spin-stack-website-sync · Nov 14, 2026
diff --git a/public/openapi.json b/public/openapi.json
diff --git a/src/assets/shots/snapshots.png b/src/assets/shots/snapshots.png
diff --git a/src/assets/shots/workspace.png b/src/assets/shots/workspace.png
diff --git a/src/assets/shots/workspaces.png b/src/assets/shots/workspaces.png
diff --git a/src/content/docs/reference/api/adminservice.md b/src/content/docs/reference/api/adminservice.md
diff --git a/src/content/docs/reference/api/authservice.md b/src/content/docs/reference/api/authservice.md
@@ -138,7 +138,7 @@ Create API key
 | `scopes` | list of string | e.g., ["workspace:read", "workspace:write"] |
 | `expiresAt` | `Timestamp` |  |
 | `stepUp` | [PasskeyAssertion](/reference/api/types/#passkeyassertion) | An assertion of a passkey of the caller's over a PASSKEY_PURPOSE_CREATE_EXEC_KEY challenge naming the key, asked for a key with workspace:exec alone: that key is a shell, which a session alone does not open. |
-| `teamId` | string | What it reaches and what its tree may hold: as APIKey's. Asked by a key holding keys:delegate, it is that key's child, and holds no more than it (delegation.Within). |
+| `teamId` | string | What it reaches and what its tree may have running at once: as APIKey's, where what is counted is said. Asked by a key holding keys:delegate, it is that key's child, and holds no more than it (delegation.Within). |
 | `projectIds` | list of string |  |
 | `maxWorkspaces` | integer or null (int32) |  |
 | `maxCores` | integer or null (int32) |  |

diff --git a/src/content/docs/reference/api/execservice.md b/src/content/docs/reference/api/execservice.md
@@ -4,7 +4,7 @@ description: "spin.v1.ExecService: each procedure, its request and its response.
 source: "spin:internal/controlplane/apidocs/spin.v1.openapi.json"
 editUrl: false
 sidebar:
-  order: 4
+  order: 6
 ---
 
 <!-- Generated by tools/refgen from spin:internal/controlplane/apidocs/spin.v1.openapi.json. Edit the source, not this file. -->

diff --git a/src/content/docs/reference/api/forgeservice.md b/src/content/docs/reference/api/forgeservice.md
@@ -4,7 +4,7 @@ description: "spin.v1.ForgeService: each procedure, its request and its response
 source: "spin:internal/controlplane/apidocs/spin.v1.openapi.json"
 editUrl: false
 sidebar:
-  order: 5
+  order: 7
 ---
 
 <!-- Generated by tools/refgen from spin:internal/controlplane/apidocs/spin.v1.openapi.json. Edit the source, not this file. -->

diff --git a/src/content/docs/reference/api/hostservice.md b/src/content/docs/reference/api/hostservice.md
@@ -4,7 +4,7 @@ description: "spin.v1.HostService: each procedure, its request and its response.
 source: "spin:internal/controlplane/apidocs/spin.v1.openapi.json"
 editUrl: false
 sidebar:
-  order: 6
+  order: 8
 ---
 
 <!-- Generated by tools/refgen from spin:internal/controlplane/apidocs/spin.v1.openapi.json. Edit the source, not this file. -->
@@ -88,6 +88,7 @@ Get host details (admin only)
 | Field | Type | What it is |
 |---|---|---|
 | `host` | [Host](/reference/api/types/#host) |  |
+| `departure` | [HostDeparture](/reference/api/types/#hostdeparture) | What taking the host out would do to each workspace on it, as the server would do it: asked of one host, because it reads every workspace there. |
 
 ## GetHostPolicy
 
@@ -133,13 +134,15 @@ List all hosts (admin only)
 
 `POST /spin.v1.HostService/RemoveHost`
 
-Takes a machine of an autoscaling group out of the fleet (admin only), as Host.removal says: given back to its group (GIVE_BACK), or forgotten (FORGET). A host whose removal is REVOKE is refused: RevokeRunner is its removal.
+Takes a machine of an autoscaling group out of the fleet (admin only), as Host.removal says: given back to its group (GIVE_BACK), or forgotten (FORGET). A host whose removal is REVOKE is refused: RevokeRunner is its removal. Asked with taken, the host leaves as one believed compromised: its credentials revoked and every team's disk whose key it was given marked for re-keying (ListRekeys), as RevokeRunner does, and its machine given back all the same.
 
