Show which optional capabilities are on.

A denied tool means the matching ENABLE_* flag is false. Do not try to bypass it. Ask the operator to flip the flag on the host if they want that class of action.

Search the structured MCP audit log.

Answers: which agent restarted which service, who triggered an update, whether a call was denied by policy or outside the maintenance window.

Args: tool: Tool name or prefix (services_restart, ssl_). actor: Agent id (X-Agent-Id / MCP_ACTOR). event: tool_call, tool_ok, tool_denied, tool_window_denied, … query: Substring match on the redacted JSON line. since: ISO timestamp (inclusive). until: ISO timestamp (inclusive). limit: Max rows (1–200).

Last N audit events (newest first). Same log as audit_search.

Is the maintenance window open right now? Reads still work when it is closed.

Fleet catalog on the hops host (no secrets). Who has CloudLinux, which profile.

The DirectAdmin box this MCP process is wired to.

Look up one server in the hops inventory.

Args: server_id: id from inventory_list.

List TLS certificates installed on a user domain.

Args: domain: Fully-qualified domain (example.com). impersonate: Optional user to act as (admin login-as).

Read ACME (Let's Encrypt / ZeroSSL) configuration for a domain.

Args: domain: Fully-qualified domain. impersonate: Optional user to act as.

Update ACME settings for a domain before issuing or reissuing a cert.

Args: domain: Fully-qualified domain. enabled: Whether ACME auto-management is on. provider: '' | letsencrypt | letsencrypt-staging | zerossl key_type: rsa2048 | rsa4096 | ec256 | ec384 prefer_wildcard: Request *.domain when DNS challenge is available. dns_provider: Optional DNS plugin name (cloudflare, …) for DNS-01. skip_dns_names: Names that ACME should ignore. dns_environment: Provider env vars (tokens are redacted in logs). impersonate: Optional user to act as. confirm: Must be true — writes ACME secrets.

Reissue / provision the Let's Encrypt (or configured ACME) certificate for a domain.

This is the primary 'renew/reissue SSL' action. It calls POST /api/domain-tls/{domain}/provision-certs (or the dry-run sibling). DirectAdmin must have ACME enabled for the domain — use ssl_get_domain_acme_config first if you are unsure. For hostname/server certs use ssl_reissue_server.

Args: domain: Fully-qualified domain to reissue. impersonate: User that owns the domain (recommended for admin). dry_run: If true, validate only — do not hit the CA. confirm: Required unless dry_run is true.

Fallback Let's Encrypt request via legacy CMD_API_SSL (older DirectAdmin).

Use ssl_reissue_domain first. This exists for panels that predate /api/domain-tls.

Args: domain: Domain to issue. wildcard: Include *.domain (needs DNS challenge). entries: Extra hostnames (www, mail, …). Defaults to domain + www.domain. keysize: secp384r1 | ecdsa | 4096 | 2048 encryption: sha256 impersonate: Owning user. confirm: Required.

Delete one certificate from a domain.

Args: domain: Domain. cert_id: Certificate id from ssl_list_domain_certs. update_acme_skiplist: Let ACME manage this name again after delete. impersonate: Owning user. confirm: Required.

Download certificate + chain + key files for a domain cert id.

The private key is returned by DirectAdmin — treat the response as secret.

Args: domain: Domain. cert_id: Certificate id. impersonate: Owning user.

Replace a domain certificate with uploaded PEM files.

Args: domain: Domain. cert_id: Certificate id. certificate: PEM certificate body. key: PEM private key. chain: Optional intermediate PEM list. force: Allow a certificate that fails validation. dry_run: Validate only. impersonate: Owning user. confirm: Required unless dry_run.

Create a CSR for a domain certificate slot (commercial CA flow).

Args: domain: Domain. cert_id: Certificate id. common_name: CN, defaults to the domain. impersonate: Owning user.

Install a self-signed certificate on a domain (lab / placeholder only).

