curl --request GET \
--url https://compute.{region}.basaltic.sh/v1/instances/{instance_id}/console/serial \
--header 'Authorization: Bearer <token>'import requests
url = "https://compute.{region}.basaltic.sh/v1/instances/{instance_id}/console/serial"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://compute.{region}.basaltic.sh/v1/instances/{instance_id}/console/serial', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://compute.{region}.basaltic.sh/v1/instances/{instance_id}/console/serial",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://compute.{region}.basaltic.sh/v1/instances/{instance_id}/console/serial"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://compute.{region}.basaltic.sh/v1/instances/{instance_id}/console/serial")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://compute.{region}.basaltic.sh/v1/instances/{instance_id}/console/serial")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"error": {
"code": "UNAUTHORIZED",
"message": "Authentication required",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "ACCESS_DENIED",
"message": "You don't have permission to perform this action",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "NOT_FOUND",
"message": "Resource not found",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "INVALID_INPUT",
"message": "Invalid request parameters",
"request_id": "550e8400-e29b-41d4-a716-446655440000",
"params": {
"instances": 2,
"pools": 0
}
}
}{
"error": {
"code": "INVALID_INPUT",
"message": "Invalid request parameters",
"request_id": "550e8400-e29b-41d4-a716-446655440000",
"params": {
"instances": 2,
"pools": 0
}
}
}{
"error": {
"code": "INTERNAL_ERROR",
"message": "An internal error occurred",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}Open an interactive serial console
Upgrades to a WebSocket carrying an interactive session on the instance’s serial port — the equivalent of a crash cart, and the only way in when the network is broken: a bad fstab, a wrong kernel, a security group that locked you out, a full disk.
Raw bytes in binary frames, both directions. It is a terminal, not a protocol: send keystrokes, receive whatever the guest prints. Point a terminal emulator at it.
This drops you at the guest’s OWN login prompt. It is not a backdoor — the guest’s credentials are still required and nothing here grants access past what the guest itself allows.
Authenticating the upgrade. A client that can set headers — the
basaltic CLI, or anything not running in a browser — authenticates
this like every other call and needs nothing extra.
A BROWSER cannot: the WebSocket constructor takes a URL and no headers.
For that case, POST the companion /console/ticket endpoint and pass
the result as a ticket query parameter. The ticket is deliberately
narrow — one instance, sixty seconds — because a credential in a URL
ends up in proxy logs, and that one is worth far less than a session
token would be.
One session per instance: opening a second disconnects the first, rather than interleaving two people’s keystrokes into the same terminal. A session ends after 15 minutes idle, or 4 hours regardless, and the close frame carries the reason.
Requires the instance to be running.
curl --request GET \
--url https://compute.{region}.basaltic.sh/v1/instances/{instance_id}/console/serial \
--header 'Authorization: Bearer <token>'import requests
url = "https://compute.{region}.basaltic.sh/v1/instances/{instance_id}/console/serial"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://compute.{region}.basaltic.sh/v1/instances/{instance_id}/console/serial', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://compute.{region}.basaltic.sh/v1/instances/{instance_id}/console/serial",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://compute.{region}.basaltic.sh/v1/instances/{instance_id}/console/serial"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://compute.{region}.basaltic.sh/v1/instances/{instance_id}/console/serial")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://compute.{region}.basaltic.sh/v1/instances/{instance_id}/console/serial")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"error": {
"code": "UNAUTHORIZED",
"message": "Authentication required",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "ACCESS_DENIED",
"message": "You don't have permission to perform this action",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "NOT_FOUND",
"message": "Resource not found",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "INVALID_INPUT",
"message": "Invalid request parameters",
"request_id": "550e8400-e29b-41d4-a716-446655440000",
"params": {
"instances": 2,
"pools": 0
}
}
}{
"error": {
"code": "INVALID_INPUT",
"message": "Invalid request parameters",
"request_id": "550e8400-e29b-41d4-a716-446655440000",
"params": {
"instances": 2,
"pools": 0
}
}
}{
"error": {
"code": "INTERNAL_ERROR",
"message": "An internal error occurred",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}compute:StartSerialConsole. See COMPUTE permissions for the full list, what each one covers, and an example policy.Authorizations
An OAuth 2.0 bearer token, sent as Authorization: Bearer <token>.
This is the recommended way to authenticate.
Get one by exchanging a service account's access key pair at
POST /v1/oauth/token with grant_type=client_credentials. It is the
standard client-credentials grant, so any OAuth-aware library will
obtain and refresh it for you.
curl -s -u "$KEY_ID:$SECRET" -d grant_type=client_credentials \
https://iam.basaltic.sh/v1/oauth/token
Tokens last an hour by default. The same access key pair is separately your AWS SigV4 credential for the S3-compatible object endpoint, which speaks nothing else.
Path Parameters
Instance ID
Query Parameters
Replay this many bytes of already-written output before live output begins, so attaching to a quiet guest shows why it is quiet instead of an empty screen. 0 disables replay. Values above 65536 are clamped.
The replay is the tail of the same recording /console/output serves; the live session is the guest's serial port. The two are separate sources, so the join is marked with a \r\n--- live ---\r\n line: everything before it is history, everything after it is happening now. A guest printing at the instant you connect may have a few bytes land on neither side of that line — a quiet guest, the case replay exists for, is replayed exactly.
0 <= x <= 65536Response
Switching protocols — the console session is open.

