Installation settings
Read and change self-hosted installation settings and setup.
Installation settings control a self-hosted Synq instance. Resource operations below use the shared SDK/HTTP interface where available; onboarding, recovery, and remaining setup endpoints are HTTP-only.
See Servers for hosts and component installation, Edge administration for existing sites, and Data transfer for imports, exports, and team-mode migration.
Onboarding & setup
GET /api/system/onboarding returns { configured: boolean } — true once at least one server exists. The
POST variant runs the same logic as the internal /setup push but only while the instance is unconfigured
(it returns 403 "Instance already configured" afterward), so first-run flows don't need a token.
POST /api/system/onboardingProp
Type
The POST /api/system/setup route accepts the same body but is reserved for the local host process of desktop app
versions up to 1.2.5 (the current app doesn't call it) and requires the internalAuth shared token rather than a user session; it can also target an existing server by passing
serverId.
Instance settings
GET /api/system/settings returns the instance config (auth mode, tunnel provider, default build mode and
rollback window, invitation mail source, team mode, migration target). PATCH updates only the fields you
send. DELETE wipes instance settings and every server row.
const result = await ship.system.updateSettings({
defaultBuildMode: "docker",
});
console.log(result);curl -X PATCH "$SYNQ_URL/api/system/settings" \
-H "Authorization: Bearer $SYNQ_TOKEN" \
-H "Content-Type: application/json" \
-d '{"defaultBuildMode":"docker"}'Prop
Type
Zero-auth is double-gated
Setting authMode: "none" on anything other than a desktop deployment means anyone who can reach the API acts
as admin. The operator must both start the process with SYNQ_ALLOW_ZERO_AUTH=true (else 403) and
send confirm: "I-understand-no-auth" in the body (else 400).
Promote zero-auth to a real login
POST /api/system/upgrade-to-auth turns the synthetic zero-auth user into an email/password account and flips
authMode from none to local, keeping the same user id so existing projects, deployments, and audit rows
still resolve. It is only callable while authMode === "none" (otherwise 400).
POST /api/system/upgrade-to-authProp
Type
Browse the host filesystem
GET /api/system/browse?path=<dir> lists child directories of a path (defaults to the host's home
directory), flagging which look like deployable projects. Used by the "deploy a local folder" picker.
Returns { path, directories: [{ name, path, isProject }] } — projects first, then alphabetical. Non-directory
paths return 400, missing paths 404.
Operations
Resource methods
| Operation | SDK | REST API |
|---|---|---|
| Browse an authorized host filesystem location. | system.browse(input?) | GET /api/system/browsesettings:read |
| Read database and installation health. | system.health() | GET /api/system/diagnosticssettings:read |
| Read instance settings. | system.getSettings() | GET /api/system/settingssettings:read |
| Change instance settings. | system.updateSettings(input) | PATCH /api/system/settingssettings:write |
| Read SMTP settings with secrets masked. | system.getEmailSettings() | GET /api/system/settings/emailsettings:read |
| Configure SMTP delivery for the installation. | system.updateEmailSettings(input) | PUT /api/system/settings/emailsettings:write |
| Send a test message using the configured SMTP settings. | system.sendTestEmail(input) | POST /api/system/settings/email/testsettings:write |
| Reset supported instance settings. | system.resetSettings() | DELETE /api/system/settingssettings:admin |
| Read the apps domain free app subdomains use, where it comes from, its wildcard DNS record and whether that record points at this server. | system.getAppsDomain() | GET /api/system/apps-domainsettings:read · Self-hosted |
| Set or clear the apps domain from Settings (only while the server's configuration doesn't set one). | system.updateAppsDomain(input) | PUT /api/system/apps-domainsettings:admin · Self-hosted |
| Read the scheduled Docker cleanup: schedule, scope, servers and last run. | system.getDockerCleanupSchedule() | GET /api/system/docker-cleanup/schedulesettings:read · Self-hosted |
| Change the scheduled Docker cleanup's schedule, scope and servers. | system.updateDockerCleanupSchedule(input) | PUT /api/system/docker-cleanup/schedulesettings:admin · Self-hosted |
| Read the control-plane database backup settings and recent runs. | system.getPanelBackup() | GET /api/system/panel-backupsettings:read · Self-hosted |
| Change the control-plane database backup destination, schedule, retention and options. | system.updatePanelBackup(input) | PUT /api/system/panel-backupsettings:admin · Self-hosted |
| Start a control-plane database backup now. | system.runPanelBackup() | POST /api/system/panel-backup/runsettings:admin · Self-hosted |
| List the control-plane database backups stored at the destination. | system.listPanelBackups() | GET /api/system/panel-backup/backupssettings:read · Self-hosted |
HTTP endpoints
| Operation | SDK | REST API |
|---|---|---|
| Create the initial administrator during authorized bootstrap. | HTTP only | POST /api/system/bootstrap-adminInternal operator · Self-hosted |
| Begin the installation's Cloud account connection. | HTTP only | POST /api/system/cloud-connectInternal operator · Self-hosted |
| Read the installation's Cloud connection status. | HTTP only | GET /api/system/cloud-statusInternal operator · Self-hosted |
| Read installation health. | HTTP only | GET /api/system/healthInternal operator · Self-hosted |
| This panel's license: locked or not, why, the installation ID, last check-in and lease expiry. Public, so the lock screen works before sign-in. | HTTP only | GET /api/licenseHandler authentication |
| Set a new license key (instance admins) and check in with it at once. The key is never returned or logged. | HTTP only | POST /api/licensesettings:admin |
| Check in with the license server now (the lock screen's Retry). Rate-limited. | HTTP only | POST /api/license/check-inHandler authentication |
| Create an account from an eligible self-hosted invitation. | HTTP only | POST /api/system/invite-signupHandler authentication · Self-hosted |
| First-run check — is any server configured yet? | HTTP only | GET /api/system/onboardingHandler authentication · Self-hosted |
| First-run setup; persists settings and creates the first server. Returns 403 once configured. | HTTP only | POST /api/system/onboardingHandler authentication · Self-hosted |
| Test a connection during initial onboarding. | HTTP only | POST /api/system/onboarding/test-connectionHandler authentication · Self-hosted |
| Reset the administrator password through the local recovery boundary. | HTTP only | POST /api/system/reset-admin-passwordInternal operator · Self-hosted |
Stage a new host for the panel (the server's synq panel-domain command): route it and issue its certificate, rolled back when that fails. Progress is on the registration stream. | HTTP only | POST /api/system/panel-domainInternal operator · Self-hosted |
| Register the Synq installation as a managed application. | HTTP only | POST /api/system/self-registerInternal operator · Self-hosted |
| Stream installation registration progress. | HTTP only | GET /api/system/self-register/streamInternal operator · Self-hosted |
| Read instance config for the desktop app. | HTTP only | GET /api/system/setupInternal operator · Self-hosted |
| Push instance config from the desktop app. | HTTP only | POST /api/system/setupInternal operator · Self-hosted |
| Promote a zero-auth instance to email/password login. | HTTP only | POST /api/system/upgrade-to-authHandler authentication · Self-hosted |
| Read one live sample of a server's CPU, memory, disk and load (the JSON form of the live monitor, for scripts and AI agents). | HTTP only | GET /api/system/servers/:id/statsserver:read · Self-hosted |