Cheat sheet
Everything on one page. Install, upgrade, models, Doctor, CLI, the API calls you use most, Keychain, licence, keyboard shortcuts, query language, files and ports.
Install and upgrade
curl -fsSL https://get.3am.si/install | sh -s -- --trial # install with a trial (asks: this machine or Kubernetes)
curl -fsSL https://get.3am.si/k8s | sh # straight to Kubernetes
curl -fsSL https://get.3am.si/install | sh # upgrade: the same command again
./install.sh --doctor [--json] # 3AM Doctor
./install.sh --bind 0.0.0.0 # open the console to the network
./install.sh --forget # ignore remembered options
./install.sh --uninstall [--purge] # remove (and delete data)
./install.sh --keychain-join URL --keychain-site-key-file site.key # a new site from its Keychain home
helm repo add 3am https://get.3am.si/charts && helm upgrade 3am 3am/3am -n 3am --reuse-valuesRecommended host: 8 vCPU, 32 GB, 100 GB SSD (GCP e2-standard-8), models on a GPU or behind endpoints, never the
CPU. Requirements · Models · Every installer option
CLI (podman exec 3am-core /opt/3am/3am-core …)
| Command | Does |
|---|---|
doctor [--json] | Health, check by check |
preflight [--deep] [--json] | Host, licence, reach of every tool |
fingerprint | This install's fingerprint |
version, health | Version; exit 0 if up |
checks run ALERT… | The diagnosis, read-only, now |
packs list | Packs the licence opens |
connectors list|check | Kinds; health of each |
estate build, estate resolve ALERT | Discovery; where an alert belongs |
ledger-verify, licence-verify | The audit log; a licence file |
digest [DAY] | Write the daily digest |
API you use most
H="Authorization: Bearer $TOKEN"
curl -s -H "$H" $URL/v1/status # mode, licence, version (no token needed)
curl -s -H "$H" $URL/v1/doctor?fresh=1 # health
curl -s -H "$H" "$URL/v1/episodes?group=incident&limit=20" # incidents
curl -sG -H "$H" $URL/v1/episodes --data-urlencode 'query=result:handed_over opened<7d'
curl -s -H "$H" $URL/v1/live # what's running now
curl -s -X POST -H "$H" -d '{"reason":"freeze"}' $URL/v1/halt # stop every action
curl -s -X POST -H "$H" $URL/v1/resume
curl -s -H "$H" "$URL/v1/ledger?order=asc&after_seq=0&limit=2000" # export the audit log
curl -s -X POST -H "Authorization: Bearer $INGEST" -d @alert.json $URL/v1/alerts/auto # push an alertKeychain
| Do | Where |
|---|---|
| Make the home | Keychain → Make this the home · POST /v1/keychain/home |
| Add a new host | Add a site → A new host → its key → the line on the host · POST /v1/keychain/site-keys |
| Pair a running install | Add a site → An install already running → Open for 10 minutes; Join → Pair on the other |
| No network | Add a site → No network between them → seal; install.sh --keychain there |
| Change what it carries | What it carries → switches · POST /v1/keychain/scope |
| Keep a member's own | Each part → Keep my own · POST /v1/keychain/own |
| Move the home | Members → Make it the home → six digits typed on the member |
| Home lost (15 min) | On a member, an owner: Take over as the home |
Not answering after 3 min; gone after a day; nothing removed by itself. Keychain
Licence
| Tiers | Starter (50 services, prod + DR), Enterprise (250+, 10 installs, Keychain), Strategic (unlimited, site licence, Keychain) |
| Add an install | New install: Ask to join → six digits; an install on the licence: paste + type the digits |
| Confirmation | Warden, hourly by default; THREEAM_LICENCE_CHECK=auto|strict|offline |
| Trial | 90 days for now (a limited offer; usually 30), 50 services, up to 10 installs, one per company; --trial on the installer |
Autonomy
off → shadow (default, records) → L1 (asks) → L2 (safe actions unasked). Raising: two approvers. Lowering: at
once. Fix mode: advise (default) or draft (drafted fixes and restore moves, two approvers each).
Keyboard
⌘K command bar · / search · ? this map · [ fold nav · g o Overview · g i Incidents · g a Approvals ·
g d Digest · g b Impact · g e Estate · g y Study · g u Autonomy · g c Connections · g l Learned ·
g t Audit · g h Doctor · g m Team · g r Branding · g k Keychain · g s Settings · g g Guide · lists:
j/k ↵ n/p f r. Keyboard
Query language
service:x outcome:mitigated · alert:MySQL* OR alert:X · -kind:symptom · note~"dead ?lock" · duration>5m ·
opened<7d · last:90d · data.channel:slack. Query language
Files and ports
| Where | What |
|---|---|
/var/lib/3am | Data: audit log, incidents, settings, secrets (back it up) |
/etc/3am | Optional config as code: licence.json, connectors.json, policy.json, packs/ |
~/.3am/install.env, ~/.3am/keys/ | The installer's remembered options and key copies |
~/.3am/ingest-token | The ingest token |
8700/tcp | Console and API (in); optional webhooks and Keychain sync |
443 out | Your tools, model endpoints, warden.3am.si |
Reference
The cheat sheet, the HTTP API, the query language, every audit event, recipes, the command line, every environment variable, the network, and the glossary.
HTTP API
Every endpoint of 3AM's API (status, incidents, search, approvals, autonomy, policy, connections, estate, study, impact, lookback, licence, installs, Keychain, access, ledger, events, alerts) with who may call it and examples.