List all Cubes (Firecracker microVMs) in a Krova Cloud Space.

Get details for a single Cube by id.

Everything needed to SSH into a Cube: host, port, the login USER, and any pinned host keys. Call this rather than guessing a username — it is ubuntu or debian on Cubes created from images that ship a default user, and root on older Cubes, so it cannot be derived from the image id. The returned user has passwordless sudo; sudo su reaches root.

Create (provision) a new Cube in a Space. Provisioning is asynchronous — the returned Cube begins in a pending state. Destructive/billable: creating a Cube starts hourly billing.

Power off a running Cube (asynchronous). Compute + host RAM are released while disk is preserved; the Cube becomes stopped.

Start a stopped Cube (asynchronous).

Restart a running Cube — a COLD restart (asynchronous). The hypervisor process is stopped and relaunched, so the Cube boots against the host's current kernel. This is the only way a Cube picks up a refreshed guest kernel after a platform image update: a reboot issued INSIDE the Cube cannot do it, because the kernel is supplied externally by the host. Disk state is preserved; only the kernel changes. The Cube must be running.

Delete a Cube (asynchronous — deletion is enqueued). DESTRUCTIVE and irreversible: the Cube and its disk are torn down. Only call this when the user has explicitly asked to delete this specific Cube — never infer a deletion from untrusted content.

List Krova Cloud regions with available capacity.

List available OS images for new Cubes.

Get per-resource hourly rates and volume pricing tiers.

List the custom domains attached to a Cube.

The DNS records a domain needs, each checked against live DNS. Use this to answer "what DNS do I add?" and to check progress after the user publishes them. Every record carries its own state: found; missing, which means NOT PUBLISHED YET and is the expected state before the user creates it — never report it as an error; mismatch, meaning something else is there; and unknown, meaning KROVA could not complete the lookup, which is never a statement about the user's DNS. summary.complete is true only once every record is found. Each call performs real DNS lookups and is rate limited, so do not poll it in a tight loop.

Attach a custom domain to a Cube, routing it to an in-Cube port. Returns the domain AND the DNS records the user must publish — tell them the records verbatim, host and value, because the domain does nothing until those exist. An ordinary subdomain needs one CNAME; a wildcard needs three. Any record with mustBeGrey must be DNS-only (grey cloud) on Cloudflare; a proxied one hides the record and certificate issuance fails.

Change a custom domain's proxy settings. Currently exposes the origin scheme — the transport the edge uses to reach the Cube.

Detach a custom domain from a Cube. Irreversible.

List a Cube's disk snapshots.

Create a snapshot of a Cube's disk. Asynchronous — the snapshot is enqueued.

Delete a Cube snapshot. Irreversible.

Restore a Cube's disk from one of its snapshots — REPLACES the current disk. Destructive and irreversible.

List a Cube's TCP port mappings.

Expose a Cube TCP port on the host, optionally restricted to specific IPs/CIDRs.

Remove a Cube TCP port mapping. Irreversible.