> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mountthor.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Customer-managed compute

> Read your Mac inventory and report problems when you manage your own Macs at a Mount Thor site

With customer-managed compute, your organization manages its own Macs at a
Mount Thor site, typically with its own MDM. Mount Thor runs the site. You
work with your Macs in the portal, with the mthr CLI, or through the compute
API at `https://customer-api.mountthor.com/compute/v2`. See
[Compute offerings](https://docs.mountthor.com/compute/offerings.md) for how this differs from
Mount Thor-managed compute.

## Capabilities

Your account can use the capabilities you and Mount Thor agree on:

| Capability | Portal | mthr CLI | API |
| - | - | - | - |
| Inventory | **Macs** card and each Mac's page | `mthr bm ls`, `mthr bm get` | `GET /compute/v2/baremetalmachines`, `GET /compute/v2/baremetalmachines/{name}` |
| Problem reports | **Report a problem** | `mthr bm report` | `POST`, `GET /compute/v2/machineproblemreports`, `GET /compute/v2/machineproblemreports/{name}` |
| Events | | | `/compute/v2/eventsubscriptions` and `GET /compute/v2/eventactions` |

Anything else, such as creating a machine or a virtual machine, is not
offered. The portal doesn't show it, the CLI refuses it, and the API answers
`400` with the reason `tenant_compute_customer_managed`. So does a capability
your account doesn't have. To add one, ask your Mount Thor contact.

To automate these tasks, use a [service account](#service-accounts).

## Choose how to work with your Macs

> [tab] Portal
>
> ### See your Macs
>
> Open the [Compute page](https://portal.mountthor.com/compute) in the portal. It
> shows **Managed by your organization**, with what your account can do, and
> lists your Macs in the [Macs](https://portal.mountthor.com/compute#fleet) card:
> each Mac's serial number, hardware, location and status. The list shows 100
> Macs at a time. Use **Previous** and **Next** to move between pages. To find a
> Mac, type its serial number, or its first characters, in
> **Find a Mac by serial number**.
>
> Click a Mac's serial number to open its page. It shows the Mac's serial number
> and, when Mount Thor knows them, its chip, model, CPU cores, memory, storage,
> class, site and location. Its status reads **Managed by your organization** because Mount
> Thor doesn't track a Mac's power or health. The page also lists the problem
> reports filed for that Mac.
>
> ### Report a problem
>
> 1. Click **Report a problem** in the
>    [Problem reports](https://portal.mountthor.com/compute#problem-reports) card,
>    or on the Mac's page, which fills in its serial number.
> 2. From the Compute page, enter the Mac's **Serial number**.
> 3. Describe what you see and when it started in **What's wrong**, up to 4,096
>    bytes.
> 4. Click **Send report**.
>
> The portal shows **Report sent** with the report's reference, and the report
> appears in **Problem reports**. Each report alerts Mount Thor's on-call team.
>
> If the portal shows **The report couldn't be confirmed**, click
> **Check again** before you send it again, so the on-call team isn't alerted
> twice.

> [tab] mthr CLI
>
> These commands need mthr 0.3.80 or later. Check your version with
> `mthr --version`, and update with `mthr update`.
>
> ### Check your account
>
> ```bash theme={null}
> mthr whoami
> ```
>
> `whoami` shows who manages your Macs and what your account can use, with the
> commands for each:
>
> ```text theme={null}
> Compute:      managed by your organization
> Available:    Mac list (mthr bm ls, mthr bm get), problem reports (mthr bm report), event subscriptions (API)
> ```
>
> `mthr whoami --json` adds `computeProfile`, with `computeManagement`, `state`
> and `capabilities`.
>
> ### See your Macs
>
> ```bash theme={null}
> mthr bm ls
> mthr bm get C02XK0AAJG5H
> ```
>
> `bm ls` shows each Mac's serial number, class and location. Its status reads
> `managed by your org` because Mount Thor doesn't track a Mac's power or health:
>
> ```text theme={null}
> NAME          SERIAL        CLASS   LOCATION            STATUS
> c02xk0aajg5h  C02XK0AAJG5H  -       rw01-rk02-tr03-s04  managed by your org
> ```
>
> `bm get` takes the serial number in any case. `bm ls` reads every page by
> default. Pass `--limit 100` to read the first 100, `--page-token TOKEN` to
> continue, or `--serial C02XK0AAJG5H` to find one Mac. With `--json`, the CLI
> prints the API's fields under `bareMetalMachines`.
>
> The CLI refuses `--active`, `--failed` and `--wait` here. They read a Mac's
> state, which Mount Thor doesn't track.
>
> ### Report a problem
>
> ```bash theme={null}
> mthr bm report C02XK0AAJG5H --description "No network link since 09:00 UTC; the Mac is powered on."
> ```
>
> The command asks before it sends the report, because each report alerts
> Mount Thor's on-call team. Pass `--yes` to skip the question. The description is
> required, up to 4,096 bytes. Once the report is sent, the CLI prints:
>
> ```text theme={null}
> Report sent. Mount Thor's on-call team has been alerted.
> Reference: mpr-… (C02XK0AAJG5H). See it with `mthr bm report get mpr-…`.
> ```
>
> List your reports with `mthr bm report ls`, or one Mac's with
> `mthr bm report ls --serial C02XK0AAJG5H`. Show one with
> `mthr bm report get REPORT_NAME`.
>
> After a lost connection or a `5xx` answer, the CLI reports that the outcome is
> unknown. Run `mthr bm report ls` before you send the report again. At your
> account's report limit, the command exits with code `10`.
>
> ### Commands your account doesn't offer
>
> Other compute commands, such as `mthr bm allocate` or any `mthr vm` command,
> exit with code `11` before they send anything:
>
> ```text theme={null}
> Error: `mthr bm allocate` isn't available because your organization manages this account's Macs (permission denied)
>   Command: mthr bm allocate
>   Docs:    https://docs.mountthor.com/compute/customer-managed
>   Contact: support@mountthor.com
> ```
>
> During your account's setup, a change exits with code `8` and the message
> "changes are paused". Run the command again later.
>
> ### Run as a service account
>
> With mthr 0.3.81 or later, a [service account](#service-accounts) runs
> `whoami`, `bm ls`, `bm get` and the `bm report` commands. The `bm` commands
> take the same flags and print the same output as for a person. Select the
> credential as on [Service accounts](https://docs.mountthor.com/platform/service-accounts.md):
>
> ```bash theme={null}
> export MOUNTTHOR_SERVICE_ACCOUNT_CREDENTIAL_FILE="$PWD/sa.json"
> mthr whoami
> mthr bm ls
> ```
>
> If the service account's roles don't grant a command's action, the command
> exits with code `11` and names the action:
>
> ```text theme={null}
> Error: this service account's role doesn't grant compute:ListBareMetalMachines (permission denied)
>   Command: mthr bm ls
>   Try:     an Owner can add it to the service account's role with `mthr iam roles update`, or on the Access page in the portal; `mthr iam roles ls` lists the roles
>   Contact: support@mountthor.com
> ```

