Everything Lath can be asked to do, and where each can be asked.
This is not a reference written about the API. It is the registry itself — the same module the REST layer routes from, the MCP server advertises as tools, and the dashboard derives its controls from.
There is one source. If an operation gains a capability or loses a surface, this page changes because the registry changed, not because somebody remembered to update a page. A build check fails if any screen names an operation instead of importing it.
account.createworkspaceno mode
Creates the first project inside a workspace that already exists. The person, their session, the workspace and the owner membership all precede it: an operation cannot create the thing it is scoped to, and operations.md §6c is why.
no reversal
projectstringthe id of the project to create. GENERATED BY THE DOOR, never accepted from a client — this operation declares no transport surface, so there is no client that could send one
not available on REST, MCP, CLI
workspace.renameworkspaceno mode
Changes the workspace's display name, its slug, or both. THE OLD SLUG IS RELEASED IMMEDIATELY and may be taken by anyone — safe today because no URL, read or route contains a slug. operations.md §6d records what changes when one does.
no reversal
namestring?the display name; omitted leaves it alone
slugstring?lowercase, digits and single hyphens; unique across all workspaces
RESTPATCH /v1/workspace
CLIlath workspace rename [--name] [--slug]
DashboardSettings → Workspace
not available on MCP
project.renameprojectno mode
Changes the project's display name, its slug, or both. The slug is unique within the workspace rather than globally, and the old one is released immediately — see workspace.rename.
no reversal
namestring?the display name; omitted leaves it alone
slugstring?lowercase, digits and single hyphens; unique within the workspace
RESTPATCH /v1/project
CLIlath project rename [--name] [--slug]
DashboardSettings → Project
not available on MCP
invite.sendworkspaceno mode
Invites an email address to join this workspace at a role, and sends them a single-use link that expires in seven days. The address may have no Lath account; the account is resolved when the invitation is accepted, not when it is sent.
no reversal
emailstringthe address to invite. Normalised lowercase; plus-addressing is kept, because a+lath@x is a distinct address somebody chose
rolestringadmin | developer | billing | readonly. NOT owner — transferring ownership is its own act with its own confirmation
RESTPOST /v1/invites
CLIlath invites send <email> --role <role>
DashboardTeam
not available on MCP
access.grantprojectlive / test
Adds to the customer's entitlement for one feature. The grant is a ladder step above plan, so the effective value becomes plan + grant. It does not replace the plan value.
undo
customerstring
featurestring
valuenumberADDED to the plan value, not a replacement for it
expires_attimestamp?when omitted the grant does not expire
reasonstring?recorded on the operations row and shown in Activity
RESTPOST /v1/access/grants
MCPlath.access.grant
CLIlath access grant <customer> <feature> <value> [--expires-at] [--reason]
DashboardCustomer detail → Grant access
access.revokeprojectlive / test
Removes the grant immediately. The customer's effective value falls back to plan plus any other grants.
undo
grantstring
reasonstring?recorded on the operations row and shown in Activity
RESTDELETE /v1/access/grants/:grant
MCPlath.access.revoke
CLIlath access revoke <grant>
DashboardAccess → Grants → Revoke
subscription.cancelprojectlive / test
Stops the subscription renewing. Entitlement continues until the period ends unless cancelled immediately, and no refund is issued either way — refund is a separate operation.
undo
subscriptionstring
at_period_endboolean?true keeps access until the period ends; false ends entitlement now
reasonstring?recorded on the operations row and shown in Activity
RESTPOST /v1/subscriptions/:subscription/cancel
MCPlath.subscription.cancel
CLIlath subscription cancel <subscription> [--at-period-end] [--reason]
DashboardRevenue → Subscriptions → Cancel
payment.refundprojectlive / test
Returns money. It does NOT change entitlement — access and payment are separate ladders, and a refunded customer keeps access until a grant or subscription change removes it.
no reversal
transactionstring
amountnumber?omit for a full refund; partial refunds are allowed
RESTPOST /v1/payments/:transaction/refund
MCPlath.payment.refund
CLIlath payment refund <transaction> [--amount]
DashboardRevenue → Transactions → Refund
hosting.deployenvironmentno mode
Builds and deploys the commit to the service, replacing what is serving once verification passes. Traffic does not move until it does.
