Docs

Check a domain. Is a domain available, and what does it cost to register and renew? Free, no side effects.

Buy a domain. Registers a domain and creates its Cloudflare zone. Spends money: needs a reason, confirm equal to the domain, and credit (a prepaid account with credit pays from it and is never stopped by the shared domains budget; any other account needs an operator-opened budget). Registered through GoLive's own registrar, with its DNS zone in GoLive's Cloudflare account and the nameservers set, so DNS, email and attach_domain work on it at once. Returns the domain and zone id, never a credential.

List domains. Domains (Cloudflare zones) registered to your account on GoLive, with their status.

Domain status. Whether a domain's Cloudflare zone is active, and the nameservers it should point at. For a domain whose DNS stays at your own host, the routing and email setups registered on it (attach_domain, setup_domain_email), whether their required records are published, and any drift of a completed setup from its plan.

List DNS records. DNS records of a zone registered to your account on GoLive, optionally filtered by name or type.

Create or update a DNS record. Sets a DNS record on a zone on our Cloudflare account. By default the record of that name and type is REPLACED when there is exactly one, for A, AAAA, CNAME and the TXT policy records (SPF, DMARC, MTA-STS), so a new SPF string leaves no old one live; it is created when there is none, and a record with exactly this value is updated in place (ttl, proxied, priority). Refused, naming the record ids, when several of that name and type exist (pass mode: "add" to add another value, or delete the extras). Never replaced by default, refused with conflict instead: any other TXT (a verification token, DKIM, plain text), a TXT of another kind (an SPF record by a site verification, say), and MX, SRV and CAA, which are sets. Pass mode: "replace" to replace the one existing record (rotating a verification token), or mode: "add" to keep it and add this one. The dry run reads the records and says which of create, update, replace or add it would do.

Delete a DNS record. Deletes one DNS record by id. Destructive: confirm with the record id.

Verify DNS at your own host. For a domain or hostname whose DNS stays at your own host (GoDaddy, Route 53, your own Cloudflare...): reads public DNS through two resolvers (Cloudflare 1.1.1.1 and Google, so propagation shows) and reports every record of the plan attach_domain or setup_domain_email gave you as present, missing, wrong or propagating, with the value expected, the value found and the exact fix; plus SPF problems (several SPF records, over 10 lookups) and conflicts (a CNAME at the root, old MX hosts). Nothing is created at a vendor until GoLive's ownership TXT (_golive.<name>) is served by both resolvers; then it starts the setup (Railway custom domain, or the domain added to AI Mail). When every required record is present it completes the setup: the app's Railway custom domain and its certificate (re-added if it vanished), an HTTPS check (public addresses only), and AI Mail's verification (then the sending records AI Mail adds). Without setup it checks every setup on the name and its subdomains, and reports drift of a completed setup from its plan. Changes no DNS; safe to call repeatedly; complete: false only reports. Free; 20 per minute per account.

Release a setup at your own DNS host. Releases a routing or email setup that attach_domain or setup_domain_email registered for a name whose DNS stays at your own host: deletes the Railway custom domain GoLive created for it (the hostname stops being served by your app), or removes the domain from AI Mail when no other setup uses it (its mailboxes stop receiving), and forgets the plan. Changes no DNS: remove the records at your host yourself. Destructive: confirm with the name. Free.

Set up email on a domain. Adds one of your domains (a zone registered to your account on GoLive) to AI Mail MCP and puts its DNS records in place: ownership, SPF, DKIM, DMARC and the sending provider's records, and MX when AI Mail's plan includes inbound records. On a zone in GoLive's own Cloudflare account GoLive writes them itself (GoLive-managed DNS), through the same checks as upsert_record, and never replaces or deletes a record that is there: a conflict (another SPF record, MX pointing elsewhere) is reported with what to do. Then AI Mail verifies the domain. Every answer says what AI Mail holds (pending or verified), each record's result, what is left, and how to finish (call again: every step is safe to repeat) or roll back. Inbound: on a GoLive zone (apex domain), once AI Mail has verified the domain GoLive turns on Cloudflare Email Routing for it and routes the zone's catch-all to GoLive's copy of AI Mail's receiver, so mail to any mailbox arrives directly; it never replaces MX pointing elsewhere or a catch-all that routes elsewhere (reported as a conflict), and undoes its own change if a step fails. Otherwise mail reaches a mailbox through its route address (the answer says which applies). A domain whose DNS stays at your own host (not a GoLive zone): GoLive changes no DNS. It registers a pending setup and returns GoLive's ownership TXT (_golive.<domain>) first, with AI Mail's records as a preview; nothing is added to AI Mail until both public resolvers show the ownership record. Then this call or verify_dns adds the domain and gives the exact records (AI Mail's ownership TXT, MX, SPF merged into the SPF you already publish, DKIM, DMARC; required or recommended, with hints for your host), and verify_dns completes it. Unproved setups are released after 7 days; release_dns_setup releases one. Free.