Args: domain: Domain. cert_id: Certificate id. dns_names: SANs. Defaults to [domain]. key_type: rsa2048 | rsa4096 | ec256 | ec384 overwrite: Replace existing material. impersonate: Owning user. confirm: Required.

Hostname / DirectAdmin service TLS status (not a user domain).

Read the current hostname certificate metadata.

Read ACME configuration used for the server hostname certificate.

Update ACME settings for the DirectAdmin hostname certificate.

Args: account: ACME account email. enabled: Enable ACME for the hostname. provider: '' | letsencrypt | letsencrypt-staging | zerossl key_type: rsa2048 | rsa4096 | ec256 | ec384 additional_domains: Extra names on the hostname cert. dns_provider: Optional DNS-01 provider. dns_environment: Provider secrets. confirm: Required.

Force-obtain / reissue the DirectAdmin hostname TLS certificate.

Calls POST /api/server-tls/obtain. Use this when the panel hostname cert is expired or the hostname changed.

Args: confirm: Required.

Enable TLS on the DirectAdmin service itself.

Args: force: Force the switch even if a cert looks incomplete. confirm: Required.

Download the hostname certificate and key (secret).

Replace the hostname certificate with uploaded PEM files.

Args: certificate: PEM cert (+ optional chain). key: PEM private key. force: Allow an invalid cert. confirm: Required.

List ACME DNS-01 providers the panel knows about (Cloudflare, …).

List every user/domain certificate the Admin SSL page shows.

This is the Admin Level → Admin SSL overview (CMD_ADMIN_SSL?json=yes). It is not in the New JSON API. Requires Pro Pack and a login key that is allowed to run CMD_ADMIN_SSL.

Use this to see which customer domains are missing, expired, or valid before calling ssl_admin_reissue.

Request Let's Encrypt certificates for selected customer domains.

This is the Admin SSL icon action: POST CMD_ADMIN_SSL action=multiple. The panel queues ACME in the background (dataskq) — no impersonation. Prefer this when an operator says “reissue SSL for these clients” from the Admin SSL page.

For a single domain on a modern panel, ssl_reissue_domain (New API, impersonate the owner) is more precise.

Args: domains: Customer domain names as listed by ssl_admin_list (max 50). wildcard: Request *.domain (dns-01). Default is http-01 / per-host. confirm: Required.

Read admin_ssl_* and letsencrypt_* flags from directadmin.conf.

These control the automatic Admin SSL poller (install-to-missing, replace-expired, cert-on-create). Change them with da_config_local_patch.

Search CSF/iptables/LFD for an IP (csf -g). Shows why it is blocked.

Args: ip: IPv4 or IPv6 address.

Why CSF/LFD listed this IP (list + LFD comment). Safe to show an operator.

Parses csf -g via the plugin. Typical comment: lfd: (sshd) Failed SSH login … 8 in the last 3600 secs. Pair with bfm_ip_reason or use ip_block_reason for both + a customer text.

Args: ip: IPv4 or IPv6.

Unblock an IP in CSF/LFD (permanent deny + temporary ban).

This is the primary 'unlock from firewall' action. It:

1. Runs the plugin Quick Unblock (action=kill) — csf -dr + csf -tr + drop states

2. Also sends qrm when the plugin supports it

3. Optionally adds a temporary allow so the next connection is not re-banned

Pair with bfm_unblock_ip if DirectAdmin Brute Force Monitor also listed the IP.

Args: ip: IPv4 or IPv6 to unblock. also_allow: After unblock, temporarily whitelist the IP. allow_ttl_seconds: TTL for the optional temporary allow (default 1h). comment: Note stored next to the allow rule. confirm: Required.

Whitelist an IP in CSF (csf -a / temporary allow).

Allowed IPs bypass closed ports but LFD can still block them unless ignored.

Args: ip: IPv4, IPv6, or CIDR. comment: Note stored with the rule. temporary: Use a TTL instead of a permanent allow. ttl_seconds: Lifetime when temporary=true. confirm: Required.

Block an IP in CSF (csf -d / temporary deny).

