Every endpoint, in one place.

Minimal liveness check. Returns 200 with { ok, version } as long as the worker is running. No upstream checks.

Full readiness probe — exercises KV, CF Pages API. Returns 200 with per-check status if all healthy, 503 if anything is broken. Powers the public /status page.

Create an account. Body: { email, password?, plan? }. Returns { email, plan }. On the free tier no payment is required.

{
  "email": "you@example.com",
  "password": "correct-horse-battery-staple",
  "plan": "builder"
}

{
  "email": "you@example.com",
  "plan": "builder",
  "created_at": "2026-07-14T10:00:00.000Z",
  "api_key_id": "krx_k_8f4a2b9d..."
}

Returns the calling customer: { email, plan, isAdmin, deployCount, tourDismissed, … }. Used by the dashboard to render the chrome.

Update notification prefs, dismiss the onboarding tour, or rename the account. Body: any subset of the writable fields.

Permanently delete the account and every associated deploy, domain, key, and team membership. Idempotent on a non-existent customer.

Mint a new API key. Body: { name }. Returns the plaintext key exactly once — store it. The server retains only a bcrypt hash.

{
  "name": "Claude Code (macbook)"
}

{
  "id": "krx_k_8f4a2b9d1c6e7f02",
  "name": "Claude Code (macbook)",
  "key": "krx_sk_live_3aF8sL2bQ9kM0vW5zE7uX1c4dR8tY6pH4jK9mN2qT3sV8wA5zD2hF7g",
  "created_at": "2026-07-14T10:00:00.000Z"
}

List every key the caller owns. Returns id, name, created_at, last_used_at — never the plaintext or the hash.

Revoke a key. The deleted key fails on the next request with 401. Idempotent on an already-revoked id.

Ship a new site. Multipart: `manifest` (JSON) + `file` (tar of the site) OR multiple `files` parts with paths. Quota-checked before parsing. Returns 201 with { deploy_id, preview_url, status: 'queued' }. The actual build runs asynchronously — poll GET /api/v1/deploys/:id or stream /api/v1/deploys/:id/stream.

Apply a list of patch ops to an existing site: {create | replace | replace_all | delete}. Body: { parent_deploy_id, ops: [{ op, path, content_base64? }] }. Patches weigh 0.1 against the monthly quota; full deploys weigh 1.0.

List every deploy owned by the caller, newest first. Returns DeployRecord[] (see GET /:id for shape).

Read a single deploy record. 404 if no such id, 403 if it belongs to a different customer. The response is the full DeployRecord: status, preview_url, logs, cf_deployment_id, custom_domain, parent_deploy_id, …

{
  "id": "krx_d_a3f1b8c92e4d",
  "email": "you@example.com",
  "domain": "my-site.pages.dev",
  "project_name": "my-site",
  "status": "ready",
  "framework": "next",
  "preview_url": "https://my-site.pages.dev",
  "cf_deployment_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "custom_domain": null,
  "parent_deploy_id": null,
  "created_at": "2026-07-14T10:00:00.000Z",
  "ready_at": "2026-07-14T10:00:34.000Z",
  "duration_ms": 34000,
  "logs": []
}

SSE stream of deploy status transitions. The server polls the KV record every ~1s and emits an `event: status` with the latest snapshot. Closes on terminal status (ready | error). Useful for CLI live tail.

Return the full file tree + per-file contents for a deploy. Used by `krexel rollback` to materialize the previous version. Body is large for non-trivial sites — prefer GET /:id/versions + targeted reads.

Return the persisted `logs` field for a deploy. Idempotent — the build log never changes after a deploy reaches a terminal status.

Walk the parent_deploy_id chain for a file, returning the list of deploys that touched it. Used by `krexel history <path>`.

Create a NEW deploy that ships the same file tree as the target. The new deploy gets a fresh deploy_id and a `parent_deploy_id` pointing at the source. Atomic — the original deploy is never modified.

Attach a custom domain to a specific deploy. Body: { domain }. Returns the domain record. The customer's registrar must point a CNAME at the platform Pages project before SSL will provision.

Re-poll Cloudflare for the SSL status of the domain attached to this deploy. Triggers the 'your domain is live' email exactly once when the status transitions pending → active.

Per-customer usage breakdown for the current calendar month: { deploys_this_month, deploys_patch, deploy_quota, over_deploy_quota }. Patch deploys weigh 0.1; full deploys weigh 1.0.

Attach a custom domain to a specific deploy. Body: { domain }. Returns the domain record. The customer's registrar must point a CNAME at the platform Pages project before SSL will provision.

Re-poll Cloudflare for the SSL status of the domain attached to this deploy. Triggers the 'your domain is live' email exactly once when the status transitions pending → active.

List every custom domain attached to the platform Pages project for the calling customer. Includes live status (pending | active | error).

Attach a domain without binding it to a specific deploy (the platform decides routing). Body: { domain }. Useful when the same domain should follow the customer's latest deploy automatically.

