API

Installation settings

Read and change self-hosted installation settings and setup.

Installation settings control a self-hosted Synq instance. Resource operations below use the shared SDK/HTTP interface where available; onboarding, recovery, and remaining setup endpoints are HTTP-only.

See Servers for hosts and component installation, Edge administration for existing sites, and Data transfer for imports, exports, and team-mode migration.

Onboarding & setup

GET /api/system/onboarding returns { configured: boolean } — true once at least one server exists. The POST variant runs the same logic as the internal /setup push but only while the instance is unconfigured (it returns 403 "Instance already configured" afterward), so first-run flows don't need a token.

POST /api/system/onboarding

Prop

Type

The POST /api/system/setup route accepts the same body but is reserved for the local host process of desktop app versions up to 1.2.5 (the current app doesn't call it) and requires the internalAuth shared token rather than a user session; it can also target an existing server by passing serverId.

Instance settings

GET /api/system/settings returns the instance config (auth mode, tunnel provider, default build mode and rollback window, invitation mail source, team mode, migration target). PATCH updates only the fields you send. DELETE wipes instance settings and every server row.

const result = await ship.system.updateSettings({
  defaultBuildMode: "docker",
});
console.log(result);
curl -X PATCH "$SYNQ_URL/api/system/settings" \
  -H "Authorization: Bearer $SYNQ_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"defaultBuildMode":"docker"}'

Prop

Type

Zero-auth is double-gated

Setting authMode: "none" on anything other than a desktop deployment means anyone who can reach the API acts as admin. The operator must both start the process with SYNQ_ALLOW_ZERO_AUTH=true (else 403) and send confirm: "I-understand-no-auth" in the body (else 400).

Promote zero-auth to a real login

POST /api/system/upgrade-to-auth turns the synthetic zero-auth user into an email/password account and flips authMode from none to local, keeping the same user id so existing projects, deployments, and audit rows still resolve. It is only callable while authMode === "none" (otherwise 400).

POST /api/system/upgrade-to-auth

Prop

Type

Browse the host filesystem

GET /api/system/browse?path=<dir> lists child directories of a path (defaults to the host's home directory), flagging which look like deployable projects. Used by the "deploy a local folder" picker.

Returns { path, directories: [{ name, path, isProject }] } — projects first, then alphabetical. Non-directory paths return 400, missing paths 404.

Operations

Resource methods

OperationSDKREST API
Browse an authorized host filesystem location.system.browse(input?)GET /api/system/browse
settings:read
Read database and installation health.system.health()GET /api/system/diagnostics
settings:read
Read instance settings.system.getSettings()GET /api/system/settings
settings:read
Change instance settings.system.updateSettings(input)PATCH /api/system/settings
settings:write
Read SMTP settings with secrets masked.system.getEmailSettings()GET /api/system/settings/email
settings:read
Configure SMTP delivery for the installation.system.updateEmailSettings(input)PUT /api/system/settings/email
settings:write
Send a test message using the configured SMTP settings.system.sendTestEmail(input)POST /api/system/settings/email/test
settings:write
Reset supported instance settings.system.resetSettings()DELETE /api/system/settings
settings:admin
Read the apps domain free app subdomains use, where it comes from, its wildcard DNS record and whether that record points at this server.system.getAppsDomain()GET /api/system/apps-domain
settings:read · Self-hosted
Set or clear the apps domain from Settings (only while the server's configuration doesn't set one).system.updateAppsDomain(input)PUT /api/system/apps-domain
settings:admin · Self-hosted
Read the scheduled Docker cleanup: schedule, scope, servers and last run.system.getDockerCleanupSchedule()GET /api/system/docker-cleanup/schedule
settings:read · Self-hosted
Change the scheduled Docker cleanup's schedule, scope and servers.system.updateDockerCleanupSchedule(input)PUT /api/system/docker-cleanup/schedule
settings:admin · Self-hosted
Read the control-plane database backup settings and recent runs.system.getPanelBackup()GET /api/system/panel-backup
settings:read · Self-hosted
Change the control-plane database backup destination, schedule, retention and options.system.updatePanelBackup(input)PUT /api/system/panel-backup
settings:admin · Self-hosted
Start a control-plane database backup now.system.runPanelBackup()POST /api/system/panel-backup/run
settings:admin · Self-hosted
List the control-plane database backups stored at the destination.system.listPanelBackups()GET /api/system/panel-backup/backups
settings:read · Self-hosted

HTTP endpoints

OperationSDKREST API
Create the initial administrator during authorized bootstrap.HTTP onlyPOST /api/system/bootstrap-admin
Internal operator · Self-hosted
Begin the installation's Cloud account connection.HTTP onlyPOST /api/system/cloud-connect
Internal operator · Self-hosted
Read the installation's Cloud connection status.HTTP onlyGET /api/system/cloud-status
Internal operator · Self-hosted
Read installation health.HTTP onlyGET /api/system/health
Internal operator · Self-hosted
This panel's license: locked or not, why, the installation ID, last check-in and lease expiry. Public, so the lock screen works before sign-in.HTTP onlyGET /api/license
Handler authentication
Set a new license key (instance admins) and check in with it at once. The key is never returned or logged.HTTP onlyPOST /api/license
settings:admin
Check in with the license server now (the lock screen's Retry). Rate-limited.HTTP onlyPOST /api/license/check-in
Handler authentication
Create an account from an eligible self-hosted invitation.HTTP onlyPOST /api/system/invite-signup
Handler authentication · Self-hosted
First-run check — is any server configured yet?HTTP onlyGET /api/system/onboarding
Handler authentication · Self-hosted
First-run setup; persists settings and creates the first server. Returns 403 once configured.HTTP onlyPOST /api/system/onboarding
Handler authentication · Self-hosted
Test a connection during initial onboarding.HTTP onlyPOST /api/system/onboarding/test-connection
Handler authentication · Self-hosted
Reset the administrator password through the local recovery boundary.HTTP onlyPOST /api/system/reset-admin-password
Internal operator · Self-hosted
Stage a new host for the panel (the server's synq panel-domain command): route it and issue its certificate, rolled back when that fails. Progress is on the registration stream.HTTP onlyPOST /api/system/panel-domain
Internal operator · Self-hosted
Register the Synq installation as a managed application.HTTP onlyPOST /api/system/self-register
Internal operator · Self-hosted
Stream installation registration progress.HTTP onlyGET /api/system/self-register/stream
Internal operator · Self-hosted
Read instance config for the desktop app.HTTP onlyGET /api/system/setup
Internal operator · Self-hosted
Push instance config from the desktop app.HTTP onlyPOST /api/system/setup
Internal operator · Self-hosted
Promote a zero-auth instance to email/password login.HTTP onlyPOST /api/system/upgrade-to-auth
Handler authentication · Self-hosted
Read one live sample of a server's CPU, memory, disk and load (the JSON form of the live monitor, for scripts and AI agents).HTTP onlyGET /api/system/servers/:id/stats
server:read · Self-hosted

On this page