compute
POST /v1/compute/servers/{serverId}/snapshots/{snapshotId}
Roll a server back to a snapshot.
Authentication
Send an API key as a bearer token. The key must carry the sites.view permission; a key without it is refused with 403, not 404.
This endpoint takes no organisation id. Your key already identifies the organisation it belongs to, and the response is scoped to it.
Try it
Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.
curl -X POST https://api.zinndigital.com/v1/compute/servers/{serverId}/snapshots/{snapshotId} \
-H "Authorization: Bearer zdk_live_…"Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console
Details
⛔⛔ The most destructive operation on this API, and more so than rebuildComputeServer. A rebuild gives the customer the clean machine they asked for; a restore overwrites the live disk with an older one. Everything written since the snapshot is gone, the current state is not itself snapshotted first, and there is no undo at the provider or here. Refused on a snapshot that is not ready — an image still being written restores an incomplete disk, and the provider will happily start it. Requires sites.view and sites.delete, the same key as deleting a website, because the blast radius is the same: data the customer cannot get back.
Parameters
| Name | Type | Required | What it is |
|---|---|---|---|
serverId (path) | Uuid | Yes | The server's id, as listComputeServers reports it. Ours (UUIDv7), minted when the order row was written — never the provider's own identifier for the machine. |
snapshotId (path) | string | Yes | The provider's id for the image, as the listing reported it — not one of ours. The engine re-checks that the snapshot was created from this machine before touching it, because… |
Response
| Name | Type | Required | What it is |
|---|---|---|---|
id | Uuid | Yes | Ours, and also the provisioning workflow's id and the machine's name at the provider — which is what makes the whole purchase path idempotent. |
name | string | Yes | What the customer called it. ⛔ At the provider a machine's name is its row id; confusing the two is a cross-tenant defect, so this is the customer's string and nothing else. |
deploy_target | string | Yes | Which compute range the machine belongs to. |
plan_code | string | Yes | The tier it was bought on, or "" when it was ordered by size alone. |
provider | string | Yes | Our provider id. |
spec | string | Yes | The machine size it currently runs. |
zone | string | Yes | The data centre it runs in. |
status | string<pending, provisioning, active, failed, suspended, terminated, resizing, terminating> | Yes | How far the order got — ours, and a different fact from power_state. pending is a row with nothing bought and nothing charged; failed is the state whose message is the… |
message | string | Yes | Why the order failed, in a sentence the customer reads. Blank unless failed. |
vendor_status | string | Yes | The provider's own word, verbatim and unrounded. Staff-facing detail; a customer client renders status and never this. |
power_state | string<unknown, on, off, starting, stopping, rebooting> | Yes | What the machine is doing right now. ⛔ Six values, not two, and the four extra ones are the point: a machine mid-transition is not "on". unknown is the honest answer when… |
addresses | string[] | Yes | Public addresses if the provider states them. Empty means not stated, never "none" — a machine rendered as having no address reads as broken. |
optimisation | string | Yes | The stack optimisation profile it was built with, or "" for none. |
term_months | integer | Yes | The term it was bought on, or null when the provider states none. |
renews_at | string | Yes | ⛔ Always null today, and honestly so: the provider publishes no renewal date, and one computed from the order plus the term would be our arithmetic rendered as the provider's… |
created_at | string | Yes | When the row was created, or "" when not stated. |
terminated_at | object | No | When the machine was terminated; null while it exists. Owner decision D11 (2026-10-06): a terminated server leaves the servers list and the last five from the past 7 days appear… |
operable | boolean | Yes | Whether the customer may act on this machine — power, resize, renew, rebuild. ⛔ Read rather than re-derived from status: the engine refuses every one of those on anything but… |
image | string | Yes | The provider image the machine was built from. Blank on the resold range, which installs one managed image and offers no choice. |
suspended | boolean | Yes | ⛔⛔ Whether WE stopped it, which is not the same fact as power_state. A stopped machine is the customer's own choice and they may start it again; a suspended one is ours and… |
suspension_reason | string | Yes | Why, verbatim, so the customer reads the same sentence support wrote. Blank when the machine is in good standing. |
capabilities | string[] | Yes | ⭐⭐ What this machine's provider can actually do — capability tokens such as compute:snapshots, compute:console, compute:firewall, compute:backups_manage and… |
billing | ComputeServerBilling | Yes | How a machine is paid for (W43-47, docs/687). term machines are charged ahead by a per-machine subscription. metered machines are charged per started hour from the account… |
login_user | string | Yes | The account to sign in as (W43-49, docs/689). admin — key-only, passwordless sudo, root login refused — on a Zinn® Cloud machine built under the access model; root on one… |
blueprint | string<, docker, k3s, k3s_argocd> | Yes | The software stack installed at first boot. Blank for none. |
cluster_id | string | Yes | The cluster this machine is a node of, or blank. |
cluster_role | string<, server, agent> | Yes | — |
Errors this endpoint can return
401 · 403 · 404 · 422 · 429 · 503