# Raff

- [Products](https://docs.rafftechnologies.com/products/index.md): Every product on the Raff Platform — Virtual Machines, Volumes, Object Storage, VPC, Public IPs, Firewall, Team & Projects — plus what's coming next. One platform, one bill, one API.
- [Why Raff](https://docs.rafftechnologies.com/products/why-raff.md): Building the future of cloud computing — one platform where digital teams deploy, store, communicate, automate, and ship AI features without juggling vendors. Read our founding story, mission, vision, values, and the ecosystem we're building.
- [Use Raff docs in your AI tools](https://docs.rafftechnologies.com/products/mcp.md): Plug Raff's full documentation into Claude, Cursor, and other MCP-enabled AI clients. The Model Context Protocol endpoint exposes search and page retrieval over Raff's docs so your AI assistant grounds its answers on real, current Raff content instead of guessing.
- [Virtual Machines](https://docs.rafftechnologies.com/products/build/virtual-machines/index.md): On-demand Linux and Windows server instances on the Raff Platform
- [Create a VM](https://docs.rafftechnologies.com/products/build/virtual-machines/quickstart-guides/create-a-vm.md): Launch a new virtual machine from the Raff Platform dashboard
- [Initial server setup (Linux)](https://docs.rafftechnologies.com/products/build/virtual-machines/quickstart-guides/initial-server-setup.md): Harden a fresh Linux VM in 10 minutes — non-root user, key-only SSH, firewall, automatic security updates
- [Connect via SSH](https://docs.rafftechnologies.com/products/build/virtual-machines/quickstart-guides/connect-via-ssh.md): Open a session to a Linux VM — in-browser terminal, direct SSH, or VNC console fallback
- [Connect via RDP](https://docs.rafftechnologies.com/products/build/virtual-machines/quickstart-guides/connect-via-rdp.md): Open a session to a Windows VM — in-browser VNC console or direct RDP from a desktop client
- [Open the browser console](https://docs.rafftechnologies.com/products/build/virtual-machines/quickstart-guides/open-browser-console.md): The "Console" button on every VM is a single entry point that picks the right in-browser session for the situation — an SSH-backed terminal for Linux, or a VNC graphical console for Windows and recovery scenarios. This page explains what each mode is, how the dashboard decides between them, and when…
- [Transfer files to and from a VM](https://docs.rafftechnologies.com/products/build/virtual-machines/quickstart-guides/transfer-files.md): Move files to and from your Raff VM with SCP for one-shot copies, SFTP for interactive sessions, rsync for big trees, or a GUI client like FileZilla / WinSCP. Same SSH credentials you already use for shell access.
- [Manage power](https://docs.rafftechnologies.com/products/build/virtual-machines/quickstart-guides/manage-power.md): Stop, start, and reboot virtual machines from the dashboard
- [Rename a VM](https://docs.rafftechnologies.com/products/build/virtual-machines/quickstart-guides/rename.md): Change a virtual machine's display name
- [Resize a VM](https://docs.rafftechnologies.com/products/build/virtual-machines/quickstart-guides/resize.md): Change CPU, RAM, or disk size on a virtual machine
- [Reset password](https://docs.rafftechnologies.com/products/build/virtual-machines/quickstart-guides/reset-password.md): Reset or recover the root or Administrator password on a virtual machine
- [Reinstall a VM](https://docs.rafftechnologies.com/products/build/virtual-machines/quickstart-guides/reinstall.md): Re-image a VM with a fresh OS template while keeping the IP, attached volumes, and specs
- [Factory reset](https://docs.rafftechnologies.com/products/build/virtual-machines/quickstart-guides/factory-reset.md): Reinstall the same OS on a VM with a clean disk while keeping volumes, snapshots, and backups
- [Create a snapshot](https://docs.rafftechnologies.com/products/build/virtual-machines/quickstart-guides/create-snapshot.md): Capture a point-in-time copy of a VM's OS disk or a volume's contents
- [Enable backups](https://docs.rafftechnologies.com/products/build/virtual-machines/quickstart-guides/enable-backups.md): Run an instant backup, schedule recurring daily or weekly backups, and manage retention
- [Recover a locked-out VM](https://docs.rafftechnologies.com/products/build/virtual-machines/quickstart-guides/recover-locked-vm.md): Get back into a VM when SSH, RDP, or the OS itself has stopped letting you in
- [Delete a VM](https://docs.rafftechnologies.com/products/build/virtual-machines/quickstart-guides/delete-vm.md): Permanently destroy a virtual machine, decide what to do with its volumes and VPCs, and credit unused subscription time back to your balance
- [Plans & sizing](https://docs.rafftechnologies.com/products/build/virtual-machines/concepts/plans-and-sizing.md): Three plan tiers (General Purpose / shared CPU, CPU Optimized / guaranteed CPU, and Windows Server), how to pick between them, and which size to start with for common workloads — web apps, databases, workers, dev/staging, Windows desktop, game servers
- [CPU and bursting](https://docs.rafftechnologies.com/products/build/virtual-machines/concepts/cpu-and-bursting.md): The sustained level Standard plans can always hold, how bursting above it works, and what happens after long periods of heavy load
- [Regions](https://docs.rafftechnologies.com/products/build/virtual-machines/concepts/regions.md): Where Raff VMs run today (us-east only) and how regional scope affects networking, IP allocation, and migration
- [OS templates](https://docs.rafftechnologies.com/products/build/virtual-machines/concepts/os-templates.md): The Linux distros, BSD, and Windows Server images Raff provides at VM creation, plus the marketplace one-click apps that install software on top
- [Custom images](https://docs.rafftechnologies.com/products/build/virtual-machines/concepts/custom-images.md): Save a VM's disk as a reusable template, then create new VMs from it
- [Storage model](https://docs.rafftechnologies.com/products/build/virtual-machines/concepts/storage-model.md): How base disks, volumes, snapshots, backups, and custom images relate — and what survives what
- [Snapshots vs Backups](https://docs.rafftechnologies.com/products/build/virtual-machines/concepts/snapshots-vs-backups.md): Both capture a VM's disk state, but they answer different needs — manual restore points vs scheduled protection. Both are deleted with the VM.
- [Lifecycle states](https://docs.rafftechnologies.com/products/build/virtual-machines/concepts/lifecycle-states.md): How a VM moves through provisioning, running, stopped, and terminal states
- [Authentication & access](https://docs.rafftechnologies.com/products/build/virtual-machines/concepts/authentication.md): How credentials and transports combine to let you reach a VM, and what to use when
- [Monitoring & metrics](https://docs.rafftechnologies.com/products/build/virtual-machines/concepts/monitoring-and-metrics.md): How Raff measures VM health, what each graph means, and where to read live state
- [Tags & organization](https://docs.rafftechnologies.com/products/build/virtual-machines/concepts/tags-and-organization.md): How VM tags, priorities, and Group by Tag let you organize many VMs without losing your mind
- [VM notes — My Notes & Team Notes](https://docs.rafftechnologies.com/products/build/virtual-machines/concepts/vm-notes.md): Two kinds of free-form notes attached to a VM, and who can see each
- [Account limits](https://docs.rafftechnologies.com/products/build/virtual-machines/concepts/account-limits.md): Per-account quotas that govern how many VMs and how much CPU/RAM you can run at once
- [Billing model](https://docs.rafftechnologies.com/products/build/virtual-machines/concepts/billing-model.md): How money moves through your account — cards, balance, subscriptions, credits, and the rotation rule
- [Virtual Machines features and limits](https://docs.rafftechnologies.com/products/build/virtual-machines/details/features-and-limits.md): Full feature list for Virtual Machines on the Raff Platform, plus account, VM, and platform limits
- [Pricing](https://docs.rafftechnologies.com/products/build/virtual-machines/details/pricing.md): How Virtual Machines are billed on the Raff Platform — full per-plan rate tables for Standard, Premium and Windows Server tiers, subscription vs PAYG, billing-date alignment, and what's billed alongside the plan
- [SLA](https://docs.rafftechnologies.com/products/build/virtual-machines/details/sla.md): Uptime commitment, service credit schedule, and how to claim for services on the Raff Platform
- [Acceptable use](https://docs.rafftechnologies.com/products/build/virtual-machines/details/acceptable-use.md): What you can and can't run on a Raff VM, abuse handling, and how to report violations
- [Support](https://docs.rafftechnologies.com/products/build/virtual-machines/details/support.md): How to reach Raff support, response times, working hours, languages, and what we help with
- [Virtual Machines troubleshooting](https://docs.rafftechnologies.com/products/build/virtual-machines/troubleshooting.md): Common Virtual Machine issues and how to fix them
- [Kubernetes](https://docs.rafftechnologies.com/products/build/kubernetes/index.md): Managed Kubernetes clusters — free single-master control plane, optional paid HA, autoscaling node pools, billed per worker node
- [Create a Kubernetes cluster](https://docs.rafftechnologies.com/products/build/kubernetes/quickstart-guides/create-a-cluster.md): Launch a managed Kubernetes cluster from the dashboard in 10–20 minutes
- [Connect to Kubernetes with kubectl](https://docs.rafftechnologies.com/products/build/kubernetes/quickstart-guides/connect-with-kubectl.md): Get a kubeconfig and run kubectl against your cluster
- [Add a Kubernetes node pool](https://docs.rafftechnologies.com/products/build/kubernetes/quickstart-guides/add-a-node-pool.md): Add a pool of worker nodes with its own labels, taints and autoscaling bounds
- [Scale a Kubernetes node pool](https://docs.rafftechnologies.com/products/build/kubernetes/quickstart-guides/scale-a-node-pool.md): Add or remove worker nodes by hand, or set autoscaling bounds
- [Upgrade to an HA control plane](https://docs.rafftechnologies.com/products/build/kubernetes/quickstart-guides/upgrade-to-ha.md): Promote a single-master cluster to a 3-master highly available control plane
- [Upgrade the Kubernetes version](https://docs.rafftechnologies.com/products/build/kubernetes/quickstart-guides/upgrade-kubernetes-version.md): Move a cluster to a newer Kubernetes version with a rolling in-place upgrade