 **Request**
 
 | Field | Type | What it is |
 |---|---|---|
 | `id` | string |  |
+| `taken` | boolean | The host is believed taken - compromised - rather than only no longer wanted. Its credentials are deleted and its stream cut before its group is asked anything, and every team's disk whose key it was given is marked for re-keying. A routine removal - a scale-in, a machine reclaimed - leaves it unset, and marks none. |
+| `leaveWorkspaces` | boolean | Remove a taken host although it is the only home of workspaces' disks. Refused without it, naming them; with it each runs again only once it is recovered onto another host (RecoverWorkspace), which gives up what this host had not published. Only with taken: a routine removal loses no disk. |
 
 **Response**
 
@@ -148,6 +151,8 @@ Takes a machine of an autoscaling group out of the fleet (admin only), as Host.r
 | `removal` | [HostRemoval](/reference/api/types/#hostremoval) | removal is what was done: GIVE_BACK or FORGET. |
 | `givenBack` | boolean | given_back is the machine terminated and its group asked for one less; false where the group no longer had it. |
 | `forgotten` | boolean | forgotten is the host's row gone. A host given back while connected is not: it drains under its termination hook, and its row goes when its stream ends. |
+| `markedForRekey` | integer (int32) | marked_for_rekey is how many teams' disks were marked for re-keying: those whose key a host removed as taken was given. Zero for a routine removal. |
+| `kept` | string | kept is why the row was not forgotten, where it was not and should have been: the workspace whose disk is only there, or the volume that would not leave it and whose that is. Empty when forgotten, and for a host given back while connected. |
 
 ## SetHostPolicy
 

diff --git a/src/content/docs/reference/api/hostshellservice.md b/src/content/docs/reference/api/hostshellservice.md
@@ -4,7 +4,7 @@ description: "spin.v1.HostShellService: each procedure, its request and its resp
 source: "spin:internal/controlplane/apidocs/spin.v1.openapi.json"
 editUrl: false
 sidebar:
-  order: 7
+  order: 9
 ---
 
 <!-- Generated by tools/refgen from spin:internal/controlplane/apidocs/spin.v1.openapi.json. Edit the source, not this file. -->

diff --git a/src/content/docs/reference/api/index.md b/src/content/docs/reference/api/index.md
@@ -22,18 +22,18 @@ curl -s https://app.example.com/spin.v1.WorkspaceService/ListWorkspaces \
 
