App API

Get App information

Returns application name and version.

curl http://drydock:3000/api/v1/app

{
  "name":"drydock",
  "version":"1.7.0-rc.16"
}

Get server configuration

Returns the server configuration, webhook status, and legacy input compatibility summary.

curl http://drydock:3000/api/v1/server

{
  "configuration": {
    "port": 3000,
    "feature": { "delete": false },
    "webhook": { "enabled": true }
  },
  "compatibility": {
    "legacyInputs": {}
  }
}

Get security runtime status

Returns backend, provider, scanner-asset, Cosign, and SBOM-generator status. Command mode checks local binaries; Docker/remote modes inspect digest-pinned worker assets.

curl http://drydock:3000/api/v1/server/security/runtime

{
  "checkedAt": "2026-03-18T19:33:00.000Z",
  "ready": true,
  "backend": "docker",
  "availabilityPolicy": "block",
  "gate": { "mode": "on", "allowNoWorse": true },
  "scanner": {
    "enabled": true,
    "command": "aquasec/trivy@sha256:…",
    "commandAvailable": true,
    "status": "ready",
    "message": "trivy scanner is ready via docker",
    "scanner": "trivy",
    "server": ""
  },
  "signature": {
    "enabled": false,
    "command": "",
    "commandAvailable": null,
    "status": "disabled",
    "message": "Signature verification is disabled"
  },
  "sbom": {
    "enabled": true,
    "formats": ["spdx-json", "cyclonedx-json"],
    "generator": "trivy"
  },
  "providers": [{ "provider": "trivy", "role": "scanner", "status": "ready" }],
  "assets": [{ "provider": "trivy", "state": "ready", "resolvedDigest": "sha256:…" }],
  "requirements": []
}

Response fields

Returns 200 on success, or 500 if the runtime check fails.

Pull or warm scanner assets

Docker/remote backends expose an audited lifecycle action:

curl -X POST http://drydock:3000/api/v1/server/security/assets/grype/pull
curl -X POST http://drydock:3000/api/v1/server/security/assets/grype/warm

Providers are trivy, grype, and syft; operations are pull and warm. The response is the resulting asset status. Invalid combinations return 400, while runtime/pull/warm failures return 503 without exposing credentials.

Download diagnostic debug dump

Downloads a comprehensive, redacted diagnostic dump of the running drydock instance as a JSON file. Useful for troubleshooting and support requests.

The dump includes runtime metadata, component state (watchers, registries, triggers, agents, containers), Docker API diagnostics, MQTT Home Assistant sensor definitions, recent Docker events, store statistics, and DD_* environment variable names. Store statistics include document counts and UTF-8 serialized byte attribution for the whole LokiJS store and each collection, making unexpected persistence growth traceable without exposing raw store contents.

Redaction works on the key name, and the exact rule matters — a key that falls outside it is returned verbatim:

• A value is redacted when its key contains password, passwd, secret, token, credential, hash, apikey, accesskey, privatekey, clientkey, or signingkey, ignoring case and word separators. This is what covers compound names such as CLIENTSECRET, BOTTOKEN and SECRETACCESSKEY.
• pass, key and pat only match a whole word segment, so COMPASS_MODE, KEYFILE and DISPATCH stay visible.
• Environment-style keys (uppercase with underscores) additionally redact on the segments AUTH, BEARER, LOGIN and URL, which covers webhook URLs with an embedded secret. DD_PUBLIC_URL is redacted along with them, deliberately.
• Any string value carrying URL credentials (postgres://user:pass@host) is redacted whatever its key is called.
• A few provider-specific fields are redacted by name even though they don't match any of the rules above: Apprise URLS, Pushover USER, Rocket.Chat USER_ID, and Telegram CHATID.
• Container runtime environment variables come from the same redactor GET /containers uses, so the dump is never a laxer view of them than the API is.

Names are always kept; only values are replaced with [REDACTED]. Downloads are recorded in the audit log as debug-dump and the route is limited to 5 requests per minute.

curl -O -J "http://drydock:3000/api/v1/debug/dump?minutes=30"

The response is a JSON attachment with a timestamped filename (e.g. drydock-debug-dump-2026-03-18T19-33-00-000Z.json).

Query parameters

Dump sections

Returns 200 with the JSON attachment on success, 401 if not authenticated, 429 if more than 5 dumps are requested in a minute, or 500 if the dump cannot be generated.