- [Install an app from App Hub](https://docs.rafftechnologies.com/products/build/kubernetes/quickstart-guides/install-an-app.md): Install, configure, expose and upgrade Helm charts from the dashboard
- [Expose a Kubernetes service](https://docs.rafftechnologies.com/products/build/kubernetes/quickstart-guides/expose-a-service.md): Publish workloads with Traefik ingress, MetalLB, or a TCP port on the cluster's public IP
- [View Kubernetes logs and metrics](https://docs.rafftechnologies.com/products/build/kubernetes/quickstart-guides/view-logs-and-metrics.md): Watch workloads, pod logs, node utilization and control-plane health from the dashboard
- [Delete a Kubernetes cluster](https://docs.rafftechnologies.com/products/build/kubernetes/quickstart-guides/delete-a-cluster.md): Remove a cluster and all its infrastructure
- [Kubernetes cluster architecture](https://docs.rafftechnologies.com/products/build/kubernetes/concepts/cluster-architecture.md): What a Raff Kubernetes cluster is made of — gateway, control plane, workers, volume storage
- [Kubernetes node pools and autoscaling](https://docs.rafftechnologies.com/products/build/kubernetes/concepts/node-pools-and-autoscaling.md): How pools group workers, and the exact rules the autoscaler follows
- [Kubernetes control plane and HA](https://docs.rafftechnologies.com/products/build/kubernetes/concepts/control-plane-and-ha.md): The managed control plane, what HA adds, and how we keep etcd fast
- [Kubernetes networking](https://docs.rafftechnologies.com/products/build/kubernetes/concepts/networking.md): VPC, CIDRs, the gateway, firewall, ingress and MetalLB
- [Cluster access and credentials](https://docs.rafftechnologies.com/products/build/kubernetes/concepts/cluster-access.md): How kubeconfigs are issued, how long they last, and how to revoke them
- [Kubernetes storage](https://docs.rafftechnologies.com/products/build/kubernetes/concepts/storage.md): PersistentVolumes backed by Raff Volumes — pay per GB, no storage nodes
- [Kubernetes cluster states](https://docs.rafftechnologies.com/products/build/kubernetes/concepts/lifecycle-states.md): Every status a cluster, pool or node can be in, and what to do about it
- [Kubernetes billing model](https://docs.rafftechnologies.com/products/build/kubernetes/concepts/billing-model.md): What bills, when — pay-as-you-go vs subscription, autoscaling overage, HA and storage fees
- [Kubernetes features and limits](https://docs.rafftechnologies.com/products/build/kubernetes/details/features-and-limits.md): Exactly what ships today — capabilities, limits, and what is not offered yet
- [Kubernetes pricing](https://docs.rafftechnologies.com/products/build/kubernetes/details/pricing.md): Worker node plans, HA control-plane fee and per-GB volume storage
- [Kubernetes SLA](https://docs.rafftechnologies.com/products/build/kubernetes/details/sla.md): 99.90% monthly uptime commitment for managed Kubernetes, and how service credits work
- [Kubernetes supported versions](https://docs.rafftechnologies.com/products/build/kubernetes/details/supported-versions.md): Which Kubernetes releases you can run, and how new versions and upgrades arrive
- [Kubernetes troubleshooting](https://docs.rafftechnologies.com/products/build/kubernetes/troubleshooting.md): The issues people actually hit, and how to resolve them
- [Raff Apps](https://docs.rafftechnologies.com/products/build/raff-apps/index.md): Push-to-deploy web services, workers, and jobs on the Raff PaaS
- [Volumes](https://docs.rafftechnologies.com/products/store/volumes/index.md): NVMe SSD block storage you attach to a VM — survives VM destroy, grows on demand, billed per GiB
- [Create a volume](https://docs.rafftechnologies.com/products/store/volumes/quickstart-guides/create-a-volume.md): Provision a new block volume — pick size, billing term, target VM, and how it should be formatted
- [Attach to a VM](https://docs.rafftechnologies.com/products/store/volumes/quickstart-guides/attach-to-vm.md): Mount a Raff volume on a Linux or Windows VM, format it, persist it across reboots, and grow it after a resize
- [Resize a volume](https://docs.rafftechnologies.com/products/store/volumes/quickstart-guides/resize-volume.md): Grow an attached volume's capacity in the dashboard, then expand the filesystem inside the VM
- [Detach from a VM](https://docs.rafftechnologies.com/products/store/volumes/quickstart-guides/detach-from-vm.md): Cleanly unmount a volume from a VM so it can be reattached elsewhere, while keeping all data intact
- [Delete a volume](https://docs.rafftechnologies.com/products/store/volumes/quickstart-guides/delete-volume.md): Permanently remove a volume, stop its billing, and credit unused subscription time back to your balance
- [Volume types](https://docs.rafftechnologies.com/products/store/volumes/concepts/volume-types.md): What a Raff volume is, how it persists, how it attaches, and what currently varies between volumes
- [Volumes features and limits](https://docs.rafftechnologies.com/products/store/volumes/details/features-and-limits.md): Full feature list for Raff volumes plus capacity, attach, and lifecycle limits
- [Volumes troubleshooting](https://docs.rafftechnologies.com/products/store/volumes/troubleshooting.md): Common volume issues — attach, mount, resize, detach, delete — and how to fix them
- [Object Storage](https://docs.rafftechnologies.com/products/store/object-storage/index.md): S3-compatible object storage on the Raff Platform — NVMe SSD buckets, AWS-SDK-compatible, with the same regional endpoint and SigV4 auth model as AWS S3
- [Create a bucket](https://docs.rafftechnologies.com/products/store/object-storage/quickstart-guides/create-bucket.md): Create an S3-compatible Object Storage bucket and get its endpoint URL
- [Upload files](https://docs.rafftechnologies.com/products/store/object-storage/quickstart-guides/upload-files.md): Drag-and-drop files into a Raff Object Storage bucket via the dashboard, plus what to do with them after
- [Generate access keys](https://docs.rafftechnologies.com/products/store/object-storage/quickstart-guides/generate-access-keys.md): Create S3-compatible access key pairs for programmatic access — Full Access or Limited (per-bucket) scope
- [Set public or private](https://docs.rafftechnologies.com/products/store/object-storage/quickstart-guides/set-public-private.md): Bucket-level ACL, bucket policies (JSON), per-object ACL, and presigned URLs — three layers that combine to control who can read what
- [Use the S3 SDK](https://docs.rafftechnologies.com/products/store/object-storage/quickstart-guides/s3-sdk-access.md): Connect to Raff Object Storage from any S3-compatible SDK or CLI — boto3, aws-cli, JavaScript, Go, rclone, s3cmd, mc, Cyberduck
- [Monitor bucket usage](https://docs.rafftechnologies.com/products/store/object-storage/quickstart-guides/monitor-usage.md): Read the live Metrics tab — storage size, object count, GET/PUT/DELETE counts, and ingress/egress data transfer for the current month
- [S3 compatibility](https://docs.rafftechnologies.com/products/store/object-storage/concepts/s3-compatibility.md): What S3-compatibility means in practice — the API surface that works on Raff, the AWS-only features that don't, and the gotchas that catch every new integration
- [Object Storage features and limits](https://docs.rafftechnologies.com/products/store/object-storage/details/features-and-limits.md): Object Storage features, S3 endpoint, pricing tiers, storage class, and platform limits
- [Object Storage troubleshooting](https://docs.rafftechnologies.com/products/store/object-storage/troubleshooting.md): Common Raff Object Storage errors — authentication, connection, uploads, ACLs — and the fix that works in each case
- [Virtual Private Cloud](https://docs.rafftechnologies.com/products/network/vpc/index.md): Virtual Private Cloud networking on Raff — VXLAN-isolated private networks for VMs in the same region
- [Use the Networking diagram](https://docs.rafftechnologies.com/products/network/vpc/quickstart-guides/use-networking-diagram.md): Visualize every VPC, VM, and public IP in your account on one interactive canvas — and manage them inline with click-to-action menus
- [Create a VPC](https://docs.rafftechnologies.com/products/network/vpc/quickstart-guides/create-vpc.md): Open the VPCs tab, click Create VPC, pick a network size (Recommended / Small / Large / Custom), and confirm
- [Manage a VPC](https://docs.rafftechnologies.com/products/network/vpc/quickstart-guides/manage-vpc.md): Open the VPC detail page to rename, change DNS, enable an internet gateway (Platform Router or Firewall Appliance), attach VMs, and configure port forwarding
- [Attach a VM](https://docs.rafftechnologies.com/products/network/vpc/quickstart-guides/attach-vm.md): Add a VM to an existing VPC — three entry points in the dashboard, all open the same Add VM dialog with auto-assign or specific-IP options
- [Delete a VPC](https://docs.rafftechnologies.com/products/network/vpc/quickstart-guides/delete-vpc.md): Delete is blocked while VMs are attached — detach or delete the VMs first, then delete the VPC from the row menu or the detail page
- [VXLAN, CIDR, and isolation](https://docs.rafftechnologies.com/products/network/vpc/concepts/cidr-and-isolation.md): How Raff VPCs are isolated — every VPC is its own VXLAN segment with a unique VNI, which is why two VPCs can use the same CIDR and still never see each other
- [VPC features and limits](https://docs.rafftechnologies.com/products/network/vpc/details/features-and-limits.md): VPC features, supported CIDR sizes, MTU, internet gateway options, and platform limits
- [VPC troubleshooting](https://docs.rafftechnologies.com/products/network/vpc/troubleshooting.md): Common VPC problems — CIDR rejection, IPs that don't talk to each other, DNS not propagating, port forwarding not working, gateway and delete blocks — and the fix for each
- [Public IPs](https://docs.rafftechnologies.com/products/network/public-ips/index.md): Public IPv4 and IPv6 addresses on Raff — auto-assigned from a free pool by default, or reserved as static IPs that persist across VM rebuilds for $3/month (IPv4) or $1/month (IPv6)
- [Auto-assign a public IP](https://docs.rafftechnologies.com/products/network/public-ips/quickstart-guides/auto-assign.md): Give a VM that has no public IP a free address from the regional pool — IPv4 or IPv6, no commitment, returns to the pool when detached
- [Reserve a static IP](https://docs.rafftechnologies.com/products/network/public-ips/quickstart-guides/reserve-ip.md): Reserve a public IPv4 or IPv6 address that stays yours across VM rebuilds and detaches — $3/month, billed continuously, attach and detach freely