 - [PasskeyService](/reference/api/passkeyservice/): PasskeyService is a person's passkeys: WebAuthn credentials of their account, under the. installation's base domain (internal/passkey). A passkey signs a challenge the control plane. issued, never a document: what turns a session into a key that logs in (SSHKeyService.AddSSHKey) is an assertion of one, so a session alone - stolen, or an agent's - is no shell.
 - [AuthService](/reference/api/authservice/): 16 procedures
+- [WorkspaceService](/reference/api/workspaceservice/): 57 procedures
+- [SettingsService](/reference/api/settingsservice/): 6 procedures
 - [AdminService](/reference/api/adminservice/): AdminService manages installation-wide settings, user management, and resource presets. Only accessible to instance administrators.
 - [ExecService](/reference/api/execservice/): ExecService runs commands and moves files in a running workspace, as its root, for a caller who. is no terminal: a program or an agent holding a key with workspace:exec. The control plane logs. in over the same session a terminal's goes over (a host's stream from the guest's vsock, met at. the control plane rather than at the relay) with a certificate of its own for five minutes, and. every call is recorded with who made it and on which credential (audit: workspace_exec).
 - [ForgeService](/reference/api/forgeservice/): ForgeService is a person's account on a forge, connected through the installation's GitHub App. (spin#758): the control plane keeps the token, lists the person's repositories with it, and a. host's egress proxy sets it on their workspaces' brokered requests. No workspace holds it.
 - [HostService](/reference/api/hostservice/): 9 procedures
 - [HostShellService](/reference/api/hostshellservice/): HostShellService is a root shell on a host, asked for by an administrator, for a while, with a. reason (spin#712). The host is emptied of its workspaces first - unless the request is an. incident's, which says so - and retired after, whatever happened in it: once a person has had root. on a host it runs no workspace again. Every session is recorded by the control plane, which. carries it; the terminal itself is a WebSocket at /api/host-shells/&lt;id>/terminal. (internal/hostshell).
 - [LogService](/reference/api/logservice/): LogService is what the installation logged, as its store of logs and traces keeps it. (internal/logstore). Every search is confined by the control plane to what the caller may see; what the caller types is searched inside that and cannot widen it.
-- [ProjectService](/reference/api/projectservice/): ProjectService is the installation's projects (spin#720): a repository and the shape of the. workspace that opens it (CreateWorkspaceRequest.project_id). Anybody signed in makes one where. the installation lets everybody (InstallationSettings.project_creation), and is its first admin. A project is seen by everybody while it is shared with everyone, and otherwise by its admins and. whom it is shared with; the instance's admins see and administer every one. Whoever sees one. opens workspaces from it, in a team of theirs.
+- [ProjectService](/reference/api/projectservice/): ProjectService is the installation's projects (spin#720): a repository and the shape of the. workspace that opens it (CreateWorkspaceRequest.project_id). Anybody signed in makes one where. the installation lets everybody (the setting project_creation), and is its first admin. A project is seen by everybody while it is shared with everyone, and otherwise by its admins and. whom it is shared with; the instance's admins see and administer every one. Whoever sees one. opens workspaces from it, in a team of theirs.
 - [RunnerTokenService](/reference/api/runnertokenservice/): 4 procedures
-- [WorkspaceService](/reference/api/workspaceservice/): 53 procedures
-- [SettingsService](/reference/api/settingsservice/): 6 procedures
 - [SetupService](/reference/api/setupservice/): SetupService handles initial platform setup and admin bootstrap. Most endpoints require admin authentication, except GetSetupStatus and PasswordLogin.
 - [ShareService](/reference/api/shareservice/): ShareService manages snapshot sharing. Snapshots can be shared with specific users or made public. Users can create new workspaces from shared snapshots.
 - [SSHKeyService](/reference/api/sshkeyservice/): SSHKeyService is the keys that log in as the person, to every workspace that lets them in: a key. of their own, for good, or a browser's or a CLI's enrolled for twelve hours. Each is added with an. assertion of a passkey of theirs (PasskeyService), so a session alone adds none.
-- [TeamService](/reference/api/teamservice/): 18 procedures
+- [TeamService](/reference/api/teamservice/): 19 procedures
 - [Types](/reference/api/types/): every message and enum the procedures name
diff --git a/src/content/docs/reference/api/logservice.md b/src/content/docs/reference/api/logservice.md
@@ -4,7 +4,7 @@ description: "spin.v1.LogService: each procedure, its request and its response."
 source: "spin:internal/controlplane/apidocs/spin.v1.openapi.json"
 editUrl: false
 sidebar:
-  order: 8
+  order: 10
 ---
 
 <!-- Generated by tools/refgen from spin:internal/controlplane/apidocs/spin.v1.openapi.json. Edit the source, not this file. -->
@@ -91,6 +91,24 @@ HistogramWorkspaceLogs is how many of those records each interval of the window
 |---|---|---|
 | `intervals` | list of [LogInterval](/reference/api/types/#loginterval) |  |
 
