Guest console and recovery API

Creates an expiring console session for the target droplet.

Send an optional ttl_seconds, default 300, integer 60–900 inclusive. Returns 201 with session ID, expiry, and a short-lived connection URL. The caller also needs Guest Console permission on the target.

The URL is a credential. It is revealed once, excluded from ordinary audit payloads, and must not be placed in shared logs or a durable dashboard. Replaying a creation intent does not extend an existing session's expiry.

Revokes the managed connection and returns 204. A caller can revoke its own session or use the separately authorized session-administration permission. Closing the transport does not guarantee that a shell left logged in on the serial device has logged out.

Requests rescue boot while retaining the original root volume.

Requires droplets:recovery, Guest Recovery permission, If-Match, and a stopped droplet. Send type=enter_rescue and a permitted rescue_image_id.

To boot the approved rescue image, send this action body:

{
  "type": "enter_rescue",
  "rescue_image_id": "img_recovery_approved"
}

Accepted work returns 202 with an operation. Infra records the original boot source and attaches the recovery image without formatting the retained root volume. An incompatible image returns 422 invalid_recovery_image.

Restores the recorded normal boot configuration after rescue.

Send type=exit_rescue to the same recovery-action path after shutting down the rescue guest. The original root attachment must remain valid, or the request requires an explicitly selected compatible replacement root.

A completed exit restores boot configuration; it does not start the guest unless an explicit start action follows. Writes made to mounted disks during rescue remain real changes after exit.

Creates a brokered session using an approved connection profile.

Requires sessions:connect and an approved connection_profile_id. The profile selects SSH, RDP, or terminal mode and its credential source. The response identifies session ID, expiry, connection URL, and actual recording mode.

Returns recording state under the target's recording permissions.

Requires sessions:recordings_read and target recording permission. A recording can be pending, complete, incomplete, or expired. Export additionally requires sessions:recordings_export and an approved archive destination.

Do not treat a missing recording as evidence that no session activity occurred. See brokered sessions and security-key enforcement.

Exports a session recording to an approved destination.

Send an approved destination_id. Requires recording export permission and returns 202 with an export operation. An incomplete or expired recording cannot be presented as a complete session archive.