retry · replay · cancel
servicestring
commitstring
RESTPOST /v1/hosting/deployments
MCPlath.hosting.deploy
CLIlath deploy <service> --commit
DashboardHosting → Deploy
database.migration.runenvironmentno mode
Runs the migration against the environment's database, taking a recovery point first. There is no inverse: rolling back is a restore to that point, not an undo.
retry · restore
migrationstringmust not already be applied in this environment; re-running is refused, not repeated
recovery_pointstringthe backup taken before the run; restore: true is a capability nothing provides without it
RESTPOST /v1/database/migrations/:migration/run
MCPlath.database.migration.run
CLIlath db migrate <migration> --recovery-point
DashboardDatabase → Migrations → Run
domain.record.updateprojectno mode
Replaces the record's value in the zone. The zone is project-scoped, so the change applies to every environment bound to this domain.
retry
domainstring
recordstringthe DNS record being replaced
valuestringthe new value; replaces the record's contents entirely
RESTPATCH /v1/domains/:domain/records/:record
MCPlath.domain.record.update
CLIlath domain record update <domain> <record> <value>
DashboardDomains → DNS → Edit
customer.disableprojectlive / test
Denies all entitlement for the customer immediately. Billing is unaffected — a disabled customer with an active subscription keeps being charged, which is a condition Overview surfaces deliberately.
undo
customerstring
reasonstring?recorded on the operations row; not shown to the customer
RESTPOST /v1/customers/:customer/disable
MCPlath.customer.disable
CLIlath customer disable <customer> [--reason]
DashboardCustomer detail → Disable
email.resendprojectlive / test
Sends the same message again to the same recipient. It does not re-render the template, so the content is what was originally sent.
retry · replay
RESTPOST /v1/email/messages/:message/resend
CLIlath email resend <message>
DashboardEmail → Messages → Resend
not available on MCP
hosting.rollbackenvironmentno mode
Deploys a previous build again. It is a new deployment with its own operations row, never a mutation of the deployment history.
retry
RESTPOST /v1/hosting/deployments/:deployment/rollback
MCPlath.hosting.rollback
CLIlath rollback <deployment>
DashboardHosting → Deployments → Roll back
webhook.endpoint.createenvironmentlive / test
Registers a URL to receive this environment's events and mints its first signing secret. THE SECRET IS RETURNED ONCE AND NEVER AGAIN — no read, no screen and no later call can show it, and the operations row does not carry it. The endpoint is bound to the environment the caller named; an endpoint covering every environment in a project is a shape the schema allows and no operation creates.
no reversal
urlstringhttps, with no credentials and no fragment. A loopback or private address is refused in every mode: a delivery to one leaves and arrives on Lath own network, and the delivery status code is readable by the customer
eventsstring[]the declared event names to subscribe to. An undeclared name is refused rather than stored — a subscription that can never match receives nothing and never says so
RESTPOST /v1/webhooks/endpoints
MCPlath.webhook.endpoint.create
CLIlath webhooks endpoint create <url> --events
DashboardSettings → Webhooks → Add endpoint
webhook.endpoint.rotate_secretenvironmentlive / test
Issues a new signing secret and marks the current one retiring. BOTH SIGN EVERY DELIVERY FOR 24 HOURS, so a receiver can move at its own pace and nothing breaks at the moment of rotation; the old one stops signing when that window closes, by comparison at signing time rather than by a scheduled job. Rotating again inside an open window is refused — receivers are told to expect two signatures, not three. The new secret is returned once and never again.
no reversal
endpointstringthe endpoint whose secret to rotate. It must be in the caller project, mode AND environment — the last of those is what stops a key scoped to one environment from breaking another receiver
RESTPOST /v1/webhooks/endpoints/:endpoint/rotate_secret
MCPlath.webhook.endpoint.rotate_secret
CLIlath webhooks endpoint rotate-secret <endpoint>
DashboardSettings → Webhooks → Rotate signing secret
An operation that is not exposed on a surface says so, rather than simply not appearing there. A gap you can see is a gap someone can ask about; a gap that is quietly absent is one that never gets closed.
The nine services Lath provisions, and whether each one is reachable as an agent tool today. Derived from the registry above, not written alongside it — a service with no operation registered says so.
Domains and DNSlath.domain.record.update
Mailboxesno operation yet
Hostinglath.hosting.deploy
Postgreslath.database.migration.run
Authenticationno operation yet
Paymentslath.subscription.cancel
Transactional emailregistered · no agent surface yet
Analyticsno operation yet
Error monitoringno operation yet