+## KeptTraces
+
+`POST /spin.v1.LogService/KeptTraces`
+
+KeptTraces is which of the trace ids a page shows the store holds: those, and only those, are links. A trace id is written where its span began, before the collector decides whether to keep the trace, and it stays after the store's retention has deleted it.
+
+**Request**
+
+| Field | Type | What it is |
+|---|---|---|
+| `traceIds` | list of string | Hex, as a log record carries them: at most 1000, a page's. |
+
+**Response**
+
+| Field | Type | What it is |
+|---|---|---|
+| `traceIds` | list of string | Those of the request's the store holds, each once. |
+
 ## ListLogIndexes
 
 `POST /spin.v1.LogService/ListLogIndexes`

diff --git a/src/content/docs/reference/api/projectservice.md b/src/content/docs/reference/api/projectservice.md
@@ -4,12 +4,12 @@ description: "spin.v1.ProjectService: each procedure, its request and its respon
 source: "spin:internal/controlplane/apidocs/spin.v1.openapi.json"
 editUrl: false
 sidebar:
-  order: 9
+  order: 11
 ---
 
 <!-- Generated by tools/refgen from spin:internal/controlplane/apidocs/spin.v1.openapi.json. Edit the source, not this file. -->
 
-ProjectService is the installation's projects (spin#720): a repository and the shape of the. workspace that opens it (CreateWorkspaceRequest.project_id). Anybody signed in makes one where. the installation lets everybody (InstallationSettings.project_creation), and is its first admin. A project is seen by everybody while it is shared with everyone, and otherwise by its admins and. whom it is shared with; the instance's admins see and administer every one. Whoever sees one. opens workspaces from it, in a team of theirs.
+ProjectService is the installation's projects (spin#720): a repository and the shape of the. workspace that opens it (CreateWorkspaceRequest.project_id). Anybody signed in makes one where. the installation lets everybody (the setting project_creation), and is its first admin. A project is seen by everybody while it is shared with everyone, and otherwise by its admins and. whom it is shared with; the instance's admins see and administer every one. Whoever sees one. opens workspaces from it, in a team of theirs.
 
 ## CreateProject
 
@@ -87,6 +87,28 @@ One of them whole, with what its build's create tasks wrote, to whoever sees the
 |---|---|---|
 | `project` | [Project](/reference/api/types/#project) |  |
 
+## GetProjectCosts
+
+`POST /spin.v1.ProjectService/GetProjectCosts`
+
+What a project cost in the month in progress, to its admins and nobody else, as ListProjectWorkspaces: everybody's workspaces of it summed, its prebuilds' builds included, and a month of what its prebuilds keep. A sum, never by workspace: one workspace's cost says how much its owner works, which a project's admin who is not their team's is not told. Read from the bill as the installation last read it, never from the cloud.
+
+**Request**
+
+| Field | Type | What it is |
+|---|---|---|
+| `projectId` | string |  |
+
+**Response**
+
+| Field | Type | What it is |
+|---|---|---|
+| `month` | `Timestamp` | The month in progress: its first instant, UTC. |
+| `readAt` | `Timestamp` | When the bill was last read; unset where it never was - an installation with no bill scope - and then nothing below is known and nothing is to be drawn. |
+| `currency` | string | ISO 4217; every amount here is in millionths of it. |
+| `workspaces` | [CostShare](/reference/api/types/#costshare) | Its workspaces' shares summed, deleted ones and its prebuilds' builds included: a workspace is the project's it opened, whoever's it was. |
+| `prebuilds` | [PrebuildsKept](/reference/api/types/#prebuildskept) |  |
+
 ## ListPrebuilds
 
 `POST /spin.v1.ProjectService/ListPrebuilds`

diff --git a/src/content/docs/reference/api/runnertokenservice.md b/src/content/docs/reference/api/runnertokenservice.md
@@ -4,7 +4,7 @@ description: "spin.v1.RunnerTokenService: each procedure, its request and its re
 source: "spin:internal/controlplane/apidocs/spin.v1.openapi.json"
 editUrl: false
 sidebar:
-  order: 10
+  order: 12
 ---
 
