@nightsquawktech/proxmox-mcp-server 0.1.0

package/dist/catalog-pdm/enrichment/delete_access_users_userid_token_token_name.json

@@ -0,0 +1,28 @@
+{
+  "operationId": "delete_access_users_userid_token_token_name",
+  "usageNotes": "Use this to permanently revoke an API token for a PDM user — for example, during offboarding, after a credential exposure, or when rotating tokens. The caller must either hold `Access.Modify` on `/access/users` or be the token's own user. Deletion is immediate and irreversible; any service or script using the deleted token will begin receiving 401 responses right away.",
+  "examples": [
+    {
+      "summary": "Revoke the 'automation' API token for a local admin user",
+      "path_params": {
+        "userid": "admin@pam",
+        "token-name": "automation"
+      },
+      "params": {
+        "digest": "a3f1c2e4b5d6789012345678901234567890abcdef1234567890abcdef123456"
+      }
+    }
+  ],
+  "destructiveReason": "The API token is permanently deleted; any credentials issued for it stop working immediately and cannot be restored.",
+  "tips": [
+    "Supply the optional `digest` parameter (SHA256 of the current config file) to guard against a race condition where another admin modifies the user's token list concurrently.",
+    "The `token-name` path segment is the short ID only (e.g. `automation`), not the full auth-id (`admin@pam!automation`) — do not include the `user@realm!` prefix here.",
+    "Returns null on success; a non-null HTTP error body indicates the token did not exist or the caller lacked permission."
+  ],
+  "relatedOperations": [
+    "get_access_users_userid_token_token_name",
+    "post_access_users_userid_token_token_name",
+    "put_access_users_userid_token_token_name",
+    "get_access_users_userid"
+  ]
+}

package/dist/catalog-pdm/enrichment/delete_auto_install_installations_uuid.json

@@ -0,0 +1,24 @@
+{
+  "operationId": "delete_auto_install_installations_uuid",
+  "usageNotes": "Use this to permanently remove an auto-install installation entry from PDM by its UUID. The operation is synchronous and returns null on success — there is no UPID or task to poll. Requires System.Modify privilege on the system/auto-installation ACL path; API tokens are supported.",
+  "examples": [
+    {
+      "summary": "Delete a completed or stale installation entry",
+      "path_params": {
+        "uuid": "a3f1c2d4-11b2-4e3a-9c87-0123456789ab"
+      },
+      "params": {}
+    }
+  ],
+  "destructiveReason": "Permanently removes the installation record; the entry cannot be recovered after deletion.",
+  "tips": [
+    "Verify the UUID via get_auto_install_installations or list_auto_install_installations before deleting — there is no confirmation step.",
+    "Deletion is immediate and synchronous; the API returns null (not a task UPID), so no polling is needed.",
+    "Only the UUID path parameter is required; no query parameters are accepted."
+  ],
+  "relatedOperations": [
+    "get_auto_install_installations_uuid",
+    "get_auto_install_installations",
+    "post_auto_install_installations"
+  ]
+}

package/dist/catalog-pdm/enrichment/delete_auto_install_prepared_id.json

@@ -0,0 +1,25 @@
+{
+  "operationId": "delete_auto_install_prepared_id",
+  "usageNotes": "Use this to permanently remove a prepared auto-installer answer configuration that is no longer needed. Requires the System.Modify privilege on the system/auto-installation ACL path. This operation returns null synchronously — there is no UPID or async task to poll; deletion is immediate.",
+  "examples": [
+    {
+      "summary": "Delete a prepared auto-install configuration by ID",
+      "path_params": {
+        "id": "ubuntu-24-04-standard"
+      },
+      "params": {}
+    }
+  ],
+  "destructiveReason": "Permanently deletes the prepared answer configuration; any automated installation workflow referencing this ID will fail until a replacement configuration is created.",
+  "tips": [
+    "The id must be between 3 and 64 characters; verify the exact ID first using the list or get endpoint before deleting.",
+    "Deletion is immediate and irreversible — export or document the configuration before removing it if there is any chance it will be needed again.",
+    "API tokens are supported (allowtoken: true), so this can be safely scripted with a scoped token rather than user credentials."
+  ],
+  "relatedOperations": [
+    "get_auto_install_prepared_id",
+    "get_auto_install_prepared",
+    "post_auto_install_prepared",
+    "put_auto_install_prepared_id"
+  ]
+}