- [Manage public IPs from a VM](https://docs.rafftechnologies.com/products/network/public-ips/quickstart-guides/manage-from-vm.md): Every VM has a Network tab in its detail page where you can add, remove, or attach a Firewall to the VM's public IPv4 and IPv6 addresses, and connect the VM to a VPC
- [Move a reserved IP between VMs](https://docs.rafftechnologies.com/products/network/public-ips/quickstart-guides/move-between-vms.md): Detach a reserved public IP from one VM, attach it to another, without changing the IP itself — useful for blue/green deploys, failover, and partner-whitelist preservation
- [Release a public IP](https://docs.rafftechnologies.com/products/network/public-ips/quickstart-guides/release-ip.md): Stop billing on a reserved IP by releasing it back to the pool — irreversible, the IP becomes available for someone else to auto-assign or reserve
- [Auto-assigned vs reserved IPs](https://docs.rafftechnologies.com/products/network/public-ips/concepts/reserved-vs-ephemeral.md): How the two public-IP lifecycles differ on Raff — what survives a detach, what survives a VM delete, when each one bills, and which to pick for stable addresses
- [Public IP features and limits](https://docs.rafftechnologies.com/products/network/public-ips/details/features-and-limits.md): Public IP features, IPv4/IPv6 support, pricing for auto-assigned and reserved IPs, regional pools, and per-VM and per-account limits
- [Public IPs troubleshooting](https://docs.rafftechnologies.com/products/network/public-ips/troubleshooting.md): Common public-IP problems — auto-assign returning empty, IP not bound to interface, "billing keeps running" surprises, type mismatch, region pool exhausted — and the fix for each
- [Firewall](https://docs.rafftechnologies.com/products/network/firewall/index.md): Stateful network firewall on Raff — every public interface gets the system Default Firewall automatically, and you can add your own Firewall Groups with custom inbound and outbound rules
- [Create a Firewall Group](https://docs.rafftechnologies.com/products/network/firewall/quickstart-guides/create-firewall-group.md): Walk the Create Firewall Group dialog — name, description, optional template, then build the inbound and outbound rule lists, save, and attach to a VM
- [Add rules — port and IP formats by example](https://docs.rafftechnologies.com/products/network/firewall/quickstart-guides/add-rules.md): The exact formats Raff accepts for the Ports and Source IP fields, with copy-pasteable examples for the most common rules
- [Attach a Firewall Group to a VM](https://docs.rafftechnologies.com/products/network/firewall/quickstart-guides/attach-to-vm.md): Two ways to attach a Firewall Group to a VM's public IP — from the group's row menu, or from the VM's Network tab — plus the mandatory reboot to make the rules take effect inside the guest
- [Update rules in a Firewall Group](https://docs.rafftechnologies.com/products/network/firewall/quickstart-guides/update-rules.md): Open Edit Firewall Group from the row menu to change a group's name, description, inbound rules, or outbound rules — same dialog as Create, just prefilled with the existing rule set
- [Delete a Firewall Group](https://docs.rafftechnologies.com/products/network/firewall/quickstart-guides/delete-firewall-group.md): Permanently remove a custom Firewall Group from the row menu — the action is blocked while VMs are attached, and any attached VMs need to be rebooted afterward
- [Inbound vs outbound, layers, and rule format](https://docs.rafftechnologies.com/products/network/firewall/concepts/inbound-vs-outbound.md): How the Raff Firewall actually evaluates traffic — the two layers (system Default + your Groups), what a single rule looks like (protocol, direction, port, source IP), the formats Raff accepts, and the ports you cannot open
- [Firewall features and limits](https://docs.rafftechnologies.com/products/network/firewall/details/features-and-limits.md): Raff Firewall features, the system Default Firewall blocked-port list, custom Firewall Group rule formats, per-group limits, the 5 templates, and pricing
- [Firewall troubleshooting](https://docs.rafftechnologies.com/products/network/firewall/troubleshooting.md): Common Firewall problems — rules saved but not applied (the reboot trap), Default-blocked ports rejected silently, port forwarding stops working after a group attach, locked-out-by-firewall recovery, save errors and rule-format gotchas
- [Team & Projects](https://docs.rafftechnologies.com/products/manage/team-projects/index.md): Team & Projects on Raff — invite members, organize resources into projects, scope access at the account or per-project level, and assign roles
- [Invite a member](https://docs.rafftechnologies.com/products/manage/team-projects/quickstart-guides/invite-member.md): Send an email invitation to add a new member at the Account or Project access level — and grant additional access from the member's row after they accept, without sending another invite
- [Change or remove a member's role](https://docs.rafftechnologies.com/products/manage/team-projects/quickstart-guides/change-role.md): Re-scope an existing member by changing their account role or any of their per-project roles, or remove a single grant entirely without removing the member from the account
- [Remove a member](https://docs.rafftechnologies.com/products/manage/team-projects/quickstart-guides/remove-member.md): Permanently revoke a team member's access to the account — removes their account role, every project role they hold, and ends their dashboard sessions. API keys they created keep working until rotated separately.
- [Create a project](https://docs.rafftechnologies.com/products/manage/team-projects/quickstart-guides/create-a-project.md): Open the Projects tab, click + Create Project, name it, optionally describe it, and save — projects organize resources for access control and let you scope members to specific subsets of your fleet
- [Edit or delete a project](https://docs.rafftechnologies.com/products/manage/team-projects/quickstart-guides/delete-a-project.md): Open the project's row menu to rename it, change its description (Edit Project), or delete it — with the hard rule that the Default project can never be deleted
- [Generate an API key](https://docs.rafftechnologies.com/products/manage/team-projects/quickstart-guides/generate-api-key.md): Create an API key with the same Account / Project role model used for members — pick an Account Role, pick projects and a Project Role (skipped when Owner is chosen), set expiration, and copy the key once
- [Rotate an API key](https://docs.rafftechnologies.com/products/manage/team-projects/quickstart-guides/rotate-api-key.md): Use the Regenerate action to issue a new key value with the same name, scope, and expiration — invalidating the old one — and roll your applications without downtime
- [Roles, scopes, and the Owner](https://docs.rafftechnologies.com/products/manage/team-projects/concepts/roles-and-api-keys.md): How Raff splits access into Account-level and Project-level roles, why account-level grants don't include project-level visibility, what the seven prebuilt System roles do, and how to build Custom roles
- [Resource scoping](https://docs.rafftechnologies.com/products/manage/team-projects/concepts/projects-and-scoping.md): How projects scope resources, IDs, and API calls
- [API keys](https://docs.rafftechnologies.com/products/manage/team-projects/concepts/api-keys.md): How Raff API keys work — the role-based permission model, the raff_ token format, the create-once / show-once secret lifecycle, expiration, rotation, and the security practices that make leaked keys non-events
- [Permissions matrix](https://docs.rafftechnologies.com/products/manage/team-projects/details/permissions-matrix.md): The full list of System roles on Raff — three account-level (Admin, Billing, Member) and four project-level (Project Admin, Operator, Project Member, Viewer) — with every permission each one grants
- [Team & Projects troubleshooting](https://docs.rafftechnologies.com/products/manage/team-projects/troubleshooting.md): Common Team & Projects problems — invitation never arrived, role changes not taking effect, API keys still authenticating after a member leaves, the Owner question, lost-access recovery, and the rules behind permission denied errors
- [Introduction](https://docs.rafftechnologies.com/introduction.md): Build against Raff with the REST API, the CLI, or Terraform — pick the flavor that fits your workflow.
- [Quickstart](https://docs.rafftechnologies.com/quickstart.md): Make your first API call in under 5 minutes
- [Authentication](https://docs.rafftechnologies.com/authentication.md): Authenticate with the Raff API — API keys, required headers, response shape, rate limits, and how to call the API from popular HTTP clients
- [Create Your First VM](https://docs.rafftechnologies.com/guides/create-your-first-vm.md): Step-by-step guide to deploying a virtual machine on Raff
- [All Endpoints](https://docs.rafftechnologies.com/api-reference/endpoints.md): Every endpoint in the Raff REST API, grouped by category
- [List Regions](https://docs.rafftechnologies.com/api-reference/catalog/list-regions.md): Returns all active data center regions.
- [List OS Templates](https://docs.rafftechnologies.com/api-reference/catalog/list-templates.md): Returns all public OS templates available for VM creation. Windows templates are only available for premium VM types.
- [List VM Pricing](https://docs.rafftechnologies.com/api-reference/catalog/list-vm-pricing.md): Returns VM pricing plans. Use the plan `id` as `pricing_id` when creating a VM.
- [Get Volume Pricing](https://docs.rafftechnologies.com/api-reference/catalog/list-volume-pricing.md): Returns block storage volume pricing per GB.
- [Get Snapshot Pricing](https://docs.rafftechnologies.com/api-reference/catalog/list-snapshot-pricing.md): Returns snapshot storage pricing per GB.
- [Get Backup Pricing](https://docs.rafftechnologies.com/api-reference/catalog/list-backup-pricing.md): Returns backup storage pricing per GB.
- [Get IP Pricing](https://docs.rafftechnologies.com/api-reference/catalog/list-ip-pricing.md): Returns pricing for IPv4 and IPv6 addresses.
- [List Database Pricing](https://docs.rafftechnologies.com/api-reference/catalog/list-database-pricing.md): Returns managed database plans plus high availability, read replica, and extra storage pricing. High availability multiplies the plan price — an HA plan costs `price_per_month * (1 + price_multiplier)`.
- [List Kubernetes Pricing](https://docs.rafftechnologies.com/api-reference/catalog/list-kubernetes-pricing.md): Returns worker node plans plus HA control plane and storage node pricing. The standard control plane is free — `ha_pricing` is the optional highly available control plane.