Args: ip: IPv4, IPv6, or CIDR. comment: Note stored with the rule. temporary: Use a TTL instead of a permanent deny. ttl_seconds: Lifetime when temporary=true. confirm: Required.

Add an IP to csf.ignore so LFD never blocks it.

Args: ip: IPv4, IPv6, or CIDR. comment: Note. confirm: Required.

Remove an IP from the CSF allow list (csf -ar).

Args: ip: Address to remove. confirm: Required.

Flush all CSF temporary allow/deny rules (csf -tf).

Args: confirm: Required.

Restart CSF, and optionally LFD.

Args: also_lfd: Restart both csf and lfd (csf -ra). confirm: Required.

Enable CSF (csf -e).

Args: confirm: Required.

Disable CSF (csf -x). Dangerous — the host is unprotected until re-enabled.

Blocked unless ENABLE_CSF_DISABLE=true. Prefer csf_unblock_ip instead.

Args: confirm: Required.

Best-effort CSF plugin landing / status page (HTML or structured).

List Brute Force Monitor state (blocked IPs, failed logins).

For one IP use bfm_ip_reason — that is the 'why was this blocked' view.

Args: blocked_only: Hint for the client; the panel still returns the full JSON.

Why Brute Force Monitor listed this IP (service, user, attempts, log line).

Returns operator reason and customer_message (en + bg) you can paste to the client. Prefer ip_block_reason when you also need the CSF/LFD side.

Args: ip: IPv4 or IPv6 to explain.

Why this IP is blocked — CSF/LFD and Brute Force Monitor together.

This is the tool to call when the operator (or the customer) asks "защо е блокиран". Read-only. Returns:

• operator_reason: technical (lists, LFD comment, BFM log line)

• customer_message.en / .bg: paste-ready, no host paths

If there is no recorded reason, says so instead of inventing one.

Args: ip: IPv4 or IPv6.

Remove an IP from DirectAdmin Brute Force Monitor blocks.

Use together with csf_unblock_ip — an IP is often listed in BOTH places.

Args: ip: IPv4 or IPv6 to unblock. confirm: Required.

Add an IP to the BFM skip / never-block list.

Args: ip: Address to skip. confirm: Required.

Unblock an IP in CSF and DirectAdmin Brute Force Monitor.

This is the 'customer is locked out' button. It does not disable the firewall.

Args: ip: IPv4 or IPv6. also_allow: Also add a temporary CSF allow (1 hour). confirm: Required.

List every user on the server (admin).

List users owned by the current reseller, or by reseller if given.

Args: reseller: Optional reseller username.

List all reseller accounts.

List all admin accounts.

Search users via the New API.

Args: q: Query string (username / domain / email fragment). extended: Use /api/search/users-extended.

Get user.conf style configuration (limits, domains, suspended flag).

Args: username: Account name.

Get live usage + limits for a user.

Args: username: Account name.

Login history for a specific user.

Args: username: Account name.

Reseller configuration.

Args: username: Reseller name.

Combined reseller + owned-users usage.

Args: username: Reseller name.

Create a user from a package (legacy CMD_API_ACCOUNT_USER).

Args: username: New username (usually 3–16 alphanumeric). email: Contact email. password: Initial password (prefer sending a login-key later). domain: Primary domain. package: Existing user package name. ip: shared | sharedreseller | a free IP. notify: Email the welcome message. confirm: Required.

Create a reseller from a reseller package.

Args: username: New reseller. email: Contact email. password: Initial password. domain: Primary domain. package: Reseller package name. ip: shared | sharedreseller | assign. notify: Send welcome email. confirm: Required.

Permanently delete a user/reseller/admin account.

Args: username: Account to delete. confirm: Required.

Toggle suspend/unsuspend for an account (DirectAdmin toggle).

Args: username: Account. confirm: Required.

Change another account's password (admin).

Args: username: Target account. Empty / current user uses /api/change-password. new_password: New password. confirm: Required.