Create a mailbox. Creates a mailbox (e.g. hello@example.com) on one of your domains already set up for email (a zone registered to your account on GoLive, or a domain on your own DNS host whose setup_domain_email setup verify_dns completed). With app (an app on your account), the app also gets mail through AI Mail with no key to handle: GoLive mints an AI Mail token that can only send from this mailbox (200 a day) and writes AIMAIL_URL, AIMAIL_TOKEN and EMAIL_FROM on the app, then redeploys it once. The app sends by calling AI Mail's send_message at the AIMAIL_URL value + /mcp with AIMAIL_TOKEN as the bearer. The token is never shown. With app, a mailbox that already exists is reused, and calling again rotates the token (the previous one GoLive minted for that app and mailbox is revoked). Use this, not a separate email provider's key, for an app's transactional mail.

Create an app from a repo. Creates a new service that deploys from a GitHub repository branch, and registers it. The repo must be covered by this account's GitHub installation and the branch must exist; the repo is linked to the app. Natively it creates a Railway project with a Postgres database (database: none to skip), a generated hostname, and registers the app to your account as soon as the project exists. Safe to repeat: a retry continues a partly built app. Provisions a billable resource: needs an open resources budget.

Deploy. Deploys the latest commit of the app's deploy branch (or a given commit), or with redeploy_current redeploys what is deployed now. When a GitHub repo is linked to the app, the deploy is GATED: it needs a passing preflight for that exact commit from the last 24 hours, is pinned to that commit, and a red-risk commit also needs confirm set to the full SHA. The app owner may override with override_preflight and a reason (audited). Without a linked repo the gate is skipped and the result says so. The answer carries the new deployment id and the commit it builds (for a branch-head deploy, the SHA the head resolved to, once Railway records it).

Deploy status. The current and recent deployments of an app: status, commit, and when.

Read logs. Recent runtime or build log lines of an app (up to 500), with secrets scrubbed server side: the app's own env values and anything shaped like a credential.

Roll back. Redeploys the previous successful deployment (or a given one). The previous one is the newest deployment created before the live one that served, even while Railway is still removing it; if Railway cannot roll back to it, the call refuses and names it (with an older one you may pass) instead of reaching further back. The dry run names the target: id, commit and created time. Pass that id as deployment_id to act on exactly it; without deployment_id the real call applies the same rule again. Railway rolls back by creating a new deployment; the answer names it as deployment_id. Destructive: replaces what is live; confirm with the app id.

Restart. Restarts the running deployment without rebuilding.

Set an environment variable. Sets one variable on an app and redeploys it (unless redeploy: false). The value goes in and is never echoed: the answer carries its length and, for values of 12 or more characters, the last 4. References (${{...}}) and Railway's own names (RAILWAY_*, PORT) are refused. Confirm with the variable name.

List environment variables. Variable NAMES on an app, each with its length and last 4 characters. Never values.

Remove an environment variable. Removes one variable from an app and redeploys it (unless redeploy: false), so the running app no longer sees it. The variable must exist; the dry run names it with its length and last 4 characters. Railway's own names (RAILWAY_*, PORT), DATABASE_URL and references (${{...}}) are refused. The answer names the redeploy as deployment_id. Confirm with the variable name.

Rotate a secret. Generates a new random value for a variable that exists on an app (hex, from bytes random bytes, default 32) and writes it on the app's service and on any other service of the app holding the same value, then redeploys them and any service that references it (${{service.NAME}}), and checks it took. The value is generated server side and never returned: the answer carries its length and last 4 characters, as set_env does. The dry run names the variable and every service it would touch; the answer names the deployment each redeployed service gets (deployments). Railway's own names (RAILWAY_*, PORT), DATABASE_URL and references are refused. Confirm with the variable name.

