> ## Documentation Index > Fetch the complete documentation index at: https://cool.computer/docs/llms.txt > Use this file to discover all available pages before exploring further. # Make a copy > Copies the site into the caller's account as a new private site: a publish of the site's live release as its release 1, with every file the site serves, its cool.json and its functions module (never hidden files or node_modules), under the requested name or a generated one; with a database, the copy's database gets the original's tables, indexes, views and triggers but no rows. It takes no release history, comments, mail, custom domain or shares, and the original's later changes never reach it. A copy counts as a publish: the publish limits and the account's site creation budget apply (429 artifact_creation_rate_exceeded). A copy of another account's site gets none of the caller's secret sets: its cool.json is published without secrets, since its functions are that account's code; the owner's own copy keeps its set. Once the request is received the copy finishes even if the client disconnects; a copy that fails after its computer was created deletes it again. Send an Idempotency-Key: a retry with the same key returns the original response or finishes that copy, and never copies again. Only a site without a VM can be copied for now (409 computer_has_vm). The owner may always copy their computer. Anyone else may only when the owner allows copies (PUT /api/computers/{id}/copy-settings), and only a computer they may open: a public one with any account credential except a computer's runtime token, or a private one shared with them. ## OpenAPI ````yaml https://www.cool.computer/openapi.json post /api/computers/{id}/copy openapi: 3.1.0 info: title: Cool Computers API version: 1.0.0 description: >- Create and operate reachable computers. Each computer keeps a stable name.cool.computer address, persistent files, and agent-ready command execution. REST requests use UTC-aligned one-minute limits: 600 requests per account identified by a recognized valid account bearer credential, a separate 600-request budget per computer-scoped credential, or 60 requests per source IP otherwise. Read-only GETs answered from API state spend a separate read budget reported as account-read or computer-read, so status polling cannot exhaust the budget that protects work and mutations. To bound authentication-provider traffic, at most 60 first-seen bearer values are checked per source IP in a minute; recognized valid credentials use their account or computer policy. Successful bearer authentication is reused for at most five seconds; transient provider failures are not cached. Revoking a credential through this API (POST /api/auth/logout or DELETE /api/api-keys/{id}) drops that reuse in every serving process, so the revoked credential is refused from the next request on; only if that announcement fails does another process keep admitting it, for at most five seconds. JSON request bodies must be sent with Content-Type: application/json; any other body answers 415 unsupported_media_type. A request that gives a published site its own VM (POST /api/computers/{id}/vm, POST /api/computers/{id}/service/run, or a publish whose cool.json declares run) answers with a Cool-Notice header saying that the site now runs there and cool.json no longer applies; exec, terminals, the port proxy and exposure never give one and answer 409 needs_vm on a site with no VM. Every error is an application/problem+json object whose type links to https://cool.computer/docs/api-reference/errors; a malformed body names the unknown field, the wrong type, or the byte where the JSON breaks. Non-exempt API responses include the structured RateLimit and RateLimit-Policy fields; request admission 429 responses use code api_request_rate_exceeded and also include Retry-After. Health, OpenAPI, webhooks, callbacks, SSE, and WebSocket endpoints are exempt from the REST request budget. Authenticated SSE connection attempts remain subject to the authentication safeguards and can receive the same typed 429 response. servers: - url: https://api.cool.computer description: Canonical API origin security: [] tags: - name: Authentication description: Obtain and manage bearer credentials. - name: Billing description: >- Inspect and manage the account's plan: Free (sites with no VM, at most 20 at once) or Pro (adds VMs and any number of sites). - name: Computers description: Create, inspect, and delete resident computers. - name: Execution description: Run commands on a computer. - name: Files description: Read and change a computer's persistent files. - name: Publishing description: >- Publish files to a computer's URL as immutable releases, with no VM. To show something, publish the files; to run something, give the site its own VM with POST /api/computers/{id}/vm or start a service with POST /api/computers/{id}/service/run, then use exec, terminals and services. - name: Services description: >- Manage processes and select the HTTP port exposed at a computer's stable address. - name: Email description: Read and send mail through a computer's inbox. - name: Comments description: >- Comments people leave on a computer's page, unless its owner switched comments off: the owner, the people it is shared with and, when the computer is public, any signed-in person. A comment is content; the owner's agents (Operator, or any agent with the owner's credential) pull the open comments and answer them, and the owner hands chosen comments as a job with POST /api/computers/{id}/comments/ask to Operator, or to the owner's own coding agent while it listens on the site with POST /api/computers/{id}/comments/watch (one listening session per site; it claims the job by pulling it, and Operator takes the job over when it goes quiet). - name: Network description: Control a computer's public visibility and outbound network policy. - name: Sharing description: Invite people to use a computer without granting owner controls. - name: Domains description: >- Serve a computer at a hostname you control, such as app.example.com, beside its own address. - name: Public description: Unauthenticated endpoints. - name: Secrets description: Inspect secret sets and their audit history; values are never returned. - name: Integrations description: Connect, inspect and revoke outside service accounts. - name: GitHub description: Work with repository workspaces using the connected user account. - name: Messaging description: >- Connect Telegram, Slack or WhatsApp so direct messages, and mentions of the Slack app in a channel, become chat turns. - name: Terminals description: Inspect a computer's terminal sessions. - name: Operator description: Read the operator agent's conversations, turns, and events. - name: Feedback description: >- Tell the Cool Computers team what works and what does not, with or without an account. externalDocs: description: Cool Computers agent registration guide url: https://www.cool.computer/auth.md paths: /api/computers/{id}/copy: post: tags: - Publishing summary: Make a copy description: >- Copies the site into the caller's account as a new private site: a publish of the site's live release as its release 1, with every file the site serves, its cool.json and its functions module (never hidden files or node_modules), under the requested name or a generated one; with a database, the copy's database gets the original's tables, indexes, views and triggers but no rows. It takes no release history, comments, mail, custom domain or shares, and the original's later changes never reach it. A copy counts as a publish: the publish limits and the account's site creation budget apply (429 artifact_creation_rate_exceeded). A copy of another account's site gets none of the caller's secret sets: its cool.json is published without secrets, since its functions are that account's code; the owner's own copy keeps its set. Once the request is received the copy finishes even if the client disconnects; a copy that fails after its computer was created deletes it again. Send an Idempotency-Key: a retry with the same key returns the original response or finishes that copy, and never copies again. Only a site without a VM can be copied for now (409 computer_has_vm). The owner may always copy their computer. Anyone else may only when the owner allows copies (PUT /api/computers/{id}/copy-settings), and only a computer they may open: a public one with any account credential except a computer's runtime token, or a private one shared with them. operationId: copyComputer parameters: - $ref: '#/components/parameters/ComputerID' - $ref: '#/components/parameters/IdempotencyKey' requestBody: required: false content: application/json: schema: $ref: '#/components/schemas/CopyRequest' responses: '201': headers: RateLimit: $ref: '#/components/headers/RateLimit' RateLimit-Policy: $ref: '#/components/headers/RateLimit-Policy' description: The copy and the receipt of its live release. content: application/json: schema: $ref: '#/components/schemas/PublishResult' '400': headers: RateLimit: $ref: '#/components/headers/RateLimit' RateLimit-Policy: $ref: '#/components/headers/RateLimit-Policy' description: Bad Request. content: application/problem+json: schema: $ref: '#/components/schemas/Problem' '401': $ref: '#/components/responses/Unauthorized' '402': headers: RateLimit: $ref: '#/components/headers/RateLimit' RateLimit-Policy: $ref: '#/components/headers/RateLimit-Policy' description: >- Payment Required. The trial expired or Pro is inactive; inspect the problem code and resolution. content: application/problem+json: schema: $ref: '#/components/schemas/Problem' '403': headers: RateLimit: $ref: '#/components/headers/RateLimit' RateLimit-Policy: $ref: '#/components/headers/RateLimit-Policy' description: 'Forbidden. `copy_not_allowed`: the owner does not allow copies.' content: application/problem+json: schema: $ref: '#/components/schemas/Problem' '404': headers: RateLimit: $ref: '#/components/headers/RateLimit' RateLimit-Policy: $ref: '#/components/headers/RateLimit-Policy' description: >- Not Found. Also for a private computer that is not shared with the caller. content: application/problem+json: schema: $ref: '#/components/schemas/Problem' '409': headers: RateLimit: $ref: '#/components/headers/RateLimit' RateLimit-Policy: $ref: '#/components/headers/RateLimit-Policy' description: >- Conflict. `computer_has_vm`: only a site without a VM can be copied for now. `nothing_to_copy`: the site has nothing published. `copy_source_changed`: the site changed while it was being copied; a new copy made nothing, while a retry may leave its unfinished copy in the account, so list computers before copying again. A taken name answers as a publish does. content: application/problem+json: schema: $ref: '#/components/schemas/Problem' '429': $ref: '#/components/responses/TooManyRequests' '500': $ref: '#/components/responses/InternalServerError' default: $ref: '#/components/responses/Problem' security: - bearerAuth: [] components: parameters: ComputerID: name: id in: path required: true description: >- The computer's name, such as agent-atlas, or its id (cmp_…). Every caller may use either, the computer's own runtime token included. schema: type: string minLength: 1 example: agent-atlas IdempotencyKey: name: Idempotency-Key in: header required: false description: >- A caller-generated key for safely retrying this side effect. The server retains the key and response for 24 hours. Reusing it with the same request replays the original response, except after a failure that proves nothing happened: that is kept for one minute, and one that sets Retry-After is not kept, so a retry after it runs the request again; reusing it with different input returns 409. schema: type: string minLength: 1 maxLength: 128 pattern: ^[!-~]+$ example: req_01J6M6Y9TF9Q9QF6M1ZP8K4R2A schemas: CopyRequest: type: object additionalProperties: false properties: name: $ref: '#/components/schemas/ComputerName' description: Name for the copy; omit it for a generated one. PublishResult: type: object additionalProperties: false required: - computer - release - url - vm - next properties: computer: $ref: '#/components/schemas/Computer' release: $ref: '#/components/schemas/Release' url: type: string format: uri description: The computer's URL, which serves the live release. release_url: type: string format: uri description: >- This release's own hostname r--. Absent once the computer's VM serves its URL. vm: type: boolean description: >- Whether the computer's VM serves its URL, because a server on it answered. next: $ref: '#/components/schemas/ReleaseNext' Problem: type: object additionalProperties: false required: - type - title - status - code - detail properties: type: type: string format: uri description: >- https://cool.computer/docs/api-reference/errors, the page that explains every code. title: type: string status: type: integer minimum: 400 maximum: 599 code: type: string pattern: ^[a-z0-9_]+$ detail: type: string resolution: type: string context: type: object additionalProperties: true suggestions: type: array items: type: string maxItems: 3 description: >- Values to send instead. With name_taken: up to three free names made from the requested one, the first with a random suffix; each was free when the answer was made. ComputerName: type: string description: >- A computer name, its address .cool.computer: lowercase letters and digits in words joined by single hyphens. The service names in not.enum are reserved. maxLength: 63 pattern: ^[a-z0-9]+(?:-[a-z0-9]+)*$ not: enum: - admin - admin-api - api - mail - www Computer: type: object additionalProperties: false required: - id - hostname - name - ip - status - visibility - access - copy_enabled - site - network_policy - created_at properties: id: type: string hostname: type: string name: type: string ip: type: string status: type: string description: >- artifact (no VM), creating, running, or deleting from when its deletion begins until it is gone. url: type: string format: uri email_address: type: string format: email visibility: type: string enum: - private - public access: type: string enum: - owner - can_use - claim_key description: >- What the caller holds: owner, can_use for a computer shared with them, or claim_key in the response to a publish without an account, whose claim key republishes to the computer and claims it. copy_enabled: type: boolean description: >- People other than the owner may copy the computer into their own accounts (PUT /api/computers/{id}/copy-settings). site: type: boolean description: >- The URL serves the computer's published files: from the edge, or from its VM's built-in site server until a port is first exposed, when the program on it takes every path but the functions' for good. network_policy: $ref: '#/components/schemas/NetworkPolicy' created_at: type: string format: date-time auto_delete_at: type: - string - 'null' format: date-time creation_mode: type: string Release: type: object additionalProperties: false required: - number - state - live - files - bytes - created_at properties: number: type: integer minimum: 1 state: type: string enum: - uploading - ready - failed live: type: boolean files: type: integer minimum: 0 bytes: type: integer format: int64 minimum: 0 created_at: type: string format: date-time ready_at: type: string format: date-time ReleaseNext: type: object additionalProperties: false required: - action description: 'What to do next: upload the missing hashes, finalize, or nothing (done).' properties: action: type: string enum: - upload - finalize - done upload: $ref: '#/components/schemas/ReleaseLink' finalize: $ref: '#/components/schemas/ReleaseLink' NetworkPolicy: type: object description: >- Outbound access policy. open allows public destinations, none blocks outbound access, and allowlist permits only the named public hosts. Private and reserved addresses remain blocked. additionalProperties: false required: - mode if: properties: mode: const: allowlist required: - mode then: required: - allowed_hosts properties: allowed_hosts: minItems: 1 else: properties: allowed_hosts: maxItems: 0 properties: mode: type: string enum: - open - none - allowlist allowed_hosts: type: array description: >- Required and non-empty only when mode is allowlist. Each value is a hostname, public IP, or leading wildcard such as *.example.com, without a scheme, port, path, or CIDR. maxItems: 100 items: type: string example: api.example.com ReleaseLink: type: object additionalProperties: false required: - method - href properties: method: type: string enum: - PUT - POST href: type: string description: API path; {sha256} stands for each missing hash. headers: RateLimit: description: >- The applied policy name, requests remaining after this request, and whole seconds until the current UTC-aligned window resets. schema: type: string pattern: >- ^"(account|account-read|computer|computer-read|source|comment-board|comment-live)";r=[0-9]+;t=([1-9]|[1-5][0-9]|60)$ examples: - '"account";r=599;t=42' - '"computer-read";r=598;t=42' RateLimit-Policy: description: >- The selected policy name, quota, and window in seconds. Valid account credentials use account or account-read with q=600, computer credentials use computer or computer-read with q=600, unauthenticated or unrecognized requests use source with q=60 for their source IP, a browser session's read of a comment board uses comment-board with q=300 for its source IP, and its handshake of a comment live channel uses comment-live with q=60 for its source IP. schema: type: string pattern: >- ^("(account|account-read|computer|computer-read)";q=600|"source";q=60|"comment-board";q=300|"comment-live";q=60);w=60$ examples: - '"account";q=600;w=60' - '"computer-read";q=600;w=60' Retry-After: description: >- Whole seconds to wait after an api_request_rate_exceeded, comment_rate_exceeded, comment_site_rate_exceeded, comment_live_full or computer_starting response before retrying (up to 3600 for comment_site_rate_exceeded, whose window is an hour). Other 429 problem codes describe separate resource or provider limits and do not inherit this retry value. schema: type: integer minimum: 1 maximum: 3600 examples: - 42 responses: Unauthorized: headers: RateLimit: $ref: '#/components/headers/RateLimit' RateLimit-Policy: $ref: '#/components/headers/RateLimit-Policy' description: Unauthorized. content: application/problem+json: schema: $ref: '#/components/schemas/Problem' TooManyRequests: headers: RateLimit: $ref: '#/components/headers/RateLimit' RateLimit-Policy: $ref: '#/components/headers/RateLimit-Policy' Retry-After: $ref: '#/components/headers/Retry-After' description: >- Too Many Requests. If the problem code is api_request_rate_exceeded, wait for Retry-After seconds; other problem codes describe a separate limit. content: application/problem+json: schema: $ref: '#/components/schemas/Problem' InternalServerError: headers: RateLimit: $ref: '#/components/headers/RateLimit' RateLimit-Policy: $ref: '#/components/headers/RateLimit-Policy' description: Internal Server Error. content: application/problem+json: schema: $ref: '#/components/schemas/Problem' Problem: headers: RateLimit: $ref: '#/components/headers/RateLimit' RateLimit-Policy: $ref: '#/components/headers/RateLimit-Policy' description: >- A machine-readable API error with a stable code and recovery instruction. content: application/problem+json: schema: $ref: '#/components/schemas/Problem' securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: WorkOS user or agent access token, or Cool Computers API key description: >- A Cool Computers API key, user access token, or claimed agent access token in the Authorization header. Follow https://www.cool.computer/auth.md for agent registration and https://www.cool.computer/authentication.md for direct user credentials. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.