Set read-only filesystem

Configure a read-only root filesystem for the service’s next deployment.

PATCH/api/services/{id}/securityHTTPS

Request & response examples

Request exampleServer-side

curl --fail-with-body --request PATCH \
  'https://app.helicarrier.xyz/api/services/YOUR_ID/security' \
  -H "Authorization: Bearer $HELI_API_KEY" \
  -H 'Content-Type: application/json' \
  --data '{
  "readonlyRootfs": true
}'

const response = await fetch(
  "https://app.helicarrier.xyz/api/services/YOUR_ID/security",
  {
    method: "PATCH",
    headers: {
      Authorization: `Bearer ${process.env.HELI_API_KEY}`,
      "Content-Type": "application/json"
    },
    body: JSON.stringify({
      "readonlyRootfs": true
    })
  }
);
const data = await response.json();
if (!response.ok) {
  throw new Error(`HTTP ${response.status}: ${data.error}`);
}
// Inspect data; avoid logging secret responses.

import os
import requests

response = requests.request(
    "PATCH",
    "https://app.helicarrier.xyz/api/services/YOUR_ID/security",
    headers={
        "Authorization": f"Bearer {os.environ['HELI_API_KEY']}"
    },
    json={
      "readonlyRootfs": True
    },
    timeout=30,
)
response.raise_for_status()
data = response.json()
# Inspect data; avoid logging secret responses.

Response example200

{
  "readonlyRootfs": true,
  "appliesAt": "next deploy"
}

Illustrative values · selected fields

Response details OpenAPI

Authorization

An account key with access, or a project/service key with settings:write. The resource must be within the key’s project, service, and environment scope.

Authorization: Bearer <key>Key setup

Path parameters

idstringrequired

Service id.

Request bodyapplication/json

readonlyRootfsbooleanrequired

true to mount the root filesystem read-only, false to restore a writable one.

Response 200

Returns the saved filesystem setting and when it takes effect. Redeploy the service to apply it.

Examples show selected response fields with illustrative values. Your response can contain additional fields.

readonlyRootfsboolean

Whether the root filesystem is read-only.

appliesAtstring

When the saved setting applies.

Errors

400

Invalid parameters. Check the required fields, types, and resource configuration.

401

The API key is missing, invalid, or revoked.

403

The caller or key scope does not permit this operation.

500

The operation could not be completed. Check resource state before retrying a write.

Error handling and safe retries

ALSO AVAILABLE VIA MCP

`set_readonly_filesystem`

Required MCP arguments: id, readonlyRootfs. Send path, query, and body fields together as tool arguments.

Connect your agent

curl --fail-with-body --request PATCH \ 'https://app.helicarrier.xyz/api/services/YOUR_ID/security' \ -H "Authorization: Bearer $HELI_API_KEY" \ -H 'Content-Type: application/json' \ --data '{ "readonlyRootfs": true }'

import os import requests response = requests.request( "PATCH", "https://app.helicarrier.xyz/api/services/YOUR_ID/security", headers={ "Authorization": f"Bearer {os.environ['HELI_API_KEY']}" }, json={ "readonlyRootfs": True }, timeout=30, ) response.raise_for_status() data = response.json() # Inspect data; avoid logging secret responses.