Attach a volume. Creates a persistent disk and mounts it on the app. Provisions a billable resource: needs an open resources budget.

Add a database to an app. Adds a Postgres (default) or Redis database to an existing app: Railway's template in the app's own project and environment, and a Railway reference to its connection variable on the app service (DATABASE_URL for postgres, REDIS_URL for redis), never a literal. Redeploys the app once so it sees the variable. The answer names the service, the engine and the variable, never a connection string. Refused when the app already has a database of that engine or the variable is already set. Safe to repeat: the database is requested once; a repeat while Railway is still creating it answers status provisioning (later stuck), and finishes the wiring when it is up. The dry run shows the steps and the estimated monthly price. Provisions a billable resource: needs an open resources budget.

Attach a hostname to an app. Routes a hostname to one of your apps: a Railway custom domain on the app (Railway serves TLS for it). On a zone GoLive hosts, GoLive also writes a proxied CNAME to Railway's target and Railway's verification TXT, never replacing an existing record. When the hostname is already this app's and Railway's certificate for it failed (ssl_status shows certificate failed), calling attach_domain again retries it: the Railway custom domain is re-created and its CNAME and TXT updated. On a domain whose DNS stays at your own host (GoDaddy, Route 53, your own Cloudflare...), GoLive changes no DNS: it registers a pending setup and returns the records to publish (type, name relative and full, value, TTL, required or recommended, with hints for your host and for a root domain, which needs CNAME flattening or ALIAS since Railway has no fixed IP). First comes GoLive's ownership TXT (_golive.<hostname>): nothing is created at Railway until both public resolvers show it; then this call or verify_dns creates the Railway custom domain and gives its CNAME target and verification TXT, and verify_dns completes the setup. Unproved setups are released after 7 days; release_dns_setup releases one. Free.

SSL status. Whether a hostname serves valid HTTPS right now, plus its zone status; and, when the hostname is attached to one of your apps, Railway's own certificate for it (validating, issuing or valid). Cloudflare's edge answers HTTPS as soon as the proxied record exists, so the probe can pass before Railway's certificate is issued. A zone shared with you under a name scope shows its status, not the owner's zone-wide SSL settings.

Validate changes. Diffs the commit to deploy (default: the head of the linked deploy branch) against the commit that is live, through GitHub's compare API, and rates the change red, yellow or green with reasons: destructive migrations (DROP, TRUNCATE, ALTER ... DROP) are red; other migrations, environment variables the new code reads but the app lacks (names only), dependency and lockfile changes, build and deploy config, auth code and large diffs are yellow. Honours golive.yaml in the repo (red_paths, green_paths, migration command), read at the live commit; and the risk.red_paths and risk.green_paths of a fleet harness manifest (.claude/harness.yaml). With both files, golive.yaml's settings apply and the red_paths of both (red never relaxes); a risk block GoLive cannot read makes the change red. For an app that carries BETTER_AUTH_URL or a Better Auth secret it adds a Better Auth section (names and lengths only): secret present and at least 32 characters (red otherwise), BETTER_AUTH_URL https (red) and an attached host (yellow), and, from lib/auth.ts or src/lib/auth.ts at the commit, rate limit storage 'database' (yellow) and requireEmailVerification: true when password sign-in is on (red). Nothing is executed. Stores a report. Free.

Preflight. Runs validate_changes, then reads the commit's CI in GitHub (Actions runs, other check suites and commit statuses). Passes when CI succeeded, or when the repo has no CI (noted). Stores one report tied to the exact commit; deploy needs a passing one from the last 24 hours. Called from inside a GitHub Actions workflow on the same commit, pass that run's id (GITHUB_RUN_ID) as ci_exclude_run_id so the calling run, still in progress, is left out; only an in-progress run of this repo and commit can be excluded, the report records it, and deploy re-reads CI for such a report (refusing if the excluded run has since failed). Free.

Get preflight reports. Past validate_changes and preflight reports for an app, newest first, optionally for one commit (full or short SHA) or one kind. Free.