{
  "domain": "alex.dev"
}

{
  "domain": "alex.dev",
  "status": "pending",
  "cname_target": "krexel-prod.pages.dev",
  "verification_token": "krexel-verify-a3f1b8c92e4d",
  "attached_at": "2026-07-14T10:00:00.000Z"
}

Re-poll Cloudflare for the SSL status of a platform-attached domain. Same as /deploys/:id/domain/refresh but addressed by the domain itself.

Detach a domain from the platform Pages project. The customer's CNAME record is not touched — they decide whether to remove it.

Start a Stripe Checkout flow for a plan upgrade. Body: { plan: 'builder' | 'pro' | 'studio' }. Returns { url } — the customer is redirected there.

Stripe webhook receiver. Authenticated via the Stripe-Signature header, not a Krexel API key. Verifies signature, then updates the customer's plan in KV.

Change plan without going through Checkout (for in-app switches between paid tiers). Body: { plan }. Rejects paid plans unless BILLING_ENABLED is set on the worker.

Per-customer usage + quota summary for the current calendar month. The dashboard's 'X / Y deploys used' meter reads from this.

List active members + pending invites for the caller's workspace. Returns { members: [...], invites: [...] }. Only available on the Studio plan.

Create a pending invite + send a one-time accept email. Body: { email, role: 'admin' | 'member' }. Returns the invite record. Expires in 7 days.

Accept a workspace invite. Body: { token }. The token is single-use; the invitee must already have a Krexel account (or signup happens in the same flow).

Revoke a pending invite. The accept URL becomes invalid. Idempotent on an already-revoked id.

Remove a member from the workspace. The removed customer keeps their own account but loses access to the shared deploys/domains. The owner cannot be removed.

List every webhook subscription owned by the caller. The full secret is never returned — only a `secret_hint` with the last 4 characters. Plan-gated quota (see Webhooks section below).

Create a subscription. Body: { url, events? } — `url` must be HTTPS and pass the SSRF guard; `events` defaults to ["deploy.*"], the only pattern supported today (plus the catch-all "*"). Returns 201 with the full WebhookRecord including the plaintext `secret` exactly once — store it, it cannot be retrieved later. 402 when the plan's quota is exhausted, 400 when the URL is invalid or in a reserved range.

{
  "url": "https://hooks.example.com/krexel",
  "events": ["deploy.ready", "deploy.error"]
}

{
  "id": "krx_wh_b7c1e9d4f8a2",
  "email": "you@example.com",
  "url": "https://hooks.example.com/krexel",
  "events": ["deploy.ready", "deploy.error"],
  "secret": "whsec_3aF8sL2bQ9kM0vW5zE7uX1c4dR8tY6pH4",
  "secret_hint": "...6pH4",
  "created_at": "2026-07-14T10:00:00.000Z",
  "consecutive_failures": 0,
  "disabled": false
}

Remove a subscription and stop all future deliveries to it. Idempotent on an already-deleted id. Does NOT revoke in-flight retries that are already queued.

Generate a new signing secret for the subscription. Returns the full new secret exactly once. The old secret stops working immediately. Also resets `consecutive_failures` to 0 — a common recovery path after the old secret leaked.

{
  "id": "krx_wh_b7c1e9d4f8a2",
  "email": "you@example.com",
  "url": "https://hooks.example.com/krexel",
  "events": ["deploy.ready", "deploy.error"],
  "secret": "whsec_k1E9sT3bV7qM0wX4zA2hC6dF8tY5pJ2r",
  "secret_hint": "...5pJ2r",
  "created_at": "2026-07-14T10:00:00.000Z",
  "rotated_at": "2026-07-14T11:30:00.000Z",
  "consecutive_failures": 0,
  "disabled": false
}

Read the last 50 delivery attempts for a subscription. Each entry has { attempted_at, event, deploy_id, response_status, duration_ms, error?, attempt }. Records expire after 7 days. The Test endpoint does NOT write here — it returns its result inline.

Send a synthetic `deploy.test` event to the subscription's URL with the same HMAC-SHA256 signature format as a real delivery. Single attempt, 5s timeout, no retry, does NOT increment the failure counter. Returns { ok, status, duration_ms, event: "deploy.test", timestamp } so the dashboard can show "✓ 200 in 342ms" inline. 409 if the subscription is disabled.

Confirm admin status + list the admin's permissions. Safe to call from the dashboard sidebar on every page to show/hide the /admin nav. Requires is_admin: true on the customer record.

Read-only view of any customer record. Returns plan, created_at, notification_prefs, team member count, is_admin, etc. Never returns the API key hash or the encrypted CF token.

List every deploy for any customer. Used when a customer says 'I lost my site' and you need to find the last good deploy to rollback.

Read the audit log (last 50 admin actions, newest first). Every admin action writes a log entry: { ts, admin_email, permission, target, details? }. Entries are kept for 1 year in KV.

Record a manual admin action (e.g. 'refunded $25 via Stripe dashboard'). Body: { permission, target, note }. The entry appears in the next GET. Useful for things that don't have a structured endpoint.

Daily retention sweep. Deletes R2 file trees older than the configured threshold (default 90d R2 Standard + 90d-1yr IA → 1yr+ deleted). Auth via KREXEL_CRON_SECRET. Returns { deleted, kept }.