Move a user to a different reseller/creator.

Args: username: User to move. new_creator: Destination reseller/admin. confirm: Required.

Promote a user account to reseller.

Args: username: User to promote. confirm: Required.

Demote a reseller to a regular user.

Args: username: Reseller to demote. confirm: Required.

Current admin's resource usage.

Check whether an account name already exists (admin).

Args: username: Candidate username.

Unsuspend an account (same toggle endpoint as users_suspend).

Args: username: Account. confirm: Required.

Customize limits on an existing user (CMD_API_MODIFY_USER).

Empty strings leave that field unchanged. Use 'unlimited' or a number.

Args: username: Account. bandwidth: Bandwidth MB or unlimited. quota: Disk MB or unlimited. vdomains: Domain limit or unlimited. nemails: Mailbox limit or unlimited. mysql: Database limit or unlimited. php: ON | OFF ssl: ON | OFF ssh: ON | OFF confirm: Required.

Create another admin account.

Args: username: New admin. email: Contact email. password: Initial password. notify: Send welcome email. confirm: Required.

List user packages, or show one package.

Args: package: Optional package name.

List reseller packages (legacy), or one package.

Args: package: Optional package name.

Reseller packages via the New API.

Args: package: Optional package name for /api/reseller-packages/{package}.

Delete a user package.

Args: package: Package name. confirm: Required.

Create or overwrite a user package.

Args: name: Package name. bandwidth: MB or unlimited. quota: MB or unlimited. vdomains: Domain limit or unlimited. nemails: Mailbox limit or unlimited. mysql: Database limit or unlimited. php: ON | OFF ssl: ON | OFF cgi: ON | OFF confirm: Required.

List IPs visible to this reseller/admin.

Details for one IP.

Args: ip: Address.

Admin-level IP list (CMD_API_IP_MANAGER).

Add an IP to the admin IP manager.

Args: ip: Address to add. netmask: Netmask (IPv4) or prefix hint. confirm: Required.

Remove an IP from the admin IP manager.

Args: ip: Address to remove. confirm: Required.

Assign an IP to a reseller/user.

Args: ip: Address. username: Destination account. confirm: Required.

List DNS zones (admin).

Get records for a zone.

Args: domain: Zone name.

Add a DNS record.

Args: domain: Zone. record_type: A | AAAA | CNAME | MX | TXT | NS | SRV | CAA … name: Record name (use @ or the domain for the apex). value: Record value. ttl: TTL seconds. confirm: Required.

Delete a DNS record.

Args: domain: Zone. record_type: Type. name: Name. value: Value (required by most DA versions). confirm: Required.

List domains owned by a user (admin) or the current account.

Args: username: Optional account. Empty = current session (CMD_API_SHOW_DOMAINS).

Create an additional domain on the current (or impersonated) user.

Args: domain: FQDN to add. bandwidth: MB or 'unlimited'. quota: MB or 'unlimited'. ssl: Enable SSL for the domain. cgi: Enable CGI. php: Enable PHP. impersonate: Owning user (admin should set this). confirm: Required.

Delete a domain from an account.

Args: domain: Domain to remove. impersonate: Owning user. confirm: Required.

List subdomains of a domain.

Args: domain: Parent domain. impersonate: Owning user.

Create a subdomain.

Args: domain: Parent domain. subdomain: Left-most label only (e.g. 'shop', not shop.example.com). impersonate: Owning user. confirm: Required.

Delete a subdomain.

Args: domain: Parent domain. subdomain: Label to remove. contents: Also delete files under the subdomain document root. impersonate: Owning user. confirm: Required.

List domain pointers (aliases) for a domain.

Args: domain: Parent domain. impersonate: Owning user.

Add a domain pointer / alias.

Args: domain: Existing parent domain. from_domain: New hostname that should point at the parent. alias: True = alias (same site), False = pointer (redirect). impersonate: Owning user. confirm: Required.

Remove a domain pointer.

Args: domain: Parent domain. pointer: Pointer hostname. impersonate: Owning user. confirm: Required.

