# Reinstall a virtual server

> Install one vServer anew with an operating system - all data and all snapshots are deleted.

- Effect: Destructive - Removes something for good. Agents ask first.
- Idempotent: no
- Stability: beta
- MCP tool: `manitu_vserver_reinstall` on https://mcp.manitu.de/mcp
- REST: `POST https://api.manitu.de/v1/vserver/reinstall`
- Needs: `service_vserver`
- Page: /reference/vserver/reinstall/

**Removes something for good. Agents name what will be lost and wait for an explicit yes; a program should ask the same.**

## MCP tool

`manitu_vserver_reinstall`

### Description for the model

Reinstalls a virtual server (vServer), by its vserver_id from manitu_vserver_list, with an operating system from runtime.os_image_list of manitu_vserver_product_get. EVERYTHING ON THE SERVER IS DELETED AND CANNOT BE RESTORED - all data, and ALL SNAPSHOTS as well (a snapshot taken before does not survive it; a backup has to be kept elsewhere). The server is stopped at once, hard; the installation takes a few minutes, up to 10-15 for larger systems (system updates are included). IP addresses and hostname stay. Give root_ssh_key_list - the customer's public key(s), the way to prefer - or root_password_hash (SHA-512 crypt, "openssl passwd -6"). NEVER ask for or pass a plaintext password: root_password is refused over this connection - for a password, the customer uses the customer panel. The new system has a new SSH host key: the client warns about a changed key - expected. Needs the customer's consent: the first call is refused with a conflict consent_required carrying consent_list (that all data and all snapshots are lost) and a consent_token. Name the server and the operating system, show the customer every item word for word, in its language (the binding wording), and wait for an explicit yes; only then make the same call again with consent_token (valid 15 minutes, once, for this server and this operating system). Never agree on the customer's behalf. Runs in the background: the answer is the workflow started (see pending_workflow_list of manitu_vserver_get for its progress). Refused with a conflict while another workflow runs on the vServer (blocked_by names it - wait for it, do not retry at once), while it is being installed, or while it cannot be changed.

Provide at least one of: root_ssh_key_list, root_password, root_password_hash.

### Arguments

- `vserver_id` (integer | string, required) - The vserver_id from manitu_vserver_list - never guess one. (pattern `"^[1-9][0-9]*$"`; minimum `1`)
- `os_image_code` (string, required) - The operating system - a code from runtime.os_image_list of manitu_vserver_product_get for this vServer; never guess one. (minLength `1`; maxLength `100`)
- `root_ssh_key_list` (array of string) - Public SSH keys that may log in as root of the newly installed server - the way to prefer. Each one public key, one line as in authorized_keys: "ssh-ed25519 AAAA... comment" (also ecdsa-sha2-nistp256/384/521, ssh-rsa from 2048 bits). No options in front of the key (command=, environment=, from= ...), no DSA. The public key only - never a private key. (minItems `1`; maxItems `20`)
- `root_password` (string, write-only) - The root password of the newly installed server - customer panel and REST only, refused over MCP: never ask for a password in a chat. Kept as a hash only, never shown again. Not together with root_password_hash. 12 to 72 printable ASCII characters, no space at the start or the end, not listed as leaked (pwnedpasswords.com). (minLength `12`; maxLength `72`; pattern `"^[\\x20-\\x7E]+$"`)
- `root_password_hash` (string, write-only) - The root password of the newly installed server as a crypt hash made by the customer - instead of root_password. A hash can be attacked offline: only for a strong password. Taken: SHA-512 crypt ("$6$...", e.g. from "openssl passwd -6" or "mkpasswd -m sha-512"). (maxLength `128`; pattern `"^\\$"`)
- `consent_token` (string, write-only) - The consent_token from the consent_required answer of the same call - only after the customer agreed to everything in its consent_list. Valid 15 minutes, once. (minLength `1`; maxLength `255`)