- [List Projects](https://docs.rafftechnologies.com/api-reference/projects/list-projects.md): List all projects for the authenticated account.
- [Create Project](https://docs.rafftechnologies.com/api-reference/projects/create-project.md): Create a new project within the authenticated account.
- [Get Project](https://docs.rafftechnologies.com/api-reference/projects/get-project.md): Get details of a specific project.
- [Update Project](https://docs.rafftechnologies.com/api-reference/projects/update-project.md): Update an existing project's settings.
- [Delete Project](https://docs.rafftechnologies.com/api-reference/projects/delete-project.md): Delete a project. The project must not contain any active resources.
- [List VMs](https://docs.rafftechnologies.com/api-reference/endpoint/list-vms.md): List all virtual machines for the authenticated account.
- [Create VM](https://docs.rafftechnologies.com/api-reference/endpoint/create-vm.md): Create a new virtual machine with a chosen OS template, compute plan, and region. The VM is automatically assigned to a VPC for private networking.
- [Get VM](https://docs.rafftechnologies.com/api-reference/endpoint/get-vm.md): Get details of a specific virtual machine.
- [Delete VM](https://docs.rafftechnologies.com/api-reference/endpoint/delete-vm.md): Permanently delete a virtual machine and release its resources.
- [Bulk Delete VMs](https://docs.rafftechnologies.com/api-reference/endpoint/bulk-delete-vms.md): Delete up to 50 virtual machines in a single request.
- [Start VM](https://docs.rafftechnologies.com/api-reference/endpoint/start-vm.md): Start a stopped virtual machine.
- [Stop VM](https://docs.rafftechnologies.com/api-reference/endpoint/stop-vm.md): Stop a running virtual machine. The VM will retain its resources and can be started again.
- [Reboot VM](https://docs.rafftechnologies.com/api-reference/endpoint/reboot-vm.md): Reboot a running virtual machine.
- [Hard reboot VM](https://docs.rafftechnologies.com/api-reference/endpoint/hard-reboot-vm.md): Force an immediate power-off and restart of a virtual machine, **without** a graceful shutdown.
- [Rename VM](https://docs.rafftechnologies.com/api-reference/endpoint/rename-vm.md): Rename a virtual machine.
- [Set console access policy](https://docs.rafftechnologies.com/api-reference/endpoint/set-vm-console-policy.md): Toggle whether the VM's web console (terminal or VNC) asks for a fresh two-factor code before it opens. Off by default. When on, the dashboard prompts for the authenticator code (a confirmation unlocks protected consoles for 1 hour), and API keys cannot open the console. Which members may open the c…
- [Reset VM Password](https://docs.rafftechnologies.com/api-reference/endpoint/reset-vm-password.md): Reset the root/admin password of a virtual machine. The new password will be emailed to the account owner.
- [Reinstall VM](https://docs.rafftechnologies.com/api-reference/endpoint/reinstall-vm.md): Reinstall a virtual machine with a new OS template. This will destroy all data on the VM.
- [Factory Reset VM](https://docs.rafftechnologies.com/api-reference/endpoint/factory-reset-vm.md): Factory reset a virtual machine to its original state. This will destroy all data on the VM and restore it to the original template.
- [Resize VM](https://docs.rafftechnologies.com/api-reference/endpoint/resize-vm.md): Resize a virtual machine's CPU and RAM by selecting a new pricing plan. The VM must be stopped before resizing.
- [Resize VM Disk](https://docs.rafftechnologies.com/api-reference/endpoint/resize-vm-disk.md): Increase the primary disk of a virtual machine. The VM must be stopped. Disk size can only be increased.
- [Save VM disk as custom image](https://docs.rafftechnologies.com/api-reference/endpoint/save-vm-disk-as-image.md): Save a VM's disk (live state or a snapshot) as a reusable custom OS image. The new image becomes available alongside the public OS templates and can be passed as `template_id` when creating a new VM.
- [Add tag to VM](https://docs.rafftechnologies.com/api-reference/endpoint/add-vm-tag.md): Attach a custom tag to a virtual machine. Tags help organize and filter resources. Returns the updated full tag list for the VM.
- [Update VM tag](https://docs.rafftechnologies.com/api-reference/endpoint/update-vm-tag.md): Update a tag's name or priority on a specific VM. Returns the updated full tag list for the VM.
- [Remove VM tag](https://docs.rafftechnologies.com/api-reference/endpoint/remove-vm-tag.md): Remove a tag from a VM. Returns the updated full tag list for the VM.
- [Get VM notes](https://docs.rafftechnologies.com/api-reference/endpoint/get-vm-notes.md): Get the personal and account-shared notes attached to a VM.
- [Upsert VM note](https://docs.rafftechnologies.com/api-reference/endpoint/upsert-vm-note.md): Create or fully replace the personal or account note on a VM.
- [Update VM note](https://docs.rafftechnologies.com/api-reference/endpoint/update-vm-note.md): Replace an existing note's content.
- [Append to VM note](https://docs.rafftechnologies.com/api-reference/endpoint/append-vm-note.md): Append `content` to the existing note (separated by a newline). If no note exists yet for this scope, the new content becomes the entire note body.
- [List database engines](https://docs.rafftechnologies.com/api-reference/databases/list-database-engines.md): The database engine catalog: each engine with its display name, supported versions, and whether it is available to create.
- [List database plans](https://docs.rafftechnologies.com/api-reference/databases/list-database-plans.md): Pricing tiers for managed databases, plus the high availability, read replica, and extra storage pricing. Use the plan `id` as `plan_id` when creating or scaling a database.
- [List databases](https://docs.rafftechnologies.com/api-reference/databases/list-databases.md): List the managed databases of the account, or of one project with `X-Project-ID`.
- [Create database](https://docs.rafftechnologies.com/api-reference/databases/create-database.md): Create a managed database. Provisioning is asynchronous: the database is created in status `pending` and moves through `deploying` to `running`. Poll `GET /api/v1/databases/{database_id}` for progress. A free PostgreSQL or MySQL database is usually `running` within 10 seconds.
- [Get database](https://docs.rafftechnologies.com/api-reference/databases/get-database.md): Get details of a managed database.
- [Rename database](https://docs.rafftechnologies.com/api-reference/databases/update-database.md): Update the display name of a database. Connection endpoints are based on the immutable `database_id` and do not change.
- [Delete database](https://docs.rafftechnologies.com/api-reference/databases/delete-database.md): Permanently delete a managed database and its backups. This cannot be undone.
- [Scale database](https://docs.rafftechnologies.com/api-reference/databases/scale-database.md): Change the plan, storage, high availability, or read replica count of a running database.
- [Resume a paused database](https://docs.rafftechnologies.com/api-reference/databases/resume-database.md): Wake a free-tier database that was suspended for idleness (no client connections for 7 days). The database returns through `deploying` and reaches `running` in about a minute; all data is preserved.
- [Get connection details](https://docs.rafftechnologies.com/api-reference/databases/get-database-connection.md): Connection details for the database: username, database name, and two endpoints.
- [Rotate credentials](https://docs.rafftechnologies.com/api-reference/databases/rotate-database-credentials.md): Generate a new password for the database user. Existing connections keep working until they disconnect; new connections must use the new password. Fetch it via `GET /api/v1/databases/{database_id}/connection?reveal=true`.
- [Connect database to VPC](https://docs.rafftechnologies.com/api-reference/databases/connect-database-v-p-c.md): Attach a database created without a VPC to one of your VPCs. The private endpoint `{database_id}.db.raffusercloud.com` becomes reachable from inside that VPC.
- [Disconnect database from VPC](https://docs.rafftechnologies.com/api-reference/databases/disconnect-database-v-p-c.md): Detach the database's private endpoint from its VPC. Clients inside the VPC lose access; public access, if enabled, keeps working.
- [Set public access](https://docs.rafftechnologies.com/api-reference/databases/set-database-public-access.md): Open or close public access to the database.
- [List database users](https://docs.rafftechnologies.com/api-reference/databases/list-database-users.md): The users (roles) inside the database engine, with what each can do. `kind` tells them apart: `admin` is the user created with the database, `scoped` are users you added, `binding` are users Raff created for an app or function, and `system` are engine users you cannot change.
- [Create database user](https://docs.rafftechnologies.com/api-reference/databases/create-database-user.md): Add a user with read-only or read-write access. The password is returned once in this response; fetch it again later with `GET /api/v1/databases/{database_id}/users/{name}/credential`.
- [Rotate database user password](https://docs.rafftechnologies.com/api-reference/databases/rotate-database-user.md): Give a user a new password. Open connections keep working until they disconnect.
- [Get database user password](https://docs.rafftechnologies.com/api-reference/databases/get-database-user-credential.md): The current username and password of a user you added.
- [Delete database user](https://docs.rafftechnologies.com/api-reference/databases/delete-database-user.md): Remove a user you added. The admin user and users Raff manages for apps and functions cannot be deleted.
- [Run a query](https://docs.rafftechnologies.com/api-reference/databases/run-database-query.md): Run one statement against the database and get the result: SQL for PostgreSQL, MySQL, and ClickHouse, or one command for Valkey.
- [Browse schemas, tables, and keys](https://docs.rafftechnologies.com/api-reference/databases/browse-database.md): Walk the database one level at a time with `path`.
- [List saved queries](https://docs.rafftechnologies.com/api-reference/databases/list-database-saved-queries.md): Queries saved for this database, shared by everyone on the account.
- [Save a query](https://docs.rafftechnologies.com/api-reference/databases/save-database-saved-query.md): Save a query under a name. Saving again with the same name replaces it.
- [Delete a saved query](https://docs.rafftechnologies.com/api-reference/databases/delete-database-saved-query.md)
- [List backups](https://docs.rafftechnologies.com/api-reference/databases/list-database-backups.md): All backups for the database: nightly automatic backups (`base`) and on-demand backups (`on_demand`).
- [Create backup](https://docs.rafftechnologies.com/api-reference/databases/create-database-backup.md): Start an on-demand backup — a base backup for PostgreSQL, an RDB snapshot for Valkey. The backup runs asynchronously; poll the list until its status is `completed`.