package/dist/catalog-pdm/enrichment/delete_auto_install_tokens_id.json

@@ -0,0 +1,25 @@
+{
+  "operationId": "delete_auto_install_tokens_id",
+  "usageNotes": "Permanently deletes an auto-install token by its name. The deletion will fail if the token is currently referenced by any prepared answer configuration, so you must remove or reassign those references first. Requires the System.Modify privilege on the system/auto-installation ACL path.",
+  "examples": [
+    {
+      "summary": "Delete an auto-install token named 'lab-deploy-01'",
+      "path_params": {
+        "id": "lab-deploy-01"
+      },
+      "params": {}
+    }
+  ],
+  "destructiveReason": "Permanently removes the auto-install token; any automated provisioning workflows that reference this token by name will break until updated.",
+  "tips": [
+    "Token names must be 3–64 characters and match ^[A-Za-z0-9_][A-Za-z0-9._\\-]*$.",
+    "Verify no prepared answer configurations reference this token before deleting — the API will reject the request if any dependency exists.",
+    "Returns null on success; a non-null error response indicates the token is still in use or the name was not found."
+  ],
+  "relatedOperations": [
+    "get_auto_install_tokens",
+    "get_auto_install_tokens_id",
+    "post_auto_install_tokens",
+    "put_auto_install_tokens_id"
+  ]
+}

package/dist/catalog-pdm/enrichment/delete_config_access_ad_realm.json

@@ -0,0 +1,27 @@
+{
+  "operationId": "delete_config_access_ad_realm",
+  "usageNotes": "Use this to permanently remove an LDAP/AD realm from Proxmox Datacenter Manager. The caller must hold the Realm.Allocate privilege on the access/domains path. Pass the optional digest (obtained from a prior get of the realm config) to guard against concurrent modifications — the delete will be rejected if the config has changed since the digest was captured.",
+  "examples": [
+    {
+      "summary": "Delete an AD realm named 'corp-ad', with optimistic-lock digest to prevent race conditions",
+      "path_params": {
+        "realm": "corp-ad"
+      },
+      "params": {
+        "digest": "a3f1c2e4b5d6789012345678901234567890abcdef1234567890abcdef123456"
+      }
+    }
+  ],
+  "destructiveReason": "Permanently removes the LDAP/AD realm configuration; any users or tokens associated with this realm will lose authentication access and cannot be recovered without reconfiguring the realm.",
+  "tips": [
+    "Fetch the current realm config first (e.g. GET /config/access/ad/{realm}) to obtain the SHA256 digest before deleting — this prevents accidental deletion if the config was modified concurrently.",
+    "Ensure no active users depend on this realm before deletion; PDM does not cascade-delete user accounts tied to the realm.",
+    "Returns null on success — a 2xx with no body is the expected response."
+  ],
+  "relatedOperations": [
+    "get_config_access_ad_realm",
+    "create_config_access_ad_realm",
+    "update_config_access_ad_realm",
+    "list_config_access_ad"
+  ]
+}

package/dist/catalog-pdm/enrichment/delete_config_access_ldap_realm.json

@@ -0,0 +1,27 @@
+{
+  "operationId": "delete_config_access_ldap_realm",
+  "usageNotes": "Use this to permanently remove an LDAP realm from Proxmox Datacenter Manager so it no longer appears as an authentication source. The caller must hold the Realm.Allocate privilege on the access/domains path. Pass the current config digest to guard against concurrent modifications — omitting it allows the delete to proceed unconditionally.",
+  "examples": [
+    {
+      "summary": "Delete an LDAP realm named 'corp-ad', using a digest to prevent concurrent modification",
+      "path_params": {
+        "realm": "corp-ad"
+      },
+      "params": {
+        "digest": "a3f1c2e4b5d6a7f8e9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2"
+      }
+    }
+  ],
+  "destructiveReason": "Permanently removes the named LDAP realm configuration; any users or tokens that rely on this realm for authentication will no longer be able to log in.",
+  "tips": [
+    "Read the current realm config first (get_config_access_ldap_realm) to obtain the digest if you want optimistic-locking protection.",
+    "Realm names are 2–32 characters and must match /^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/; a mismatch returns a 400 before any deletion occurs.",
+    "This operation returns null on success — no UPID is issued, the deletion is synchronous."
+  ],
+  "relatedOperations": [
+    "get_config_access_ldap_realm",
+    "put_config_access_ldap_realm",
+    "post_config_access_ldap",
+    "get_config_access_ldap"
+  ]
+}