List site redirects for a domain.

Args: domain: Domain. impersonate: Owning user.

Create a site redirect.

Args: domain: Domain. path: Source path (e.g. /old). destination: Target URL. redirect_type: 301 | 302 | 303. impersonate: Owning user. confirm: Required.

List POP/IMAP accounts on a domain.

Args: domain: Domain. full: Use action=full_list (quota + usage) when true. impersonate: Owning user.

Create a mailbox (user@domain).

Args: domain: Domain. user: Local part only (before @). password: Mailbox password. quota_mb: 0 = unlimited. impersonate: Owning user. confirm: Required.

Delete a mailbox.

Args: domain: Domain. user: Local part. impersonate: Owning user. confirm: Required.

Change mailbox password and/or quota.

Args: domain: Domain. user: Local part. password: New password (empty = leave unchanged). quota_mb: New quota; -1 = leave unchanged, 0 = unlimited. impersonate: Owning user. confirm: Required.

List forwarders on a domain.

Args: domain: Domain. impersonate: Owning user.

Create an email forwarder.

Args: domain: Domain. user: Local part (source). destination: Destination address or comma-separated list. impersonate: Owning user. confirm: Required.

Delete a forwarder.

Args: domain: Domain. user: Local part. impersonate: Owning user. confirm: Required.

List autoresponders on a domain.

Args: domain: Domain. impersonate: Owning user.

Global email logs (admin).

Email log summary.

Current/impersonated user email logs.

Vacation / autoresponder list for a domain.

Args: domain: Domain.

One vacation message.

Args: domain: Domain. user: Local part.

Create/update a vacation message.

Args: domain: Domain. user: Local part. values: Vacation body. confirm: Required.

Delete a vacation message.

Args: domain: Domain. user: Local part. confirm: Required.

Apple mobileconfig for the current email account.

IMAP migration tasks.

Import mail from a remote IMAP server into this box.

Args: payload: Panel imapsync import body (host, user, password, dest). confirm: Required. Passwords in the payload are redacted in logs.

Export mail from this box to a remote IMAP server.

Args: payload: Panel imapsync export body. confirm: Required.

Cancel a running IMAP migration.

Args: migration_id: Id from imapsync_migrations. confirm: Required.

List FTP accounts for a domain.

Args: domain: Domain. impersonate: Owning user.

Create an FTP account.

Args: domain: Domain. user: FTP username (local part). password: FTP password. path_type: domain | ftp | user | custom custom_path: Required when path_type=custom. impersonate: Owning user. confirm: Required.

Delete an FTP account.

Args: domain: Domain. user: FTP username. impersonate: Owning user. confirm: Required.

List cron jobs for the current (or impersonated) user.

Args: impersonate: Owning user.

Create a cron job.

Args: minute: Cron minute (0-59 or *). hour: Cron hour. day_of_month: Day of month. month: Month. day_of_week: Day of week. command: Command to run (no shell metachar redirection from untrusted input). impersonate: Owning user. confirm: Required.

Delete a cron job by its panel id / select key.

Args: job_id: Id from cron_list (select0 value). impersonate: Owning user. confirm: Required.

Set the PHP version selector for a domain.

Args: domain: Domain. php1_select: Selector index from the panel (often '1', '2', … mapping to php versions). impersonate: Owning user. confirm: Required.

List admin-level backups / backup settings.

Create a backup for one user.

Args: username: Account to back up. where: Backup destination the panel understands (local / ftp / …). confirm: Required.

Restore a user from a local backup file.

Args: username: Account to restore into. file: Backup filename as listed by the panel. confirm: Required.

Kick an admin-level backup now.

Args: who: all | or a username. where: Destination the panel understands. confirm: Required.

High-level panel info (/api/info).

DirectAdmin version and update channel.

Change the DirectAdmin update channel.

Args: channel: current | stable | beta | alpha (panel-dependent). confirm: Required.

Update DirectAdmin itself to the latest build on the current channel.