- [Restore database](https://docs.rafftechnologies.com/api-reference/databases/restore-database.md): Restore a database to a backup or a point in time, either into a new database (`clone_to_new: true`) or over this one (`in_place: true`).
- [Get metrics](https://docs.rafftechnologies.com/api-reference/databases/get-database-metrics.md): Latest usage snapshot: CPU, memory, storage, connections, and replication lag. Metrics refresh about every 60 seconds; zero values mean not measured yet.
- [Get metrics history](https://docs.rafftechnologies.com/api-reference/databases/get-database-metrics-history.md): Time-series metrics over a window, bucketed for charting.
- [Get traffic by client](https://docs.rafftechnologies.com/api-reference/databases/get-database-client-traffic.md): Operations, errors, and warnings per database user over a window, bucketed for charting. A value of `-1` means the engine does not count that number per user.
- [Get slow queries](https://docs.rafftechnologies.com/api-reference/databases/get-database-slow-queries.md): The slowest recent queries.
- [Get logs](https://docs.rafftechnologies.com/api-reference/databases/get-database-logs.md): Recent engine log lines, newest last.
- [List extensions](https://docs.rafftechnologies.com/api-reference/databases/list-database-extensions.md): The PostgreSQL extension allowlist with the installed state of each extension. Valkey has no extensions — the list is empty.
- [Enable or disable extension](https://docs.rafftechnologies.com/api-reference/databases/set-database-extension.md): Install or remove a PostgreSQL extension from the allowlist. PostgreSQL only.
- [List engine parameters](https://docs.rafftechnologies.com/api-reference/databases/list-database-parameters.md): The engine settings in effect (for example `max_connections` or `work_mem`), with the default and where each value comes from: `plan` (set by the plan size), `override` (set through `engine_config`), or `engine` (engine default).
- [List apps and functions using the database](https://docs.rafftechnologies.com/api-reference/databases/list-database-consumers.md): The Raff apps and functions bound to this database, with the state of each binding.
- [List app services](https://docs.rafftechnologies.com/api-reference/apps/list-app-services.md): List app services for the authenticated account.
- [Create app service](https://docs.rafftechnologies.com/api-reference/apps/create-app-service.md): Create an app service. Provisioning is asynchronous — the service is created in status `pending` and moves through `building` and `deploying` to `live`; poll `GET /api/v1/apps/services/{service_id}` for progress.
- [Get app service](https://docs.rafftechnologies.com/api-reference/apps/get-app-service.md)
- [Delete app service](https://docs.rafftechnologies.com/api-reference/apps/delete-app-service.md): Delete an app service. Deletion is asynchronous; the name and URL are released once it completes.
- [Pause app service](https://docs.rafftechnologies.com/api-reference/apps/pause-app-service.md): Scale the service to zero and stop billing for replicas. Cron services are suspended.
- [Resume app service](https://docs.rafftechnologies.com/api-reference/apps/resume-app-service.md): Bring a paused service back to its configured replica count.
- [Scale app service](https://docs.rafftechnologies.com/api-reference/apps/scale-app-service.md): Update the replica count, autoscaling bounds, or scale-to-zero. Live services apply the change with no downtime.
- [Request source upload URL](https://docs.rafftechnologies.com/api-reference/apps/request-app-source-upload.md): Get a presigned URL to upload a source tarball (gzipped). After the upload completes, create a deployment with the returned `blob_key`.
- [List deployments](https://docs.rafftechnologies.com/api-reference/apps/list-app-deployments.md)
- [Create deployment](https://docs.rafftechnologies.com/api-reference/apps/create-app-deployment.md): Build and roll out a new deployment. Provide a `source_blob_key` from a completed source upload, or an `image_ref` for a prebuilt image. Git-connected services deploy their branch head when neither is given.
- [Get deployment](https://docs.rafftechnologies.com/api-reference/apps/get-app-deployment.md)
- [Get deployment build logs](https://docs.rafftechnologies.com/api-reference/apps/get-app-deployment-logs.md)
- [Roll back to a deployment](https://docs.rafftechnologies.com/api-reference/apps/rollback-app-service.md): Pin the service back to an earlier deployment's image. Creates a new deployment from the target's digest and config snapshot.
- [List runtime logs](https://docs.rafftechnologies.com/api-reference/apps/list-app-logs.md)
- [Get service metrics](https://docs.rafftechnologies.com/api-reference/apps/get-app-service-metrics.md)
- [List environment variables](https://docs.rafftechnologies.com/api-reference/apps/list-app-env-vars.md): Secret values are masked; use the reveal endpoint to read them.
- [List environment variables with values](https://docs.rafftechnologies.com/api-reference/apps/reveal-app-env-vars.md): Returns secret values in cleartext. Requires manage permission; access is audited.
- [Set environment variable](https://docs.rafftechnologies.com/api-reference/apps/set-app-env-var.md): Create or update one variable. By default the change rolls out to running replicas. Set `redeploy: false` to defer it to the next deploy.
- [Bulk set environment variables](https://docs.rafftechnologies.com/api-reference/apps/bulk-set-app-env-vars.md): Upsert many variables at once (an `.env` paste).
- [Delete environment variable](https://docs.rafftechnologies.com/api-reference/apps/delete-app-env-var.md)
- [List custom domains](https://docs.rafftechnologies.com/api-reference/apps/list-app-custom-domains.md)
- [Add custom domain](https://docs.rafftechnologies.com/api-reference/apps/add-app-custom-domain.md): Attach a custom domain to a web service. The response carries the DNS records to create — a CNAME to `cname_target` and a verification TXT record. Verification and TLS issuance run automatically once the DNS resolves.
- [Delete custom domain](https://docs.rafftechnologies.com/api-reference/apps/delete-app-custom-domain.md)
- [Retry domain verification](https://docs.rafftechnologies.com/api-reference/apps/retry-app-domain-verification.md): Re-check DNS and re-attempt certificate issuance for a domain.
- [Trigger a manual job run](https://docs.rafftechnologies.com/api-reference/apps/run-app-job.md): Start a run of a cron or one-off job service now.
- [List job runs](https://docs.rafftechnologies.com/api-reference/apps/list-app-job-runs.md)
- [Cancel a job run](https://docs.rafftechnologies.com/api-reference/apps/cancel-app-job-run.md)
- [List Apps tiers](https://docs.rafftechnologies.com/api-reference/apps/list-app-tiers.md): The Apps pricing catalog — compute sizes and prices. No authentication required.
- [Get Apps usage](https://docs.rafftechnologies.com/api-reference/apps/get-apps-usage.md): Month-to-date replica-hours and estimated charge per service.
- [Get spend cap settings](https://docs.rafftechnologies.com/api-reference/apps/get-app-spend-settings.md)
- [Update spend cap settings](https://docs.rafftechnologies.com/api-reference/apps/update-app-spend-settings.md): Change the account's monthly Apps spend cap. Send only the fields you want to change; fields you leave out keep their value. An account that never set a cap is on at $50 with `notify_only`.
- [List VPCs](https://docs.rafftechnologies.com/api-reference/endpoint/list-vpcs.md): List virtual private clouds (VPCs).
- [Create VPC](https://docs.rafftechnologies.com/api-reference/endpoint/create-vpc.md): Create a new virtual private cloud. Pick a `cidr` block that doesn't overlap with any of your existing VPCs.
- [Get VPC](https://docs.rafftechnologies.com/api-reference/endpoint/get-vpc.md): Get details of a single VPC. The response wraps the core VPC fields under `data.vpc` and includes additional detail fields (`ip_range_start`, `ip_range_end`, `leases`) at the same level.
- [Update VPC](https://docs.rafftechnologies.com/api-reference/endpoint/update-vpc.md): Update a VPC's name or description. CIDR cannot be changed after creation.
- [Delete VPC](https://docs.rafftechnologies.com/api-reference/endpoint/delete-vpc.md): Delete a VPC. The VPC must not have any VMs attached — detach them first via `DELETE /api/v1/vms/{id}/vpc/{nic_id}`.
- [Suggest CIDR blocks for new VPCs](https://docs.rafftechnologies.com/api-reference/endpoint/list-vpc-cidr-suggestions.md): Returns suggested CIDR blocks that don't overlap with the account's existing VPCs. Use one of these as `cidr` when creating a new VPC.
- [List floating IPs](https://docs.rafftechnologies.com/api-reference/endpoint/list-ips.md): List the account's floating (public) IP addresses, including reserved IPs and IPs currently attached to VMs. Filter to just reserved IPs with `?reserved=true`.
- [Reserve a floating IP](https://docs.rafftechnologies.com/api-reference/endpoint/reserve-ip.md): Reserve a floating public IP. The IP is allocated immediately and held for your account until you release it.
- [Get floating IP](https://docs.rafftechnologies.com/api-reference/endpoint/get-ip.md): Get details of a single floating IP.
- [Release a reserved IP](https://docs.rafftechnologies.com/api-reference/endpoint/release-ip.md): Release a reserved IP back to the pool.
- [Change reserved IP](https://docs.rafftechnologies.com/api-reference/endpoint/change-ip.md): Swap a reserved IP for a different one from the available pool. The subscription stays the same — no extra charge, no refund. Useful if the current IP is blacklisted somewhere.
- [List firewalls](https://docs.rafftechnologies.com/api-reference/endpoint/list-firewalls.md): List the account's security groups. Pass `X-Project-ID` to scope to one project, or omit it to list across all accessible projects.
- [Create firewall](https://docs.rafftechnologies.com/api-reference/endpoint/create-firewall.md): Create a new security group with a set of inbound/outbound rules.
- [List firewall templates](https://docs.rafftechnologies.com/api-reference/endpoint/list-firewall-templates.md): Pre-built security group templates customers can clone when creating a new group (e.g. "Web server", "SSH only", "Database"). Pass the chosen `id` as `template_id` on `POST /api/v1/security-groups`.
- [Get firewall](https://docs.rafftechnologies.com/api-reference/endpoint/get-firewall.md): Get details of a single security group, including its rules.