 <!-- Generated by tools/refgen from spin:internal/controlplane/apidocs/spin.v1.openapi.json. Edit the source, not this file. -->

diff --git a/src/content/docs/reference/api/settingsservice.md b/src/content/docs/reference/api/settingsservice.md
@@ -4,7 +4,7 @@ description: "spin.v1.SettingsService: each procedure, its request and its respo
 source: "spin:internal/controlplane/apidocs/spin.v1.openapi.json"
 editUrl: false
 sidebar:
-  order: 12
+  order: 4
 ---
 
 <!-- Generated by tools/refgen from spin:internal/controlplane/apidocs/spin.v1.openapi.json. Edit the source, not this file. -->
@@ -13,7 +13,7 @@ sidebar:
 
 `POST /spin.v1.SettingsService/GetNotificationPreferences`
 
-Which of those the caller is emailed about.
+Which of those the caller is emailed about, and for an administrator which of the installation's events besides.
 
 **Request**
 
@@ -23,7 +23,7 @@ No fields: `{}`.
 
 | Field | Type | What it is |
 |---|---|---|
-| `preferences` | list of [NotificationPreference](/reference/api/types/#notificationpreference) | One per event a person may be told of, in the order they are shown. |
+| `preferences` | list of [NotificationPreference](/reference/api/types/#notificationpreference) | One per event a person may be told of, in the order they are shown: an administrator's include the installation's. |
 | `emailConfigured` | boolean |  |
 
 ## GetUserSettings

diff --git a/src/content/docs/reference/api/teamservice.md b/src/content/docs/reference/api/teamservice.md
@@ -153,6 +153,28 @@ Get team by ID or path
 | `team` | [Team](/reference/api/types/#team) |  |
 | `currentUserRole` | [TeamRole](/reference/api/types/#teamrole) | Role of the requesting user in this team |
 
+## GetTeamCosts
+
+`POST /spin.v1.TeamService/GetTeamCosts`
+
+What the team's workspaces cost in the month in progress, each and summed, for the team's admins: a member reads their own workspace's (WorkspaceService.GetWorkspaceCost) and nobody else's. A workspace is the team's whose it was on the last day it cost anything; a team below this one is not counted in it.
+
+**Request**
+
+| Field | Type | What it is |
+|---|---|---|
+| `teamId` | string |  |
+
+**Response**
+
+| Field | Type | What it is |
+|---|---|---|
+| `month` | `Timestamp` | The month in progress: its first instant, UTC. |
+| `readAt` | `Timestamp` | When the bill was last read; unset where it never was - an installation with no bill scope - and then nothing below is known and nothing is to be drawn. |
+| `currency` | string | ISO 4217; every amount here is in millionths of it. |
+| `total` | [CostShare](/reference/api/types/#costshare) | Its workspaces, summed. |
+| `workspaces` | list of [TeamWorkspaceCost](/reference/api/types/#teamworkspacecost) | Costliest first. |
+
 ## ListIdentityProviders
 
 `POST /spin.v1.TeamService/ListIdentityProviders`
@@ -278,7 +300,7 @@ A team's secrets: what a brokered network rule has the host's egress proxy add t
 | `name` | string | Lower-case letters, digits and dashes, starting with a letter; what a rule names it by. |
 | `value` | string | At most 8 KiB of visible ASCII. Replaces what the name held. |
 | `hosts` | list of string | The exact names the secret may be sent to, 1 to 16: a brokered rule that injects it and names any other host is refused it. |
-| `ref` | string | In place of value: the ARN of a Secrets Manager secret or a Parameter Store parameter the team keeps it in, read as the team (InstallationSettings.team_secrets_role) now and whenever a host asks for it. |
+| `ref` | string | In place of value: the ARN of a Secrets Manager secret or a Parameter Store parameter the team keeps it in, read as the team (the setting team_secrets_role) now and whenever a host asks for it. |
 
 **Response**