Args: confirm: Required.

Restart the DirectAdmin service.

Args: confirm: Required.

CPU information.

Memory information.

1/5/10 minute load averages.

Filesystem usage.

Host uptime.

Services occupancy snapshot (not the systemd list).

Latest per-user resource usage snapshot.

Historical resource usage.

Latest global resource usage.

Global resource usage history for one user.

Args: user: Username.

Available OS package upgrades.

Dry-run OS package upgrade.

Args: packages: Optional package name list. Empty = all pending.

Apply OS package upgrades.

Args: packages: Optional package name list. Empty = all pending. confirm: Required.

History of OS package upgrade tasks.

DirectAdmin license details.

License proof document.

Install a new license key.

Args: key: License key. confirm: Required.

Maintenance tasks / health checks the panel exposes.

Run a maintenance check.

Args: task: Task id from maintenance_list.

Apply a maintenance fix.

Args: task: Task id. confirm: Required.

List managed services (httpd, exim, dovecot, named, …).

Details for one service.

Args: service: Service name (e.g. httpd, exim, dovecot, named, proftpd).

Read a service log.

Args: service: Service name. cursor: Pagination cursor from a previous response. limit: Max lines. level: Optional log level filter.

Start a service.

Args: service: Service name. confirm: Required.

Stop a service.

Args: service: Service name. confirm: Required.

Restart a service.

Args: service: Service name. confirm: Required.

Reload a service configuration.

Args: service: Service name. confirm: Required.

Toggle the service watchdog.

Args: service: Service name. enabled: True to watch, False to stop watching. confirm: Required.

Change the server hostname.

Args: hostname: New FQDN. confirm: Required. Reissue the hostname SSL afterwards with ssl_reissue_server.

Currently applied directadmin.conf (merged).

Default directadmin.conf values.

Local overrides in directadmin.conf.

Replace local directadmin.conf overrides (PUT).

Args: values: Full local config object as the panel expects. confirm: Required.

Patch selected directadmin.conf keys.

Args: values: Partial local config. confirm: Required.

Current server timezone.

Available timezones.

Set server timezone.

Args: timezone: IANA name, e.g. Europe/Sofia. confirm: Required.

Global email / exim configuration.

Update global email configuration.

Args: values: Config object. confirm: Required.

Outbound email filter settings.

Update outbound email filter.

Args: values: Filter object. confirm: Required.

SQL server connection settings used by the panel.

Update SQL server settings.

Args: values: Config object. confirm: Required.

Test the configured SQL connection.

List login keys on the current account.

Commands a login key can be restricted to.

Get one login key.

Args: key_id: Key id.

Usage history for a login key.

Args: key_id: Key id.

Create a login key. Prefer IP-restricted, command-restricted keys.

Args: payload: Create body as documented by /api/login-keys/keys (name, expires, ips, commands, …). confirm: Required.

Update a login key.

Args: key_id: Key id. payload: Patch body. confirm: Required.

Delete a login key.

Args: key_id: Key id. confirm: Required.

List one-time / login-as URLs.

Create a login URL.

Args: payload: Create body. confirm: Required.

Delete a login URL.

Args: url_id: URL id. confirm: Required.

Create a one-shot panel login URL (POST /api/login/url).

Args: payload: Optional body the panel expects.

Current session (who am I, level, selected domain).

Session UI state.

Current account user.conf.

Current account usage.

Current reseller config (when logged in as reseller/admin).

Switch the active domain in the session.

Args: domain: Domain to select.

Switch the session into another account (login-as).

Prefer the impersonate= argument on individual tools — it does not mutate the long-lived session.

Args: username: Account to impersonate. confirm: Required.

Leave a login-as session and return to the admin.

Search users available for login-as.

Args: q: Query. limit: Max rows.

List active sessions for this account.

Destroy one other session.

Args: public_id: Session public id. confirm: Required.

Destroy every other session (force logout everywhere else).

Args: confirm: Required.

Current account login history.

