS/JS) from inline file bytes. Files are staged to a temp directory, then uploaded via the v1.32 plan/commit transport — only bytes the gateway doesn't already have are PUT. Served at a unique URL via CloudFront. Free with active tier.

Deploy a static site from a local directory. Walks the tree, hashes each file, and uploads only the bytes the gateway doesn't already have via the v1.32 plan/commit transport. Files named .git, node_modules, or .DS_Store are skipped; symlinks are rejected. Re-deploying an unchanged tree issues no S3 PUTs. Free with active tier.

Verify gateway/edge release coherence for a deploy operation. Returns the canonical edge-coherence report, including pointer-update state, probed paths, stale-release evidence, and next actions. Set wait=true to poll until coherent or timeout_seconds elapses.

Returns the live CDN state for a public blob URL (probed once from gateway-us-east-1 — NOT a global view). Use this when a deployed asset shows the wrong version or you suspect cache staleness. The result includes `expectedSha256` (from gateway DB), `observedSha256` (what CloudFront just served), recent `invalidation` status, and a human-readable `hint` with actionable next-steps. The `probeMayHaveWarmedCache: true` field warns that the probe itself populates the cache, so subsequent reads from elsewhere may differ. URLs outside the requesting project return 403; non-`*.run402.com` URLs return 400 unless they're on one of your active custom domains.

Activate custom mailbox addresses once ProjectDomain receive checks have passed. This switches addresses from managed fallback to the custom domain.

Apply safe provider-managed ProjectDomain changes when authority is available. Manual-DNS domains return a typed next action instead of mutating external DNS.

Re-observe DNS/provider state for a ProjectDomain and return the current checks. Useful as a preflight and drift detector before validation cycles.

Disconnect a ProjectDomain from the project and return mailbox addresses to managed fallback.

Create or update a project-scoped ProjectDomain desired state for web, email sending, inbound receive, mailbox addresses, and activation. Returns the aggregate with checks, DNS records, and next actions.

Get one ProjectDomain aggregate with desired, observed, effective, DNS records, checks, and next actions.

List all ProjectDomain aggregates for a project.

Repair Run402-owned ProjectDomain infrastructure, such as missing SES receipt-rule recipients, without changing external DNS.

Create a ProjectDomain receive test token for a mailbox address. Send mail to the returned address/token and poll domains_check for receive readiness.

Drain a KMS signer's entire native-token balance to a destination address. Works on suspended signers — the safety valve. Cost: chain gas + $0.000005 KMS sign fee.

Grouped, release-baselined error memory for a project, verdict-first: every page leads with a computed promote-vs-revert verdict (the gateway's numbers — never recomputed here), then the collapsed error identities. The post-promote watch: right after an apply/promote activates a release, call errors_list with new_in set to the just-activated release id (the promote response's next_actions carries a ready-made watch_errors command for the CLI equivalent). verdict.new_fingerprints > 0 means the release introduced NEW error identities — inspect errors[] (each row has samples with request ids + a runnable logs command) and consider reverting; new_fingerprints === 0 with healthy verdict.invocations_in_window means clean under real traffic (0 errors over 0 invocations is absence of signal, not proven health). Filter by since/until/function/kind/fingerprint; pass fingerprint_id to fetch one fingerprint's full detail (all samples + also_seen_in_functions). Quality tier coarse = the function predates the error side-channel; redeploy to upgrade fidelity. Read-only, own-project service-key auth; cursors are opaque.

Export the supported Run402 Core runtime slice of a Cloud project as a portable .r402ar archive. Can wait for readiness and write the downloaded archive to a local path. Secrets, credentials, billing, allowance, logs, fleet, and Cloud operations are never exported.

Fork a published app into a new project. Creates a full copy including database, functions, site, and optionally claims a subdomain.

Refresh function(s) onto the platform's current entry wrapper + bundled runtime WITHOUT changing source (capability function-runtime-rebuild, gateway v1.69+). Provide `name` to rebuild one function, or omit it to rebuild every function in the project. Re-bundles from each function's STORED source with deps pinned to the recorded exact versions, so the source `code_hash` is unchanged and no new release is created — this is how a gateway-side wrapper fix (e.g. an SSR auth.* fix) reaches an already-deployed function (a plain redeploy with unchanged source does NOT pick it up). Strictly opt-in; the platform never auto-rebuilds. Wallet-authed (project ownership; no service key) and allowed during billing grace. Functions deployed before dependency locking return CANNOT_REBUILD_UNLOCKED_DEPS — redeploy them from source with `deploy_function`. Use `list_functions` (runtime_stale) or `run402 doctor` to find stale functions.

Generate a PNG image from a text prompt. Costs $0.03 USDC via x402. Aspect ratios: square (1:1), landscape (16:9), portrait (9:16).

Get the current agent contact assurance state: wallet_only, email_pending, email_verified, passkey_pending, or operator_passkey.

Inspect a specific published app — details, required secrets, fork pricing.

Look up a previously submitted contract call by call_id. Returns lifecycle state (pending/confirmed/failed), block number, gas used, gas cost in USD-micros, receipt, and any error.

Get a sent email with details and any replies.

Get the raw RFC-822 bytes of an inbound email message, base64-encoded. The decoded bytes are bit-identical to the DKIM-signed original — no parsing, normalization, or CRLF cleanup. Use this for cryptographic verification (DKIM checks, zk-email proofs). Inbound messages only; outbound returns 404. For display/threading, use get_email instead.

Get the current authorization manifest for a project (GET /projects/v1/admin/:id/expose). Returns the last-applied manifest from `internal.project_manifest`, or a manifest reconstructed by introspecting live DB state if none has ever been applied. The `source` field is `"applied"` or `"introspected"`.

Get recent logs from a deployed function. Shows console.log/error output and error stack traces from CloudWatch.

Fetch one durable function run by fnrun_ id.

Fetch logs correlated to one durable function run.

Get the project's mailbox info (ID, address, slug, default/readiness metadata, and footer-policy fields when returned). Use to check if a mailbox exists.

Get details of a specific webhook by ID.

Read the operator's notification preferences (channels, cadence, threshold/lifecycle/security toggles, locale, timezone).

Compact operator-health snapshot: contact assurance, critical items, skipped notifications, organizations, projects, active thresholds. Read via run402 doctor.

Read one organization (GET /orgs/v1/:org_id) — its `org_id`, `display_name`, `tier`, `lease_started_at`, `lease_expires_at`, and your `role`. Any active member may read; a non-member (including a guessed id) gets the same non-revealing 403. Params: `org_id`.

Get one project data snapshot and its next actions.