- [Update firewall](https://docs.rafftechnologies.com/api-reference/endpoint/update-firewall.md): Update a security group's name, description, or rules. Passing `rules` replaces the entire rule set — to add or remove a single rule, GET the current rules first, modify the array, then PUT the result.
- [Delete firewall](https://docs.rafftechnologies.com/api-reference/endpoint/delete-firewall.md): Delete a security group. The group must not be attached to any VM NIC. Detach it first via `DELETE /api/v1/vms/{id}/security-groups/{sg_id}/{nic_id}`.
- [List VM network interfaces](https://docs.rafftechnologies.com/api-reference/endpoint/list-vm-networks.md): List all network interfaces (NICs) attached to a virtual machine. Each NIC has a `nic_id` used when detaching from a VPC, IP, or security group.
- [Attach VM to VPC](https://docs.rafftechnologies.com/api-reference/endpoint/attach-vm-to-vpc.md): Attach a virtual machine to a VPC. The VM gains a private network interface inside the VPC.
- [Detach VM from VPC](https://docs.rafftechnologies.com/api-reference/endpoint/detach-vm-from-vpc.md): Detach a VM's network interface from its VPC. Use the `nic_id` from `GET /api/v1/vms/{id}/networks` to identify the interface.
- [Attach floating IP to VM](https://docs.rafftechnologies.com/api-reference/endpoint/attach-vm-ip.md): Attach a floating public IP to a virtual machine. Pick **one** of two modes:
- [Detach floating IP from VM](https://docs.rafftechnologies.com/api-reference/endpoint/detach-vm-ip.md): Detach a floating IP from a VM. A reserved IP returns to your reserved pool and **continues to be billed** until you release it via `DELETE /api/v1/ips/{id}/reserve`. An auto-assigned IP is released back to the shared pool. Use the `nic_id` from `GET /api/v1/vms/{id}/networks`. If you detach the VM'…
- [Attach firewall to VM NIC](https://docs.rafftechnologies.com/api-reference/endpoint/attach-vm-firewall.md): Attach a security group to a specific network interface on a VM. The security group's rules apply to inbound and outbound traffic on that NIC.
- [Detach firewall from VM NIC](https://docs.rafftechnologies.com/api-reference/endpoint/detach-vm-firewall.md): Remove a security group from a specific NIC on a VM.
- [List Volumes](https://docs.rafftechnologies.com/api-reference/volumes/list-volumes.md): List volumes for the authenticated account. Filter by VM or region.
- [Create Volume](https://docs.rafftechnologies.com/api-reference/volumes/create-volume.md): Create a new block storage volume. Volumes are created asynchronously — the response returns immediately with `pending` status.
- [Get Volume](https://docs.rafftechnologies.com/api-reference/volumes/get-volume.md): Get details of a specific volume.
- [Delete Volume](https://docs.rafftechnologies.com/api-reference/volumes/delete-volume.md): Permanently delete a volume. The volume must be detached from any VM before deletion.
- [Attach Volume](https://docs.rafftechnologies.com/api-reference/volumes/attach-volume.md): Attach a volume to a VM. The VM must be in the same region as the volume. A volume can only be attached to one VM at a time — detach it first if it's already attached elsewhere.
- [Detach Volume](https://docs.rafftechnologies.com/api-reference/volumes/detach-volume.md): Detach a volume from its current VM. Unmount the filesystem inside the guest before calling this endpoint to avoid data corruption.
- [Resize Volume](https://docs.rafftechnologies.com/api-reference/volumes/resize-volume.md): Increase the size of a block storage volume. Volume size can only be increased, never decreased.
- [List Kubernetes Clusters](https://docs.rafftechnologies.com/api-reference/kubernetes/list-clusters.md): List clusters for the authenticated account, newest first.
- [Create Kubernetes Cluster](https://docs.rafftechnologies.com/api-reference/kubernetes/create-cluster.md): Create a managed Kubernetes cluster. Provisioning is asynchronous — the response returns immediately with `pending` status; the cluster is usable when `ready` is `true` (typically 8–12 minutes).
- [Get Kubernetes Cluster](https://docs.rafftechnologies.com/api-reference/kubernetes/get-cluster.md)
- [Rename Kubernetes Cluster](https://docs.rafftechnologies.com/api-reference/kubernetes/rename-cluster.md)
- [Delete Kubernetes Cluster](https://docs.rafftechnologies.com/api-reference/kubernetes/delete-cluster.md): Delete a cluster and all its infrastructure (nodes, networking, reserved IPs, DNS). Deletion is asynchronous.
- [Get Kubeconfig](https://docs.rafftechnologies.com/api-reference/kubernetes/get-kubeconfig.md): Issue a kubeconfig for the cluster. Every kubeconfig expires — the default lifetime is **7 days**; use `expires_in` to choose another (10 minutes to 30 days). Grants full cluster-admin access while valid, so store it like a password, and [rotate access](#tag/Kubernetes/operation/rotateK8sKubeconfigA…
- [Upgrade to HA Control Plane](https://docs.rafftechnologies.com/api-reference/kubernetes/upgrade-to-ha.md): Promote a single-master cluster to a 3-master highly available control plane. The flat HA fee starts accruing once enabled.
- [List Available Version Upgrades](https://docs.rafftechnologies.com/api-reference/kubernetes/get-cluster-upgrades.md): The Kubernetes versions this cluster can upgrade to right now — patch releases of its current minor and the next minor (Kubernetes upgrades one minor at a time) — plus the cluster's upgrade state, mode and maintenance window.
- [Upgrade Kubernetes Version](https://docs.rafftechnologies.com/api-reference/kubernetes/upgrade-cluster-version.md): Start an in-place Kubernetes upgrade to one of the versions from [List available version upgrades](#tag/Kubernetes/operation/listK8sClusterUpgrades). The upgrade is rolling: control-plane nodes one at a time, then workers drained first (PodDisruptionBudgets honoured). HA clusters upgrade with no API…
- [Set Upgrade Mode and Maintenance Window](https://docs.rafftechnologies.com/api-reference/kubernetes/update-cluster-maintenance.md): `manual` (default) — you start upgrades yourself. `auto_patch` — patch releases are applied automatically in the maintenance window (notice email ~72h before). `auto_minor` — minors too, after a stability period. The window is 4 hours from `maintenance_start` (UTC) on `maintenance_day`.
- [List Kubernetes Versions](https://docs.rafftechnologies.com/api-reference/kubernetes/list-kubernetes-versions.md): Kubernetes versions available for new clusters. Use `id` as `k8s_version_id` when creating a cluster.
- [List Kubernetes Node Plans](https://docs.rafftechnologies.com/api-reference/kubernetes/list-node-plans.md): Worker node plans plus HA control-plane and storage-node pricing. Same data as `GET /api/v1/public/pricing/kubernetes`.
- [List Node Pools](https://docs.rafftechnologies.com/api-reference/kubernetes/list-node-pools.md)
- [Add Node Pool](https://docs.rafftechnologies.com/api-reference/kubernetes/add-node-pool.md): Add a node pool. Nodes deploy asynchronously; the pool is `running` once every node has joined.
- [Update Node Pool](https://docs.rafftechnologies.com/api-reference/kubernetes/update-node-pool.md): Update a pool's autoscaling bounds, labels and taints. Labels and taints are applied to the pool's Kubernetes nodes within a minute.
- [Scale Node Pool](https://docs.rafftechnologies.com/api-reference/kubernetes/scale-node-pool.md): Set the pool's node count (2–20). Scale-up deploys new nodes; scale-down cordons and drains the newest nodes first — honouring PodDisruptionBudgets, never force-deleting — then removes their VMs. Both run asynchronously; watch the pool's `status` and `status_message`.
- [Delete Node Pool](https://docs.rafftechnologies.com/api-reference/kubernetes/delete-node-pool.md): Remove a pool and all its nodes. Each node is cordoned and drained (PodDisruptionBudgets are honoured) before its VM is terminated, one at a time; the operation runs asynchronously and stops — with the pool intact — if a node cannot be emptied.
- [List Cluster Nodes](https://docs.rafftechnologies.com/api-reference/kubernetes/list-cluster-nodes.md): All nodes of the cluster (control plane, workers, storage, gateway) merged with live Kubernetes state when reachable.
- [List Cluster Events](https://docs.rafftechnologies.com/api-reference/kubernetes/list-cluster-events.md): Lifecycle events (provisioning steps, scaling, autoscaling, warnings), newest first.
- [Get Cluster Metrics](https://docs.rafftechnologies.com/api-reference/kubernetes/get-cluster-metrics.md): Live utilization (CPU, memory, pods, per-node breakdown) plus a 24-hour control-plane health summary. Values refresh every 60 seconds.
- [Get Cluster Utilization Stats](https://docs.rafftechnologies.com/api-reference/kubernetes/get-cluster-stats.md): Batch utilization snapshot for one or more clusters (CPU, memory, pods, node readiness). Values refresh every 60 seconds.
- [Get Cluster Firewall](https://docs.rafftechnologies.com/api-reference/kubernetes/get-cluster-firewall.md): The security group protecting the cluster's public gateway, and the account's security groups available to assign.
- [Assign Cluster Firewall](https://docs.rafftechnologies.com/api-reference/kubernetes/assign-cluster-firewall.md)
- [Reset Cluster Firewall](https://docs.rafftechnologies.com/api-reference/kubernetes/reset-cluster-firewall.md): Detach the custom security group and restore the platform baseline.
- [Get MetalLB Address Pool](https://docs.rafftechnologies.com/api-reference/kubernetes/get-metallb-pool.md)
- [Resize MetalLB Address Pool](https://docs.rafftechnologies.com/api-reference/kubernetes/update-metallb-pool.md): Set how many private IPs MetalLB can hand to `LoadBalancer` services.
- [List TCP Port Forwards](https://docs.rafftechnologies.com/api-reference/kubernetes/list-tcp-ports.md): L4 forwards published on the cluster's public gateway (created when exposing an app over TCP).
- [Delete TCP Port Forward](https://docs.rafftechnologies.com/api-reference/kubernetes/delete-tcp-port.md)
- [List Snapshots](https://docs.rafftechnologies.com/api-reference/snapshots/list-snapshots.md): List snapshots for the authenticated account. Filter by VM, volume, or type.