Generate logo options. Designs 1 to 6 distinct logo marks (default 4) for a brand. Each option has an id, a one-line concept note and a clean square SVG (validated: no scripts, fonts or external references). preview_url is a private page to send the person: every option large on light and dark, at 16 and 32 px and in greyscale, with "Choose this one", "Tweak this one" and mix buttons and no sign-in; it is kept 7 days (expires_at). Send the person preview_url; when they choose, get_logo_options returns selected_option_id; pass it to export_logo_assets. When the person asks to tweak an option, call generate_logo_options { brand, tweak_of, instructions }: 2 to 4 variants of THAT option (default 3, same price), on a new preview_url with based_on pointing back. include_previews: true also returns each option as a base64 PNG and preview_html, a self-contained page of the same sheet (no forms) you can publish or render. must_include makes every option contain a motif or letter (e.g. ["the letter S", "a heart"]). Pass idempotency_key: if the call times out on your side it still finishes here, and get_logo_options with the same key returns it for free; repeating generate_logo_options with a used key is refused, never charged twice. check: true also runs check_logo_similarity on every option after generating (each option is sent to Google Cloud Vision; charged per option on top, shown in dry_run) and shows a similarity badge on the preview page. Costs a model call; dry_run shows the price.

Check a logo for lookalikes. A risk signal for one logo: renders it, sends the image to Google Cloud Vision (processed in memory; per Google not stored or used for training) for a web image search, and returns risk low | medium | high with a score, the pages and images that match it (exact, partial or visually similar, the last compared by perceptual hash), any other brand the web ties to it, and links to the USPTO, WIPO and EUIPO trademark registers to search by hand. It is a risk signal from a web image search, NOT a trademark clearance or legal advice: confusion depends on the goods and markets too. Give option_id (from a generate_logo_options result kept 7 days; add preview_url to say which result) or the svg itself; goods (what the brand sells) is echoed back to frame the register search. The verdict is kept on the stored option for the rest of its 7 days: the preview page shows a badge and get_logo_options returns it. If Google cannot answer, status is unavailable and nothing is charged. Costs a little per option; dry_run shows the price.

Get logo options. A generate_logo_options result, kept 7 days: the options, preview_url, expires_at and what the person did on the page: selected_option_id, selected_at, selection_note and requests (each { at, kind: "mix" | "tweak", text, option_ids }; a tweak asks for generate_logo_options { brand, tweak_of, instructions }). Look it up by preview_url, by the token in it, or by the idempotency_key you passed; state running (call again in about 30 seconds) while that call is still working. When tweaks made more rounds, rounds lists every round of the job (each with its preview_url; every page links to the others) and current_choice is the latest pick the person made on any round: use current_choice when it is present, since the person may choose on an earlier round. Poll it after sending the person preview_url; when selected_option_id (or current_choice) is set, pass its option_id to export_logo_assets. Use it after a timeout instead of generating again. Free.

Export favicon and app icons. Turns one logo option into a full icon set: favicon.svg, favicon.ico (16, 32, 48), PNGs from 16 to 512, apple-touch-icon (180, on background_color so iOS shows no black corners), icon-192, icon-512 and icon-maskable-512 (padded for Android's crop), a web manifest, and the <head> tags. Give option_id (the selected_option_id from get_logo_options, or any id from generate_logo_options; results are kept 7 days, so it works after a restart) or the svg itself. download_url is a zip of every file (kept 24 h); include_files: true also returns each file as base64. Free, no side effects.

Connect GitHub. Returns a one-time link (30 minutes) that installs the GoLive GitHub App, or adds repos to it, and connects the installation to this account. Open it in a browser signed in to GitHub; GitHub asks you to authorize GoLive so it can confirm you can see the installation. Also lists the installations already connected. GoLive gets read access to code and opens PRs; it never pushes.

List repositories. Repositories this account's GitHub installations cover, refreshed from GitHub, with the GoLive app and deploy branch each one is linked to. Free.

Link a repo to an app. Binds a repository and its deploy branch to a GoLive app, so deploys and preflight checks use that repo. The repo must be covered by this account's GitHub installation and the branch must exist.

Read a repo file. One text file from a connected repository at a branch, tag or commit (default: the linked deploy branch, else the default branch), with the commit SHA it was read at. Up to 256 KB; binary files are refused. Free.

Model completion (text). One model call that returns text, on GoLive's Fireworks account: no provider key needed. Give prompt (and optionally system), or messages. model is one of the listed Fireworks models, or "auto". Billed per token from credit at the model's listed rate (see the AI models table on /pricing, or a dry run): the most the call can cost is held first and settled at the tokens actually used. Each request passes an acceptable-use screen first; a refused request is not charged. Prompts and replies are never stored.