### Example

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "manitu_vserver_reinstall",
    "arguments": {
      "vserver_id": 12345,
      "os_image_code": "string",
      "root_ssh_key_list": [
        "string"
      ]
    }
  }
}
```

## REST

`POST https://api.manitu.de/v1/vserver/reinstall`

### Authentication

One of `X-API-Key`, `Authorization: Bearer …` - never more than one in a request.

### Request body

JSON; unknown fields are refused.

Provide at least one of: root_ssh_key_list, root_password, root_password_hash.

- `vserver_id` (integer | string, required) - The vserver_id from manitu_vserver_list - never guess one. (pattern `"^[1-9][0-9]*$"`; minimum `1`)
- `os_image_code` (string, required) - The operating system - a code from runtime.os_image_list of manitu_vserver_product_get for this vServer; never guess one. (minLength `1`; maxLength `100`)
- `root_ssh_key_list` (array of string) - Public SSH keys that may log in as root of the newly installed server - the way to prefer. Each one public key, one line as in authorized_keys: "ssh-ed25519 AAAA... comment" (also ecdsa-sha2-nistp256/384/521, ssh-rsa from 2048 bits). No options in front of the key (command=, environment=, from= ...), no DSA. The public key only - never a private key. (minItems `1`; maxItems `20`)
- `root_password` (string, write-only) - The root password of the newly installed server - customer panel and REST only, refused over MCP: never ask for a password in a chat. Kept as a hash only, never shown again. Not together with root_password_hash. 12 to 72 printable ASCII characters, no space at the start or the end, not listed as leaked (pwnedpasswords.com). (minLength `12`; maxLength `72`; pattern `"^[\\x20-\\x7E]+$"`)
- `root_password_hash` (string, write-only) - The root password of the newly installed server as a crypt hash made by the customer - instead of root_password. A hash can be attacked offline: only for a strong password. Taken: SHA-512 crypt ("$6$...", e.g. from "openssl passwd -6" or "mkpasswd -m sha-512"). (maxLength `128`; pattern `"^\\$"`)
- `consent_token` (string, write-only) - The consent_token from the consent_required answer of the same call - only after the customer agreed to everything in its consent_list. Valid 15 minutes, once. (minLength `1`; maxLength `255`)

### Response

In `data`; the rest of the body as on every call.

- `workflow` (string, required) - What is being done, e.g. a reboot. (one of `"create"`, `"destroy"`, `"power_start"`, `"power_stop"`, `"power_reboot"`, `"reinstall"`, `"ptr_set"`, `"vnc_enable"`, `"vnc_disable"`, `"rescuesystem_enable"`, `"rescuesystem_disable"`, `"snapshot_create"`, `"snapshot_delete"`, `"snapshot_delete_all"`, `"snapshot_revert"`, `"telemetry_await"`, `"iso_eject"`)
- `workflow_id` (string, required) - The id of this run of the workflow.
- `created_at` (string | null, required) - When it was asked for. (format `date-time`)
- `started_at` (string | null, required) - When it started; null while it waits for the next run - usually a minute or two, at times longer. Nothing to tell the customer unless asked. (format `date-time`)
- `workflow_token` (string | null, required) - Pass it to manitu_workflow_get to see how far the workflow is - as it is, never built or changed. A secret of this workflow: do not show it to anyone. null if there is none.
- `task` (object, required) - The task the customer panel polls for its progress.
  - `task.id` (integer, required)
  - `task.auth` (string, required)

### Statuses

- `200` Success.
- `400` The request does not match the declared input schema.
- `401` No credential was presented, or it was not recognised.
- `403` The credential is not permitted to use this operation.
- `500` The server failed. Nothing about the request was wrong. Whether a change took effect is not known - check before trying it again.
- `503` The channel this operation forwards through is unavailable.

### Example

```sh
curl -X POST 'https://api.manitu.de/v1/vserver/reinstall' \
  -H 'X-API-Key: $API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"vserver_id":12345,"os_image_code":"string","root_ssh_key_list":["string"]}'
```

## Example result

```json
{
  "workflow": "create",
  "workflow_id": "string",
  "created_at": "2026-10-23T12:00:00+02:00",
  "started_at": "2026-10-23T12:00:00+02:00",
  "workflow_token": "eyJwYWdlIjoyfQ",
  "task": {
    "id": 1,
    "auth": "string"
  }
}
```