Server Chief
Use the Server Chief REST API to search your team's servers and read their packages, software, sites, certificates, vulnerabilities, and metrics. You can also manage tags, metric alert rules, and install commands that add new servers. AI clients can use the same operations through the MCP server. To react when a server goes offline or an alert fires, receive webhooks instead of polling.
Looking for help using Server Chief in the browser? Go to the Server Chief documentation.
Make your first request
Every request needs a bearer access token. Use a team access token for a service owned by one team, a personal access token for a private script, or OAuth when your application connects other users' accounts. The token guide explains how to create and protect each token type.
Give the token only the Server Chief scopes its requests need. The production API base URL is:
Code
Start by listing the servers with outstanding security updates. This read-only request needs serverchief:servers:read:
Code
The response is a page of servers with their operating system, hardware, addresses, update counts, and vulnerability summary. Use the id of a server, such as server_01jb9a2c3d4e5f6g7h8j9k0m1n, in requests about that server.
Search servers
The q parameter of List servers takes the same search language as the Server Chief dashboard. Separate terms with spaces. Every term must match, and a leading - excludes servers that match the term.
| Query | Finds |
|---|---|
php:7.x | Servers running PHP 7 |
arch:arm64 php:eol | ARM servers running a PHP release past its end of life |
pkg:openssl<3.0.13 | Servers with an older openssl package, compared like dpkg or rpm |
vulnerable:critical | Servers with a critical vulnerability |
tag:production -status:offline | Online servers tagged production |
cert:expiring<7d | Servers with a site certificate that expires within 7 days |
The q parameter in the API reference lists every filter. A query the parser does not understand returns a 422 response that explains which term is wrong.
Servers shared with your team
Teams can share servers with each other through a tag. The API returns those servers too, with access set to viewer and the owning team in owner_team. Shared servers are read-only. Requests that change them, such as updating tags or metadata, return 403.