Model completion (JSON object). One model call whose reply is a JSON value matching your JSON Schema (schema), decoded under a grammar built from it, then checked: never prose to parse. Same models, billing, screening and privacy as complete_text. A reply cut off at max_tokens, or one that still fails the schema after one retry, is an invalid_output error (the tokens are charged).

Classify text. Puts a text into one of your labels ({ label: "what it means" }, 2 to 20). Cloudflare's Clef-flash scores every label in one pass and answers when it is confident (min_confidence, default 0.8); otherwise a Fireworks model picks one under a JSON schema. Returns label, confidence and, from Clef, every label's probability. Usually a small fraction of a cent; billed per token at the listed rates.

Pick a model for a task. Tell it what you want a model to do (task, optionally a few examples, the output you need, how many calls a day, and whether cost or quality matters most) and it proposes the GoLive tool and model for it: classify (Clef-flash first) for a fixed set of labels, complete_json for structured fields, complete_text for prose, with a fallback model, why, the cost per call, per 1,000 calls and per month, and a ready request for the tool and for the HTTP endpoint. Only models Fireworks is serving right now are proposed. Free.

Give an app model access. Gives one of your apps its own key for GoLive's OpenAI-compatible model endpoint, so the running app calls models with no provider key: sets GOLIVE_LLM_URL and GOLIVE_LLM_KEY on the app and redeploys it. The key is never shown to you, can call the model endpoint only (/chat/completions, /llm/classify, /models), and is billed to the app's account per token, like complete_text. A new grant revokes the app's earlier key. daily_call_cap limits calls per UTC day (default 20,000). Free.

Dashboard. Start here to see what needs attention. The account console's Dashboard as data, with the same status rules as the page: a board (one row per area: apps and deploys, domains and email, messaging, spend and budget, security and access, publishing, recent activity, each good, warn, bad or info), an attention list worst first where each item carries a fix (a GoLive tool call to make, such as verify_dns or add_funds with dry_run, or a console page to open), and per area its verdict, stats, tables and notes. An admin-scoped account key sees every area; an operate or read key sees spend and recent activity only. Built from what GoLive stores: deploy status is the recorded deploy requests, not live Railway state (use deploy_status); SSL expiry is not stored (use ssl_status); env and storage are not counted (use list_env). A section that cannot load comes back with status unknown and the rest still answers. Per account: a key with no account is refused. No secrets, key values, addresses or message text. sections limits it to some areas; format full adds the tables (default summary). Free.

Fleet overview. Every app registered to this account, one line each: deploy state, live commit, last deploy, domains, and health from the app's own health check path when it declares one. Free.

App metrics. CPU, memory, network and disk of an app over the last hours (default 24, up to 168), as about 120 points per series with latest, average and peak. Free.

Traffic. Edge traffic per day: requests, bandwidth, cache hit rate, status-code mix, top countries and unique visitors, for the last 1 to 30 days (default 7). For a whole zone (its owner only), or with hostname for one name in it (from Cloudflare's sampled per-host analytics; how far back it reaches depends on the zone's plan). A zone shared with you under a name scope gives the traffic of hostnames inside the scope only. Free.

Deploy history. An app's recent deployments, newest first: status, commit SHA and message, created and finished times, build-to-live duration, whether Railway recorded it as a rollback or redeploy, and the newest preflight result for each commit. Summarised as a failure rate and a median duration. Free.

Error digest. The live deployment's runtime errors over a window (default 24h, up to 7d), grouped into signatures (numbers, ids, hex, timestamps, quoted values and emails stripped) with a count, first and last seen, and one sample line. Known noise (transient upstream errors, bot probes, platform notices, stack frames) is counted, not listed, using the fleet classifier's rules. Deprecation and end-of-support notices (Node, the AWS SDK) are listed under warnings and not counted as errors. Samples are scrubbed of the app's env values and anything secret-shaped. Free.

Budget status. Whether this account can buy (domains) or provision (apps, volumes, databases) right now, and its own spend limits and what remains of them. The operator sees the open budgets themselves. Budgets are opened by an operator, never by a tool.