- [Create Snapshot](https://docs.rafftechnologies.com/api-reference/snapshots/create-snapshot.md): Create a snapshot of a VM or a volume.
- [Get Snapshot](https://docs.rafftechnologies.com/api-reference/snapshots/get-snapshot.md): Get details of a specific snapshot.
- [Delete Snapshot](https://docs.rafftechnologies.com/api-reference/snapshots/delete-snapshot.md): Permanently delete a snapshot.
- [Restore Snapshot](https://docs.rafftechnologies.com/api-reference/snapshots/restore-snapshot.md): Revert the source VM (or volume) to the state captured in this snapshot.
- [Rename Snapshot](https://docs.rafftechnologies.com/api-reference/snapshots/rename-snapshot.md): Rename a snapshot. Updates the display name only — does not affect the underlying disk image.
- [List Backups](https://docs.rafftechnologies.com/api-reference/backups/list-backups.md): List backups for the authenticated account. Filter by VM.
- [Create Backup](https://docs.rafftechnologies.com/api-reference/backups/create-backup.md): Create an on-demand backup of a VM. The backup is created asynchronously — the response returns immediately with a `pending` status.
- [Get Backup](https://docs.rafftechnologies.com/api-reference/backups/get-backup.md): Get details of a specific backup.
- [Delete Backup](https://docs.rafftechnologies.com/api-reference/backups/delete-backup.md): Permanently delete a backup.
- [Delete Backup Series](https://docs.rafftechnologies.com/api-reference/backups/delete-backup-chain.md): Delete an entire backup series — every restore point that the given backup belongs to. The series is identified by passing the UUID of **any** backup row in it; all sibling restore points (and the underlying storage) are removed in one call.
- [Restore Backup](https://docs.rafftechnologies.com/api-reference/backups/restore-backup.md): Restore a VM from a backup. The restore runs asynchronously — the response returns immediately with a `pending` status.
- [Reset Backup Series](https://docs.rafftechnologies.com/api-reference/backups/reset-backup-chain.md): Start a fresh backup series for the VM. The current series is closed — existing restore points remain restorable until you delete them — and the next backup creates a new independent baseline.
- [List Backup Schedules](https://docs.rafftechnologies.com/api-reference/backups/schedules/list-backup-schedules.md): List backup schedules for the authenticated account. Filter by VM.
- [Create Backup Schedule](https://docs.rafftechnologies.com/api-reference/backups/schedules/create-backup-schedule.md): Create a recurring backup schedule for a VM.
- [Get Backup Schedule](https://docs.rafftechnologies.com/api-reference/backups/schedules/get-backup-schedule.md): Get details of a specific backup schedule.
- [Update Backup Schedule](https://docs.rafftechnologies.com/api-reference/backups/schedules/update-backup-schedule.md): Update one or more fields on an existing backup schedule. Omitted fields are unchanged.
- [Delete Backup Schedule](https://docs.rafftechnologies.com/api-reference/backups/schedules/delete-backup-schedule.md): Delete a backup schedule. Existing backups created by this schedule are retained.
- [List SSH Keys](https://docs.rafftechnologies.com/api-reference/ssh-keys/list-ssh-keys.md): List SSH keys for the authenticated account. SSH keys are account-level — no project scoping.
- [Create SSH Key](https://docs.rafftechnologies.com/api-reference/ssh-keys/create-ssh-key.md): Add an SSH public key to your account. Pass the key on VM create via the `ssh_keys` array to enable key-based login.
- [Get SSH Key](https://docs.rafftechnologies.com/api-reference/ssh-keys/get-ssh-key.md): Get details of a specific SSH key.
- [Update SSH Key](https://docs.rafftechnologies.com/api-reference/ssh-keys/update-ssh-key.md): Update an SSH key's display name. The public key itself cannot be changed — delete and recreate to rotate.
- [Delete SSH Key](https://docs.rafftechnologies.com/api-reference/ssh-keys/delete-ssh-key.md): Permanently delete an SSH key from your account. VMs that already have this key installed continue to accept it until the key is removed from the VM's `~/.ssh/authorized_keys`.
- [List Members](https://docs.rafftechnologies.com/api-reference/members/list-members.md): List all members of the authenticated account, including pending invitations.
- [Add Member](https://docs.rafftechnologies.com/api-reference/members/add-member.md): Add a new member to the account. There are three ways:
- [Get Member](https://docs.rafftechnologies.com/api-reference/members/get-member.md): Get details of a specific account member.
- [Update Member](https://docs.rafftechnologies.com/api-reference/members/update-member.md): Update a member's role or status. Pass only the fields you want to change.
- [Remove Member](https://docs.rafftechnologies.com/api-reference/members/remove-member.md): Remove a member from the account. Account owners cannot be removed via this endpoint — transfer ownership first from the dashboard.
- [List Project Members](https://docs.rafftechnologies.com/api-reference/project-members/list-project-members.md): List members of a specific project.
- [Add Project Member](https://docs.rafftechnologies.com/api-reference/project-members/add-project-member.md): Add an existing account member (or API key) to a project with a specific role.
- [Get Project Member](https://docs.rafftechnologies.com/api-reference/project-members/get-project-member.md)
- [Update Project Member](https://docs.rafftechnologies.com/api-reference/project-members/update-project-member.md): Change a project member's role or status.
- [Remove Project Member](https://docs.rafftechnologies.com/api-reference/project-members/remove-project-member.md): Remove a member from a project. The user remains an account member; only the project-scoped grant is revoked.
- [List Roles](https://docs.rafftechnologies.com/api-reference/roles/list-roles.md): List all roles available to the account — both **system roles** (e.g. `Owner`, `Admin`, `Member`, `Operator`) and any **custom roles** the account has defined.
- [Create Role](https://docs.rafftechnologies.com/api-reference/roles/create-role.md): Create a custom role bundling a set of permissions at either account or project scope.
- [Get Role](https://docs.rafftechnologies.com/api-reference/roles/get-role.md)
- [Update Role](https://docs.rafftechnologies.com/api-reference/roles/update-role.md): Update a custom role's name, description, or permission set. **System roles cannot be edited** — return `400 Bad Request`.
- [Delete Role](https://docs.rafftechnologies.com/api-reference/roles/delete-role.md): Delete a custom role. The role must not be in use by any member or API key — reassign them first or deletion will fail.
- [List Permissions](https://docs.rafftechnologies.com/api-reference/permissions/list-permissions.md): List the full catalog of permission strings recognized by the role system. Use this to discover valid values for the `permissions` array on [Create Role](#tag/Roles/operation/createRole) and [Update Role](#tag/Roles/operation/updateRole).
- [List API Keys](https://docs.rafftechnologies.com/api-reference/api-keys/list-api-keys.md): List API keys belonging to the account. Only key prefixes are returned — full secrets are only shown once at create time.
- [Create API Key](https://docs.rafftechnologies.com/api-reference/api-keys/create-api-key.md): Create a new API key. The full secret is returned **once** in the `secret` field of the response — store it immediately. Subsequent reads only return the `key_prefix`.
- [Get API Key](https://docs.rafftechnologies.com/api-reference/api-keys/get-api-key.md): Get an API key's metadata. The secret is never returned — only the prefix.
- [Update API Key](https://docs.rafftechnologies.com/api-reference/api-keys/update-api-key.md): Update an API key's name, expiry, rate-limit tier, or active flag. Permissions cannot be changed via this endpoint — change the role assigned to the key instead, or rotate to a new key.
- [Revoke API Key](https://docs.rafftechnologies.com/api-reference/api-keys/revoke-api-key.md): Permanently revoke an API key. In-flight requests using this key fail with `401`. Cannot be undone.
- [Regenerate API Key](https://docs.rafftechnologies.com/api-reference/api-keys/regenerate-api-key.md): Rotate an API key — issues a new secret value and immediately invalidates the previous secret. The key keeps its name, scope, role, and expiration.
- [Create Account Invitation](https://docs.rafftechnologies.com/api-reference/invitations/create-account-invitation.md): Send an email invitation for someone to join the account with the given role. The recipient gets an email with an accept link. Until they accept, the invitation appears in [List Members](#tag/Members/operation/listMembers) with `status: pending`.
- [Create Project Invitation](https://docs.rafftechnologies.com/api-reference/invitations/create-project-invitation.md): Send an email invitation for someone to join a specific project with the given role. The recipient gets an email with an accept link.
- [Cancel Invitation](https://docs.rafftechnologies.com/api-reference/invitations/cancel-invitation.md): Cancel a pending invitation. The accept link in the recipient's email becomes invalid.
- [Raff CLI](https://docs.rafftechnologies.com/reference/cli/introduction.md): Manage Raff resources from your terminal — VMs, volumes, snapshots, backups, VPCs, public IPs, firewalls, SSH keys, API keys, and team & access control. The CLI uses the same public API as the dashboard, with the same role-based authorization model.
- [Installing raff](https://docs.rafftechnologies.com/reference/cli/install.md): Install the raff binary by downloading a release from GitHub or building from source. Single static Go binary; supports macOS, Linux, and Windows.
- [raff configure](https://docs.rafftechnologies.com/reference/cli/configure.md): Authenticate the CLI and set default values. Stores credentials in ~/.raff/config.yaml; supports multiple profiles, env-var overrides, and per-command flag overrides.
- [raff vm](https://docs.rafftechnologies.com/reference/cli/vm.md): Manage Virtual Machines from the CLI — list, get, create, update, delete (incl. bulk-delete), power, reboot, hard-reboot, reinstall, factory-reset, rename, reset-password, resize, resize-disk, save-image, plus IP, firewall, VPC, tags, notes, and networks subcommands.
- [raff kubernetes](https://docs.rafftechnologies.com/reference/cli/kubernetes.md): Manage Kubernetes clusters from the CLI — list, get, create, delete, rename, kubeconfig, nodes, node pools, HA upgrade, version upgrades, and maintenance windows.