Current profile settings.

Patch profile settings.

Args: values: Partial settings object.

Message center list.

Read one message.

Args: message_id: Message id.

Support tickets.

Ticket requests queue.

Enable multi-factor authentication on the current account.

Args: payload: Panel-specific body (otp, password, …). confirm: Required.

Disable MFA.

Args: payload: Usually includes the current password / OTP. confirm: Required.

Generate a new TOTP secret (enrolment).

List MFA recovery codes.

security.txt status.

Global ModSecurity configuration.

Update global ModSecurity configuration.

Args: values: Config object. confirm: Required.

All ModSecurity per-host configs.

Current user's ModSecurity configs.

ModSecurity config for one hostname.

Args: hostname: vhost name.

ModSecurity audit log summary.

One ModSecurity audit entry.

Args: entry_id: Optional entry identifier (query).

ClamAV status / start a scan (GET).

Start a ClamAV scan.

Args: payload: Scan options as the panel expects. confirm: Required.

Kill a running ClamAV scan.

Args: pid: Process id from clamav_status. confirm: Required.

Per-user Redis status.

Enable Redis for the current/impersonated user.

Args: confirm: Required.

Disable Redis.

Args: confirm: Required.

Directory password-protection list.

Database server info.

List databases visible to the current/impersonated account.

Details for one database.

Args: database: Database name.

List database users.

One database user.

Args: dbuser: DB username.

Create a database.

Args: payload: Create body (name, charset, …). confirm: Required.

Create a database and a user in one call.

Args: payload: Combined create body. confirm: Required.

Create a database user.

Args: payload: User body. confirm: Required.

Drop a database.

Args: database: Name. confirm: Required.

Drop a database user.

Args: dbuser: Name. confirm: Required.

Change a database user password.

Args: dbuser: Name. password: New password. confirm: Required.

Repair a database.

Args: database: Name. confirm: Required.

Optimize a database.

Args: database: Name. confirm: Required.

Check a database.

Args: database: Name.

Show process list (admin).

Kill a database process.

Args: process_id: Process id. confirm: Required.

List a directory.

Args: path: Absolute path inside the account home.

Directory tree.

Args: path: Starting path.

Disk usage for a path.

Args: path: Path.

Search file names.

Args: query: Filename fragment. path: Root to search.

Search file contents.

Args: query: Text. path: Root to search.

Create a directory.

Args: path: New directory path. confirm: Required.

Move paths to trash (or delete, depending on panel settings).

Args: paths: List of paths. confirm: Required.

Move files.

Args: payload: Source/destination body. confirm: Required.

Copy files.

Args: payload: Source/destination body. confirm: Required.

Change permissions.

Args: payload: Paths + mode. confirm: Required.

List trash.

CustomBuild current state.

Installed / available software.

Component versions.

Available CustomBuild updates.

CustomBuild options (options.conf).

Patch CustomBuild options.

Args: values: Options object. confirm: Required.

Start a CustomBuild run (build / update / rewrite).

Args: payload: Run arguments (action, software, …). confirm: Required.

Kill a running CustomBuild job.

Args: confirm: Required.

CustomBuild log names.

Available CustomBuild actions.

Software CustomBuild can remove.

Installed plugins (user-facing list).

Plugin manager inventory (admin).

Install a plugin from a URL.

Args: url: https URL to a .tar.gz plugin. confirm: Required.

Activate a plugin.

Args: plugin_id: Plugin id. confirm: Required.

Deactivate a plugin.

Args: plugin_id: Plugin id. confirm: Required.

Update a plugin from its update_url.

Args: plugin_id: Plugin id. confirm: Required.

Uninstall a plugin.

Args: plugin_id: Plugin id. confirm: Required.

List WordPress installations.

Install WordPress.

Args: payload: Install body (domain, path, title, admin user, …). confirm: Required.

Quick WordPress install.

Args: payload: Quick-install body. confirm: Required.

WordPress instance details.

Args: location_id: Location id.