package/dist/catalog-pdm/enrichment/delete_config_access_openid_realm.json

@@ -0,0 +1,27 @@
+{
+  "operationId": "delete_config_access_openid_realm",
+  "usageNotes": "Use this to permanently remove an OpenID Connect realm from Proxmox Datacenter Manager's authentication configuration. Requires the `Realm.Allocate` privilege on `access/domains`. Before deleting, ensure no users or active sessions depend on this realm — removal is immediate and returns null with no undo path.",
+  "examples": [
+    {
+      "summary": "Delete an OpenID realm named 'corp-sso'",
+      "path_params": {
+        "realm": "corp-sso"
+      },
+      "params": {
+        "digest": "a3f1c9b2e4d7f08a1c3e5b2d9f6a0c8e4b7d1f3a5c9e2b8d6f0a4c7e1b5d9f2"
+      }
+    }
+  ],
+  "destructiveReason": "Permanently removes the OpenID realm configuration; any users or tokens tied to this realm will lose the ability to authenticate until reassigned to another realm.",
+  "tips": [
+    "Pass the `digest` param (obtained from a prior GET on this realm) to guard against concurrent config modifications before deletion.",
+    "Check for dependent user accounts on this realm before deleting — PDM does not block deletion based on existing user associations.",
+    "This operation returns null on success; treat a non-error HTTP response as confirmation."
+  ],
+  "relatedOperations": [
+    "get_config_access_openid_realm",
+    "create_config_access_openid_realm",
+    "update_config_access_openid_realm",
+    "list_config_access_openid"
+  ]
+}

package/dist/catalog-pdm/enrichment/delete_config_acme_account_name.json

@@ -0,0 +1,25 @@
+{
+  "operationId": "delete_config_acme_account_name",
+  "usageNotes": "Use this to deactivate and remove an ACME account registration from Proxmox Datacenter Manager; the CA (e.g. Let's Encrypt) will be notified to deactivate the account before local data is deleted. Requires the System.Modify privilege on the system/certificates path. Returns a UPID — poll the task log to confirm completion before assuming the account is gone.",
+  "examples": [
+    {
+      "summary": "Deactivate the default ACME account",
+      "path_params": {
+        "name": "default"
+      },
+      "params": {}
+    }
+  ],
+  "destructiveReason": "Permanently deactivates the ACME account at the CA and deletes its local credentials; any certificates that relied on this account can no longer be renewed without re-registering.",
+  "tips": [
+    "The `force` flag deletes local account data even if the CA returns an error during deactivation — use only when the account is already gone at the CA side and you need to clean up stale local state.",
+    "Because the response is a UPID, use a task-status endpoint to verify the deactivation completed without error before treating the account as removed.",
+    "Ensure no active certificate orders reference this account before deleting; orphaned orders will fail renewal silently."
+  ],
+  "relatedOperations": [
+    "get_config_acme_account_name",
+    "put_config_acme_account_name",
+    "post_config_acme_account",
+    "get_config_acme_account"
+  ]
+}

package/dist/catalog-pdm/enrichment/delete_config_acme_plugins_id.json

@@ -0,0 +1,25 @@
+{
+  "operationId": "delete_config_acme_plugins_id",
+  "usageNotes": "Use this to permanently remove an ACME challenge plugin configuration from Proxmox Datacenter Manager. The caller must hold the System.Modify privilege on the system/certificates ACL path. Before deleting, ensure no ACME accounts or domains are still referencing this plugin, as removal is immediate and returns null (synchronous, no UPID).",
+  "examples": [
+    {
+      "summary": "Delete a DNS challenge plugin named 'cloudflare-dns'",
+      "path_params": {
+        "id": "cloudflare-dns"
+      },
+      "params": {}
+    }
+  ],
+  "destructiveReason": "Permanently removes the named ACME plugin configuration; any ACME account or certificate order that references this plugin will fail to renew until a replacement plugin is configured.",
+  "tips": [
+    "The plugin ID must match the pattern ^(?:[A-Za-z0-9_][A-Za-z0-9.\\-_]*)$ and is case-sensitive.",
+    "This call returns null on success — a 200 with no body is the expected success response.",
+    "List existing plugins first with get_config_acme_plugins to confirm the exact ID before deleting."
+  ],
+  "relatedOperations": [
+    "get_config_acme_plugins",
+    "get_config_acme_plugins_id",
+    "post_config_acme_plugins",
+    "put_config_acme_plugins_id"
+  ]
+}

