Organization API: Customer Portal: Snapshots

Part of Customer Portal.

GET /api/v1/orgs/{org_slug}/portal/snapshots

Every snapshot this customer holds, across every server they have had.

Scoped by the customer rather than by a server, so a customer whose service was terminated can still see what they can restore. This uses the customer's own tuple instead of deriving one from a server, because there may be no server left to derive it from, and that is the case that matters.

GET /api/v1/orgs/{org_slug}/portal/snapshots/allowance

GET /api/v1/orgs/{org_slug}/portal/snapshots/{snapshot_uuid}

One snapshot, for the order form that was handed its uuid in a link.

Registered after /snapshots/allowance on purpose: FastAPI matches in declaration order, and a path parameter here would otherwise swallow it.

DELETE /api/v1/orgs/{org_slug}/portal/snapshots/{snapshot_uuid}

Delete a snapshot the account owns, with or without its source server.

GET /api/v1/orgs/{org_slug}/portal/snapshots/{snapshot_uuid}/download

A signed URL for an archive whose server may no longer exist.

The free-tier download gate reads the source server's plan, and a snapshot whose server is gone has none to read, so it is treated as paid. Refusing instead would strand the archives that matter most, and a customer with no server is not using a free tier.

POST /api/v1/orgs/{org_slug}/portal/snapshots/{snapshot_uuid}/lock

Keep or release a snapshot the account owns, with or without its server.

The platform client had this and the portal did not, so a customer whose server was deleted could see the snapshot the sweep was about to rotate away and had no way to keep it.

POST /api/v1/orgs/{org_slug}/portal/snapshots/{snapshot_uuid}/restore

Restore an account snapshot onto one of the customer's servers.

The target is required rather than defaulted. On this path there is no server in the URL to fall back to, and guessing which server to overwrite is the one mistake here that destroys data.

The permission is still checked against the target server, because that is the one being overwritten and the one a subuser was or was not trusted with.

application/json (required)