Estimate a budget. Call this BEFORE a multi-step launch (buying a domain, creating an app, adding a volume or a database, setting up email) to know what it will cost and whether this account can pay for it. Give goal in words (e.g. "launch my app on acme.dev with email") and GoLive matches a built-in plan, or give steps (the tools you will call, with args and count) for an exact one; if the goal matches no plan the answer says needs_steps. Returns, per step: the GoLive fee, the amount held during the call, pass-through charges one-time and monthly (domains quoted live, apps and volumes as labelled estimates, unknown with a reason when they cannot be priced), and whether the step is available, capability_pending or refused for this account (read-only key, operator-only, no open budget, app or domain not registered). Totals as low/high ranges over months (1 to 12), the largest hold, and the account fit: balance, held, spend limits, shortfall and a recommendation (top-up, monthly spend limit, budgets an operator must open). Free, read-only: nothing is held, reserved, bought or changed.

Usage and spend. What this key has used and been charged: calls, charges and pending holds by tool or by day, plus the account's spend limits and what remains, and (prepaid accounts) the period's charges for ongoing usage by category and resource. Refusals and dry runs are listed at $0. Free.

Audit log. Every mutating attempt on this account through golive, newest first: who, what, dry run or real, and outcome (including refusals). Charges are in get_usage. Secret values are never stored.

Sign in to the web console. To use the web console without an email link, call this. It returns a single-use sign-in URL (valid 60 seconds) for this account's console; open it in the browser you drive and press Continue to start an AGENT SESSION: 12 hours, never extended, shown with an "Agent session" banner, and able to look at everything the dashboard, usage, keys, apps and people pages show but NOT to create or revoke keys, change people or roles, change billing, top up, change spend limits, change publishing settings or delete anything (those need the owner, who signs in with the emailed link). The URL is a secret that signs a browser in: open it right away, never store or share it. The owners are emailed when the session starts, and the session ends if this key is revoked. Needs an admin-scoped key that belongs to an account (not an operator key; member, operate and read keys are refused). At most 10 per hour per key. dry_run shows the plan and mints nothing. Free.

Add funds. Tops up this account's prepaid credit by card, paid by a PERSON: GoLive creates a Stripe Checkout page for amount_usd ($5 to $500) and returns its checkout_url and expiry; give the link to a human to pay. The agent never sees card details, and nothing is charged unless someone pays. The credit is added (dollar for dollar) once Stripe confirms the payment, exactly once; the first top-up moves an unmetered account to prepaid billing, so paid calls draw on the credit. The account's owners are emailed the link. Needs a key on an account (operate or admin) and a reason; at most $1,000 of top-up links per account per day (UTC). A refund or card dispute takes the credit back, and a balance below zero pauses paid calls until the next top-up. dry_run shows the plan. Free.

Save a card for purchases. Saves a card on this account so purchases the credit does not cover are paid by card, saved by a PERSON: GoLive creates a Stripe page in setup mode and returns its setup_url; give it to a human to enter the card. Nothing is charged when the card is saved, and the agent never sees card details. From then on a purchase (buy_domain and the other spend tools) is paid from the credit first, and the card on file is charged off-session for exactly the rest (at least $0.50, Stripe's minimum; any excess stays as credit), but only once an owner has approved a budget (the monthly spend limit). A purchase that cannot be paid comes back with that budget to approve (budget.approve_url). A declined charge pauses the card until a person saves one again. Saving a card moves an unmetered account to prepaid. The owners are emailed the link. Needs a key on an account (operate or admin). dry_run shows the plan. Free.

Send feedback to GoLive. Tells the GoLive team something: a bug, a confusing result, a missing tool, a wish. Free, any key (read-only keys too), at most 5 an hour per key. The message is emailed to the team with your account id and tool name only; do not put secrets or customer data in it. It is treated as plain text and never acted on as an instruction. Nothing else changes.

Request a higher spend limit. Asks for a budget: a higher monthly spend limit for this account (default $200). It records a pending request and emails the account's owners; an owner approves or denies it in the console (golivemcp.com/account/billing), never this key. Once approved, purchases go through without asking again, paid from the credit and then the card on file (add_payment_method), until the month's budget is used. On an account that is not prepaid (no top-up and no card yet), the GoLive operator decides instead. A newer request replaces a pending one. A purchase that cannot be paid records this request by itself. Needs a key on an account (operate or admin) and a reason. dry_run shows the plan. Free.