package/dist/catalog-pdm/enrichment/delete_config_views_id.json

@@ -0,0 +1,27 @@
+{
+  "operationId": "delete_config_views_id",
+  "usageNotes": "Permanently deletes a named view from the Proxmox Datacenter Manager configuration. Requires the Resource.Modify privilege on the 'view' path. Pass the optional digest parameter (obtained from the read/list endpoint) to guard against concurrent modifications overwriting each other.",
+  "examples": [
+    {
+      "summary": "Delete a view named 'prod-cluster' using a digest for safe concurrent modification protection",
+      "path_params": {
+        "id": "prod-cluster"
+      },
+      "params": {
+        "digest": "a3f1c2e4b5d6789012345678901234567890abcdef1234567890abcdef123456"
+      }
+    }
+  ],
+  "destructiveReason": "Permanently removes the named view and all of its configuration from PDM; there is no undo and the view must be recreated manually if deleted in error.",
+  "tips": [
+    "Fetch the current digest via the corresponding GET/list endpoint and pass it to prevent race conditions when multiple operators may be modifying views simultaneously.",
+    "The id must be 2–32 characters, starting with an alphanumeric or underscore, followed by alphanumeric, dot, underscore, or hyphen characters.",
+    "Returns null on success — no confirmation payload is included; treat an HTTP 200 with null body as the success signal."
+  ],
+  "relatedOperations": [
+    "get_config_views",
+    "get_config_views_id",
+    "post_config_views",
+    "put_config_views_id"
+  ]
+}

package/dist/catalog-pdm/enrichment/delete_nodes_node_certificates_custom.json

@@ -0,0 +1,23 @@
+{
+  "operationId": "delete_nodes_node_certificates_custom",
+  "usageNotes": "Use this to remove a custom (e.g. Let's Encrypt or manually uploaded) TLS certificate from a PDM node and immediately replace it with a freshly generated self-signed certificate. The operation is synchronous and returns null on success; the web UI and API become reachable again without a service restart. Requires the System.Modify privilege on the calling token or user.",
+  "examples": [
+    {
+      "summary": "Revert pdm-node1 to a self-signed certificate after a bad custom cert upload",
+      "path_params": {
+        "node": "pdm-node1"
+      },
+      "params": {}
+    }
+  ],
+  "destructiveReason": "Permanently deletes the current custom certificate and its associated private key, replacing them with a new self-signed certificate; any browser or client trust pinned to the previous certificate will immediately fail until re-accepted.",
+  "tips": [
+    "The 'restart' query parameter is accepted for UI compatibility but has no effect — no service restart is triggered.",
+    "After this call completes, clients connecting to the node's web UI will receive an untrusted certificate warning until a new custom cert is uploaded or trust is re-established.",
+    "Use 'localhost' as the node value only when calling from the node itself; always use the real node name when targeting a remote node."
+  ],
+  "relatedOperations": [
+    "post_nodes_node_certificates_custom",
+    "get_nodes_node_certificates"
+  ]
+}

package/dist/catalog-pdm/enrichment/delete_nodes_node_network.json

@@ -0,0 +1,24 @@
+{
+  "operationId": "delete_nodes_node_network",
+  "usageNotes": "Use this to discard pending (uncommitted) network changes on a PDM node — it deletes `/etc/network/interfaces.new`, leaving the live `/etc/network/interfaces` untouched. Call this after a failed or unwanted `PUT /nodes/{node}/network` before applying changes, not after. Requires `System.Modify` on the node and returns null synchronously (no UPID).",
+  "examples": [
+    {
+      "summary": "Revert staged network changes on node 'pdm-node1'",
+      "path_params": {
+        "node": "pdm-node1"
+      },
+      "params": {}
+    }
+  ],
+  "destructiveReason": "Permanently deletes the staged network configuration file (`/etc/network/interfaces.new`), discarding any unsaved interface edits without recovery.",
+  "tips": [
+    "This only removes the staged config — the live running network config is unaffected.",
+    "If `interfaces.new` does not exist the call still returns null without error.",
+    "Run before `POST /nodes/{node}/network` (apply) if you want to abort pending changes rather than commit them."
+  ],
+  "relatedOperations": [
+    "get_nodes_node_network",
+    "put_nodes_node_network",
+    "post_nodes_node_network"
+  ]
+}