Remove a WordPress location from the manager.

Args: location_id: Location id. confirm: Required.

List git applications on a domain.

Args: domain: Domain.

One git application.

Args: uuid: Application uuid.

Trigger a git deploy.

Args: uuid: Application uuid. confirm: Required.

Fetch remotes for a git application.

Args: uuid: Application uuid.

Create or rotate the deploy webhook for a git application.

Args: username: Owning user. uuid: Application uuid. confirm: Required — webhook URLs are secrets.

Map every Pro Pack feature to the curated tool that covers it.

Modern licenses include Pro Pack. Web Terminal is intentionally not wrapped.

List Nginx Unit applications and routes for a domain (CMD_UNIT).

Args: domain: Domain that owns the Unit apps. impersonate: Owning user.

Create an empty Nginx Unit application stub (then edit JSON in the panel).

Args: domain: Domain. name: Application name (saved as domain_name). impersonate: Owning user. confirm: Required.

Delete one or more Nginx Unit applications.

Args: domain: Domain. names: Application names. impersonate: Owning user. confirm: Required.

Apply a Pro Pack Nginx CMS template (WordPress, Drupal, FastCGI cache, …).

Args: domain: Domain. template: wordpress | wordpress_cache | drupal | joomla | magento | laravel | default | none impersonate: Owning user. confirm: Required.

Detect CloudLinux / LVE Manager on this box.

Reads the plugin list and pings LVE Manager. Does not change anything.

List LVE users / current limits (LVE Manager action=users).

LVE limits for one user.

Args: username: DirectAdmin account.

Set LVE limits for one user (CPU/RAM/IO/processes).

Only numeric values, percents, or 'unlimited'. This is the CloudLinux equivalent of Pro Pack cgroups throttle.

Args: username: Account. speed: CPU (e.g. 100% or 200). pmem: Physical memory (e.g. 1024 or 1G-style numbers the plugin accepts as digits). io: Disk IO. nproc: Max processes. ep: Entry processes. iops: IOPS. confirm: Required.

Enable CageFS for one user.

Args: username: Account. confirm: Required.

Disable CageFS for one user. The account leaves the cage.

Args: username: Account. confirm: Required.

Read CloudLinux PHP Selector for a user (plugin).

On non-CL boxes use domains_set_php (DirectAdmin PHP selector) instead.

Args: username: Account.

Set CloudLinux PHP Selector version for a user.

Args: username: Account. version: alt-php version the plugin understands (e.g. 8.2, 8.3, native). confirm: Required.

Search panel resources (domains, dbs, emails, …).

Args: q: Query.

Dashboard widgets.

cPanel import tasks.

Check a remote cPanel server before import.

Args: payload: Host / credentials body.

Create a phpMyAdmin SSO session.

Args: database: Optional database name for database-scoped SSO.

List New API operations bundled with this server (from official swagger).

Args: prefix: Path prefix filter, e.g. /api/domain-tls or /api/users. method: Optional HTTP method filter (GET/POST/…).

Show parameters for one New API operation.

Args: method: HTTP method. path: Path template, e.g. /api/domain-tls/{domain}/provision-certs

Call any documented DirectAdmin New API endpoint.

Use this for operations that do not yet have a dedicated curated tool. The path must exist in the bundled swagger. /api/execute is blocked unless ENABLE_EXECUTE=true.

Args: method: GET POST PUT PATCH DELETE path: Template from da_list_endpoints (keep {placeholders}). path_params: Values for {placeholders}. query: Query string parameters. body: JSON body for non-GET requests. impersonate: Optional user to act as. confirm: Required for destructive methods / paths.

Call a legacy CMD_API_* / CMD_* endpoint.

Only commands that start with CMD_API_ or CMD_ are accepted.

Args: command: e.g. CMD_API_SHOW_ALL_USERS or /CMD_API_SSL method: GET or POST data: Form fields. json=yes is added automatically. impersonate: Optional user. confirm: Required for POST.

Connectivity check — hits /api/version.