- [raff database](https://docs.rafftechnologies.com/reference/cli/database.md): Manage databases from the CLI: create, connect, run queries, browse tables, users, backups, restore, public access, metrics, and logs.
- [raff volume](https://docs.rafftechnologies.com/reference/cli/volume.md): Manage block storage volumes from the CLI — list, get, create, delete, resize, attach, detach. NVMe SSD volumes attach to one VM at a time and live in a specific region.
- [raff snapshot](https://docs.rafftechnologies.com/reference/cli/snapshot.md): Manage VM and volume snapshots from the CLI — list, get, create, rename, restore, delete. Snapshots are point-in-time captures of a VM disk or volume; restoring overwrites the source.
- [raff backup](https://docs.rafftechnologies.com/reference/cli/backup.md): Manage VM backups and recurring backup schedules from the CLI — on-demand backups (create, restore, delete) and schedules (daily/weekly with retention).
- [raff vpc](https://docs.rafftechnologies.com/reference/cli/vpc.md): Manage VPCs from the CLI — list, get, create, update, delete, and fetch CIDR suggestions. Each VPC is a VXLAN-isolated private network for VMs in the same region.
- [raff ip](https://docs.rafftechnologies.com/reference/cli/ip.md): Manage Public IPs from the CLI — list, get, reserve a static IP ($3/mo IPv4, $1/mo IPv6), release, or swap a reserved IP for a different one from the pool.
- [raff security-group](https://docs.rafftechnologies.com/reference/cli/security-group.md): Manage Firewall Groups (security groups in the API) from the CLI — list, list templates, get, create, delete. Customer-facing label is Firewall; the API path is still security-groups.
- [raff ssh-key](https://docs.rafftechnologies.com/reference/cli/ssh-key.md): Manage SSH keys from the CLI — register, rename, and delete public keys used when creating Linux VMs.
- [raff api-key](https://docs.rafftechnologies.com/reference/cli/api-key.md): Manage API keys from the CLI — create, update, regenerate, and revoke. The plaintext secret is returned only once at create or regenerate; copy it immediately.
- [raff project](https://docs.rafftechnologies.com/reference/cli/project.md): Manage projects from the CLI — list, get, create, update, delete. Projects are the container for VMs, volumes, IPs, VPCs, buckets, and access control.
- [raff member](https://docs.rafftechnologies.com/reference/cli/member.md): Manage account-level members from the CLI — invite by email, add an existing user, grant API-key access, update roles or status, remove. For project-scoped membership, see raff project member.
- [raff role](https://docs.rafftechnologies.com/reference/cli/role.md): Manage IAM roles from the CLI — list system + custom roles, create custom roles with a permission set, update, delete. System roles (Owner, Admin, etc.) are immutable.
- [raff permission](https://docs.rafftechnologies.com/reference/cli/permission.md): Browse the IAM permission catalog from the CLI — every permission name available to assign to a role, optionally filtered by scope (account or project).
- [raff invitation](https://docs.rafftechnologies.com/reference/cli/invitation.md): Send and cancel email invitations from the CLI — for account-level access or project-level access. Pending invites show up via list until accepted, expired, or cancelled.
- [raff region](https://docs.rafftechnologies.com/reference/cli/region.md): List Raff datacenter regions from the CLI. Region codes are required when creating VMs, volumes, VPCs, and reserved IPs.
- [raff template](https://docs.rafftechnologies.com/reference/cli/template.md): List OS templates available for VM creation from the CLI. Template UUIDs are required for raff vm create --template-id and raff_vm.template_id.
- [raff pricing](https://docs.rafftechnologies.com/reference/cli/pricing.md): Browse the public pricing catalog from the CLI — VM plans, volume / backup / snapshot per-GB rates, floating IP family rates.
- [Raff Terraform Provider](https://docs.rafftechnologies.com/reference/terraform/introduction.md): Provision and manage Raff resources declaratively with HashiCorp Terraform. 14 resources spanning compute, storage, networking, and IAM, plus 25+ data sources for discovery and pricing.
- [Install the Raff Terraform Provider](https://docs.rafftechnologies.com/reference/terraform/install.md): Install the provider from the Terraform Registry, build from source for local development, or pin a specific version. Works with Terraform 1.0+ and OpenTofu.
- [raff_project](https://docs.rafftechnologies.com/reference/terraform/raff_project.md): Manage Raff projects with Terraform — the access-control container for VMs, volumes, IPs, VPCs, and Object Storage buckets. Required attribute is name; optional are description and default_region.
- [raff_vm](https://docs.rafftechnologies.com/reference/terraform/raff_vm.md): Manage Raff Virtual Machines with Terraform — pick template, plan, region, SSH keys, optional VPC and backup schedule. Required: name, template_id, pricing_id, region. Resizing is in-place via pricing_id change.
- [raff_volume](https://docs.rafftechnologies.com/reference/terraform/raff_volume.md): Manage Raff block storage volumes with Terraform. NVMe SSD volumes, sized in GB, attached to a single VM at a time. Resize is in-place; reattach is in-place.
- [raff_snapshot](https://docs.rafftechnologies.com/reference/terraform/raff_snapshot.md): Capture point-in-time snapshots of VMs or volumes with Terraform. Once taken, the source binding is immutable — only the name can be updated. Restore is imperative; use the CLI.
- [raff_backup](https://docs.rafftechnologies.com/reference/terraform/raff_backup.md): Take an on-demand backup of a Raff VM with Terraform. Async — the resource returns once the backup record exists. For recurring backups, use raff_backup_schedule.
- [raff_backup_schedule](https://docs.rafftechnologies.com/reference/terraform/raff_backup_schedule.md): Recurring backup policy for a Raff VM with Terraform — daily or weekly, with retention. The schedule auto-prunes old backups; never manage them via raff_backup.
- [raff_vpc](https://docs.rafftechnologies.com/reference/terraform/raff_vpc.md): Manage Raff VPCs (Virtual Private Clouds) with Terraform — RFC 1918 / RFC 6598 ranges, /16–/28 prefixes, region-pinned. CIDR is immutable; rename and description update in place.
- [raff_ip](https://docs.rafftechnologies.com/reference/terraform/raff_ip.md): Reserve a Raff floating IP with Terraform — IPv4 or IPv6, region-pinned. The IP is held by the project until the resource is destroyed.
- [raff_security_group](https://docs.rafftechnologies.com/reference/terraform/raff_security_group.md): Manage Raff security groups (firewalls) with Terraform — named inbound/outbound rule sets you attach to VM NICs. Updates replace the entire rule set; reboot required for VMs to pick up new rules.
- [raff_ssh_key](https://docs.rafftechnologies.com/reference/terraform/raff_ssh_key.md): Register an SSH public key on a Raff account with Terraform. The key material is immutable; rename in place. Linux VMs accept these via raff_vm.ssh_keys.
- [raff_api_key](https://docs.rafftechnologies.com/reference/terraform/raff_api_key.md): Create a Raff API key with Terraform. The plaintext secret is returned ONCE on create and stored in the secret attribute (sensitive). Lock down your Terraform state.
- [raff_role](https://docs.rafftechnologies.com/reference/terraform/raff_role.md): Manage custom IAM roles with Terraform. System roles (Owner, Admin, etc.) are immutable; only custom roles can be created. Permissions are diffed as a set.
- [raff_member](https://docs.rafftechnologies.com/reference/terraform/raff_member.md): Manage an account-level Raff member with Terraform — invite by email, add an existing user, or grant API-key access. The three identifiers are mutually exclusive.
- [raff_project_member](https://docs.rafftechnologies.com/reference/terraform/raff_project_member.md): Add an account user or API key to a Raff project with Terraform. Project-scoped roles only. ID is composite — <project_id>/<member_id>.
- [raff_k8s_cluster](https://docs.rafftechnologies.com/reference/terraform/raff_k8s_cluster.md): Manage Raff managed Kubernetes clusters with Terraform — default node pool, HA control plane, add-ons, kubeconfig output.
- [raff_k8s_node_pool](https://docs.rafftechnologies.com/reference/terraform/raff_k8s_node_pool.md): Manage additional Kubernetes node pools with Terraform — node count, autoscaling bounds, labels and taints.
- [raff_database](https://docs.rafftechnologies.com/reference/terraform/raff_database.md): Manage Raff managed databases with Terraform: PostgreSQL, MySQL, Valkey, ClickHouse, and Kafka, with resizing, high availability, VPC, and public access in place.
- [raff_database_user](https://docs.rafftechnologies.com/reference/terraform/raff_database_user.md): Manage users inside a Raff managed database with Terraform, with read-only or read-write access.
- [Catalog data sources](https://docs.rafftechnologies.com/reference/terraform/data-sources.md): Terraform data sources for Raff catalog/lookup endpoints — regions, OS templates, and pricing for VMs, volumes, backups, snapshots, and floating IPs.
- [API Changelog](https://docs.rafftechnologies.com/api-reference/changelog.md): Track all changes to the Raff API
- [CLAUDE](https://docs.rafftechnologies.com/CLAUDE.md)
- [Adding a new resource to the public API](https://docs.rafftechnologies.com/contributing/adding-a-resource.md)
- [PRODUCT_NAME](https://docs.rafftechnologies.com/products/_template.md): PRODUCT_DESCRIPTION
- [CONCEPT_TITLE](https://docs.rafftechnologies.com/products/_template-concept.md): ONE_LINE_CONCEPT_DESCRIPTION
- [DETAILS_PAGE_TITLE](https://docs.rafftechnologies.com/products/_template-details.md): ONE_LINE_DESCRIPTION
- [TASK_TITLE](https://docs.rafftechnologies.com/products/_template-quickstart.md): ONE_LINE_TASK_DESCRIPTION
- [PRODUCT_NAME troubleshooting](https://docs.rafftechnologies.com/products/_template-troubleshooting.md): Common PRODUCT issues and how to recover.
- [Reference](https://docs.rafftechnologies.com/reference/introduction.md): Manage Raff resources programmatically with the REST API, the CLI, or Terraform. The public API is in **Beta** (v1.0.0).

## OpenAPI Specs

- [openapi](/api-reference/openapi.yaml)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.