package/dist/catalog-pdm/enrichment/delete_nodes_node_network_iface.json

@@ -0,0 +1,30 @@
+{
+  "operationId": "delete_nodes_node_network_iface",
+  "usageNotes": "Removes a network interface configuration from the node's network config file (`/etc/network/interfaces`). The change is staged — it takes effect only after applying the pending network configuration (see `put_nodes_node_network`). Use the `digest` parameter to guard against concurrent edits when multiple operators may be modifying network config simultaneously.",
+  "examples": [
+    {
+      "summary": "Delete a bridge interface named vmbr1 from node pdm01",
+      "path_params": {
+        "node": "pdm01",
+        "iface": "vmbr1"
+      },
+      "params": {
+        "digest": "a3f1e2b4c7d9e0f12345678901234567890abcdef1234567890abcdef12345678"
+      }
+    }
+  ],
+  "destructiveReason": "Permanently removes the named interface from the node's network configuration; any VMs or services bound to that interface lose their network path once the configuration is applied.",
+  "tips": [
+    "The deletion is not applied until you call PUT /nodes/{node}/network to commit pending network changes; the node continues using the old config until then.",
+    "Fetch the current digest via GET /nodes/{node}/network before deleting to pass a valid SHA256 digest and prevent race conditions.",
+    "Requires System.Modify privilege scoped to the specific interface path; token-based auth is supported.",
+    "Attempting to delete an interface that is still referenced by a VM NIC or another interface (e.g., a bond slave) may cause errors or network disruption after apply — verify dependencies first."
+  ],
+  "relatedOperations": [
+    "get_nodes_node_network",
+    "get_nodes_node_network_iface",
+    "post_nodes_node_network",
+    "put_nodes_node_network_iface",
+    "put_nodes_node_network"
+  ]
+}

package/dist/catalog-pdm/enrichment/delete_nodes_node_tasks_upid.json

@@ -0,0 +1,25 @@
+{
+  "operationId": "delete_nodes_node_tasks_upid",
+  "usageNotes": "Use this to stop a running or queued task on a PDM node by its UPID. Users can stop their own tasks without elevated privileges; stopping another user's task requires Sys.Modify on /system/tasks. The UPID must match a task that is still active — sending a DELETE against an already-finished task is a no-op (returns null without error).",
+  "examples": [
+    {
+      "summary": "Stop a running vzdump backup task on node pdm-node1",
+      "path_params": {
+        "node": "pdm-node1",
+        "upid": "UPID:pdm-node1:001A2B3C:004D5E6F:0000000100000000:68123456:vzdump:100:root@pam:"
+      },
+      "params": {}
+    }
+  ],
+  "destructiveReason": "Terminates the targeted running task, which may leave in-progress operations (e.g., backups, migrations, or replication syncs) in an incomplete or inconsistent state.",
+  "tips": [
+    "The UPID pattern is strict — obtain it from list_nodes_node_tasks rather than constructing it manually.",
+    "A DELETE on a task that has already completed returns null with no error; check task status first if you need to confirm it was actually running.",
+    "Stopping a backup or replication task mid-run may leave partial snapshots or dirty state on the target datastore that requires manual cleanup."
+  ],
+  "relatedOperations": [
+    "get_nodes_node_tasks_upid_status",
+    "get_nodes_node_tasks_upid_log",
+    "get_nodes_node_tasks"
+  ]
+}

package/dist/catalog-pdm/enrichment/delete_pbs_remotes_remote_tasks_upid.json

@@ -0,0 +1,25 @@
+{
+  "operationId": "delete_pbs_remotes_remote_tasks_upid",
+  "usageNotes": "Stops a running task on a PBS remote by sending a stop/cancel signal for the given UPID. The caller must hold Resource.Manage on the target remote; the UPID must belong to a task that is still active on the remote — attempting to stop an already-finished task is a no-op or may return an error depending on PBS version. Returns null on success; confirm the task has halted by polling the corresponding task-status endpoint.",
+  "examples": [
+    {
+      "summary": "Stop a running garbage-collection task on the 'prod-backup' PBS remote",
+      "path_params": {
+        "remote": "prod-backup",
+        "upid": "UPID:prod-backup:00003A1C:012F4E8B:67A1C300:garbage_collect::root@pam:"
+      },
+      "params": {}
+    }
+  ],
+  "destructiveReason": "Terminates a running PBS task on the remote; any work performed by that task up to the point of cancellation may be incomplete or left in a partial state (e.g., a garbage-collection or prune run that did not finish).",
+  "tips": [
+    "Retrieve the UPID from the task-list or task-log endpoints before calling this — UPIDs are opaque strings at least 42 characters long.",
+    "Only tasks in a running or queued state can be meaningfully stopped; finished tasks return null without error in most PBS versions.",
+    "After stopping, verify final task status via the corresponding GET task-status endpoint before assuming the operation fully rolled back."
+  ],
+  "relatedOperations": [
+    "get_pbs_remotes_remote_tasks_upid_status",
+    "get_pbs_remotes_remote_tasks_upid_log",
+    "get_pbs_remotes_remote_tasks"
+  ]
+}

package/dist/catalog-pdm/enrichment/delete_pve_remotes_remote_lxc_vmid_snapshot_snapname.json

@@ -0,0 +1,29 @@
+{
+  "operationId": "delete_pve_remotes_remote_lxc_vmid_snapshot_snapname",
+  "usageNotes": "Permanently deletes a named snapshot from a remote LXC container; the operation is asynchronous and returns a remote UPID that should be polled for completion. The caller must hold Resource.Manage on the remote/vmid ACL path, and the target PVE node must be reachable from PDM. If the snapshot has dependent child snapshots, deletion will fail — remove children first.",
+  "examples": [
+    {
+      "summary": "Delete a pre-upgrade snapshot from a remote LXC container",
+      "path_params": {
+        "remote": "pve-hetzner",
+        "vmid": 201,
+        "snapname": "pre-upgrade-2026-06"
+      },
+      "params": {
+        "node": "pve1"
+      }
+    }
+  ],
+  "destructiveReason": "Permanently removes the named snapshot and its stored disk delta; the container state captured at that point in time cannot be recovered.",
+  "tips": [
+    "The returned UPID is a remote UPID — use the appropriate PDM task-status endpoint (not local PVE task endpoints) to poll for completion.",
+    "Omitting 'node' lets PDM resolve the node automatically; specify it only when the container is on a specific node in a multi-node cluster.",
+    "Snapshot names follow the same alphanumeric-plus-dots-dashes pattern as on local PVE — max 40 characters.",
+    "Run list_pve_remotes_remote_lxc_vmid_snapshot first to confirm the exact snapname before deleting."
+  ],
+  "relatedOperations": [
+    "list_pve_remotes_remote_lxc_vmid_snapshot",
+    "post_pve_remotes_remote_lxc_vmid_snapshot",
+    "get_pve_remotes_remote_lxc_vmid_snapshot_snapname"
+  ]
+}

package/dist/catalog-pdm/enrichment/delete_pve_remotes_remote_qemu_vmid_snapshot_snapname.json

@@ -0,0 +1,28 @@
+{
+  "operationId": "delete_pve_remotes_remote_qemu_vmid_snapshot_snapname",
+  "usageNotes": "Permanently deletes a named snapshot from a remote QEMU VM managed through PDM. The operation is asynchronous — it returns a remote UPID that must be polled for completion before assuming the snapshot is gone. Requires Resource.Manage on the remote guest; if the target node is not specified, PDM selects it automatically, but passing 'node' is recommended when the remote cluster has multiple nodes to avoid routing ambiguity.",
+  "examples": [
+    {
+      "summary": "Delete a pre-upgrade snapshot from a remote VM",
+      "path_params": {
+        "remote": "hetzner-pve01",
+        "vmid": 104,
+        "snapname": "before_upgrade_2026"
+      },
+      "params": {
+        "node": "pve1"
+      }
+    }
+  ],
+  "destructiveReason": "Permanently removes the named snapshot and all associated memory/disk state; this cannot be undone.",
+  "tips": [
+    "Poll the returned UPID via the PDM task API to confirm deletion completed before proceeding with dependent operations.",
+    "Snapshots with child snapshots (created after this one) may need to be deleted in reverse chronological order depending on the storage backend.",
+    "snapname must begin with a letter or digit and match the pattern [A-Za-z0-9_][A-Za-z0-9._-]* (max 40 chars) — verify the exact name with a list-snapshots call first."
+  ],
+  "relatedOperations": [
+    "get_pve_remotes_remote_qemu_vmid_snapshot",
+    "post_pve_remotes_remote_qemu_vmid_snapshot",
+    "post_pve_remotes_remote_qemu_vmid_snapshot_snapname_rollback"
+  ]
+}

package/dist/catalog-pdm/enrichment/delete_pve_remotes_remote_tasks_upid.json

@@ -0,0 +1,24 @@
+{
+  "operationId": "delete_pve_remotes_remote_tasks_upid",
+  "usageNotes": "Use this endpoint to stop (cancel) a running task on a remote Proxmox VE node via PDM. The caller must hold Resource.Manage on the target remote, and the remote must be reachable by PDM at the time of the request. Note that the spec description says 'Get the status' but the method is DELETE — this actually stops/cancels the task identified by the UPID; returns null on success.",
+  "examples": [
+    {
+      "summary": "Cancel a running migration task on remote 'pve-hetzner'",
+      "path_params": {
+        "remote": "pve-hetzner",
+        "upid": "UPID:pve-hetzner:00001A2B:0012D687:66808F00:qmigrate:105:root@pam:"
+      },
+      "params": {}
+    }
+  ],
+  "destructiveReason": "Cancels the in-progress task on the remote PVE node; any work performed by that task up to the cancellation point is not automatically rolled back (e.g., a partially migrated VM may be left in an inconsistent state).",
+  "tips": [
+    "Obtain the UPID from a prior task-creation response or from list_pve_remotes_remote_tasks; UPIDs are at least 42 characters long.",
+    "A null return indicates the stop request was accepted — poll the task status endpoint to confirm the task has actually terminated.",
+    "Not all PVE task types support mid-flight cancellation; the task may finish normally before the stop signal is processed."
+  ],
+  "relatedOperations": [
+    "get_pve_remotes_remote_tasks_upid",
+    "list_pve_remotes_remote_tasks"
+  ]
+}

package/dist/catalog-pdm/enrichment/delete_remotes_remote_id.json

@@ -0,0 +1,26 @@
+{
+  "operationId": "delete_remotes_remote_id",
+  "usageNotes": "Use this to permanently remove a remote Proxmox instance from PDM management; the remote entry is deleted synchronously (returns null, not a UPID). Pass `delete-token: true` to also revoke the API token that PDM created on the remote — omitting this leaves a dangling token on the remote side. Requires `Resource.Modify` privilege on the resource.",
+  "examples": [
+    {
+      "summary": "Remove a managed remote and revoke its PDM API token",
+      "path_params": {
+        "id": "pve-hetzner-01"
+      },
+      "params": {
+        "delete-token": true
+      }
+    }
+  ],
+  "destructiveReason": "Permanently removes the remote from PDM management, severing all visibility and control over that Proxmox node; if `delete-token` is false, the orphaned API token remains active on the remote.",
+  "tips": [
+    "Always pass delete-token=true unless you have a specific reason to retain the API token on the remote (e.g., the token is shared with another PDM instance).",
+    "The remote ID must match the pattern /^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/ and be 2–32 characters — use list_remotes to confirm the exact ID before deleting.",
+    "This operation is synchronous and returns null on success; no task UPID is issued, so there is nothing to poll."
+  ],
+  "relatedOperations": [
+    "get_remotes_remote_id",
+    "put_remotes_remote_id",
+    "get_remotes"
+  ]
+}

package/dist/catalog-pdm/enrichment/delete_subscriptions_keys_key.json

@@ -0,0 +1,27 @@
+{
+  "operationId": "delete_subscriptions_keys_key",
+  "usageNotes": "Removes a subscription key from the PDM pool permanently. Before calling this, verify the key is not currently the live active key on any bound remote node — PDM will refuse the deletion if it is; use the Clear Key action on the Node Subscription Status panel first to deactivate it. If the key is assigned to a remote node, the caller must also hold PRIV_RESOURCE_MODIFY on that remote in addition to System.Modify.",
+  "examples": [
+    {
+      "summary": "Remove a Proxmox Backup Server community key from the pool",
+      "path_params": {
+        "key": "pbsc-a1b2c3d4e5"
+      },
+      "params": {
+        "digest": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+      }
+    }
+  ],
+  "destructiveReason": "Permanently removes the subscription key entry from the PDM pool; the key cannot be recovered through the API and must be re-added manually if needed.",
+  "tips": [
+    "Pass the current config digest to guard against concurrent modifications — PDM will reject the request if another write has occurred since you last read the pool.",
+    "A null return on success means no body is returned; treat any non-2xx response as a failure.",
+    "If the delete is refused with a conflict error, check whether the key is still bound as the active key on a remote node and clear it there first."
+  ],
+  "relatedOperations": [
+    "get_subscriptions_keys",
+    "post_subscriptions_keys",
+    "get_subscriptions_keys_key",
+    "put_nodes_node_subscription"
+  ]
+}

package/dist/catalog-pdm/enrichment/delete_subscriptions_keys_key_assignment.json

@@ -0,0 +1,27 @@
+{
+  "operationId": "delete_subscriptions_keys_key_assignment",
+  "usageNotes": "Removes the remote-node binding for a pool key, making the key available for reassignment to a different node. This call will be rejected if the key is currently synced (i.e., it is the active live key on its assigned remote node) — you must first clear the key on the node via the Node Subscription Status panel before unassigning. Requires System.Modify on the PDM instance.",
+  "examples": [
+    {
+      "summary": "Unassign a Proxmox VE subscription key from its current node binding",
+      "path_params": {
+        "key": "pve1c-a1b2c3d4e5"
+      },
+      "params": {
+        "digest": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+      }
+    }
+  ],
+  "destructiveReason": "Drops the remote-node binding for the key; if performed while the key is still active on the remote node, the subscription is orphaned and the node loses its covered subscription state until the key is reassigned and re-synced.",
+  "tips": [
+    "Always run 'Clear Key' on the node's Subscription Status panel before calling this endpoint — PDM will return an error if the key is still in the synced state.",
+    "Pass the current config digest to prevent a race condition if multiple operators are managing subscriptions concurrently.",
+    "After unassigning, reassign the key with PUT /subscriptions/keys/{key}/assignment before syncing to a new node."
+  ],
+  "relatedOperations": [
+    "get_subscriptions_keys_key_assignment",
+    "put_subscriptions_keys_key_assignment",
+    "get_subscriptions_keys",
+    "post_subscriptions_keys_key_sync"
+  ]
+}

package/dist/catalog-pdm/enrichment/get_.json

@@ -0,0 +1,17 @@
+{
+  "operationId": "get_",
+  "usageNotes": "Call this endpoint to retrieve the top-level directory index of the Proxmox Datacenter Manager API — useful for discovery, connectivity testing, or confirming that a PDM host is reachable and responding. No parameters are required and no special privileges beyond a valid API token are needed. This is the lightest possible call to verify authentication credentials are accepted.",
+  "examples": [
+    {
+      "summary": "Verify PDM API reachability with an API token",
+      "path_params": {},
+      "params": {}
+    }
+  ],
+  "tips": [
+    "Because this endpoint accepts all authenticated users, it is safe to use as a health-check or smoke-test in automation before issuing more privileged calls.",
+    "The PDM API listens on port 8443 by default; ensure firewall rules allow TCP 8443 from your client.",
+    "Returns null per spec — the value of this call is the HTTP 200 response code, not the response body."
+  ],
+  "relatedOperations": []
+}

package/dist/catalog-pdm/enrichment/get_access.json

@@ -0,0 +1,20 @@
+{
+  "operationId": "get_access",
+  "usageNotes": "Returns the top-level access directory index for Proxmox Datacenter Manager, listing available sub-resources under /access (such as /access/users, /access/roles, /access/tickets). Useful as a discovery call to confirm which access-management endpoints are available on the connected PDM instance. Requires no special privileges — any authenticated user or API token can call it.",
+  "examples": [
+    {
+      "summary": "Retrieve the access directory index",
+      "path_params": {},
+      "params": {}
+    }
+  ],
+  "tips": [
+    "Returns null per the spec; the actual value is the HTTP response body listing child endpoints — parse the 'data' array from the JSON envelope.",
+    "Use this as a lightweight connectivity/auth check: a 200 response confirms the API token and host are reachable."
+  ],
+  "relatedOperations": [
+    "get_access_users",
+    "get_access_roles",
+    "get_access_ticket"
+  ]
+}