> [tab] API
>
> ### See your Macs
>
> Mount Thor's inventory lists your Macs at the site. Each Mac's name is its
> serial number in lower case:
>
> ```http theme={null}
> GET /compute/v2/baremetalmachines/c02xk0aajg5h
> ```
>
> A Mac's record includes `serialNumber`, its location and
> `computeManagement: COMPUTE_MANAGEMENT_CUSTOMER_MANAGED`. It also includes
> `machineClass`, `hardware` details and the Mac's address in
> `network.ipAddresses` when Mount Thor knows them.
>
> Mount Thor doesn't track a Mac's power or health. Its status `state` is
> `STATE_UNSPECIFIED` with the reason `CustomerManaged`.
>
> The list is paged. Pass `pageSize` (100 by default, at most 1,000) and, for
> each following page, the `pageToken` set to the previous answer's
> `nextPageToken`. An empty `nextPageToken` means you have read the whole list:
>
> ```http theme={null}
> GET /compute/v2/baremetalmachines?pageSize=1000
> GET /compute/v2/baremetalmachines?pageSize=1000&pageToken=NEXT_PAGE_TOKEN
> ```
>
> To read one Mac, use its lower-case serial with
> `GET /compute/v2/baremetalmachines/{name}` rather than walking the list.
>
> If the inventory cannot be read, the request answers `503`. It never answers
> with an empty or partial list.
>
> ### Report a problem
>
> Report a hardware or site problem, such as a Mac that does not power on or
> has no network link, by its serial number:
>
> ```http theme={null}
> POST /compute/v2/machineproblemreports
> Content-Type: application/json
>
> {"serial": "C02XK0AAJG5H", "description": "No network link since 09:00 UTC; the Mac is powered on."}
> ```
>
> The answer is `201` with the report, whose name starts with `mpr-`. Each
> report alerts Mount Thor's on-call team. Read your reports with
> `GET /compute/v2/machineproblemreports` and
> `GET /compute/v2/machineproblemreports/{name}`.
>
> * `description` is required, up to 4,096 bytes. Describe what you see and
>   when it started.
> * Your account can hold a limited number of reports. At the limit, a new
>   report answers `422` with the reason `problem_report_limit_reached`.
> * Creating a report is not idempotent. If a create fails with a `5xx`
>   answer, list your reports before you retry, so you do not file the same
>   report twice.

## Events

If your account has events, Mount Thor can send webhook notifications about
your Macs to an HTTPS endpoint you run. Ask your Mount Thor contact to enable
events and for the integration details.

## Service accounts

A [service account](https://docs.mountthor.com/platform/service-accounts.md) works through the API or the
mthr CLI, as their tabs show. Every service account can read
`GET /compute/v2/computeprofile`, which says who manages your Macs and which
capabilities your account has. For everything else, an owner binds the
service account to a custom role with the capability's actions. See
[Roles and bindings](https://docs.mountthor.com/platform/roles-and-bindings.md).

| Capability | Actions |
| - | - |
| Inventory | `compute:ListBareMetalMachines`, `compute:GetBareMetalMachine` |
| Problem reports | `compute:CreateMachineProblemReport`, `compute:ListMachineProblemReports`, `compute:GetMachineProblemReport` |
| Events | `compute:CreateEventSubscription`, `compute:ListEventSubscriptions`, `compute:GetEventSubscription`, `compute:UpdateEventSubscription`, `compute:DeleteEventSubscription`, `compute:RotateEventSubscriptionKey`, `compute:ListEventActions` |

This role reads your Macs and files problem reports:

```bash theme={null}
mthr iam roles create mac-reports \
  --action compute:ListBareMetalMachines \
  --action compute:GetBareMetalMachine \
  --action compute:CreateMachineProblemReport \
  --action compute:ListMachineProblemReports \
  --action compute:GetMachineProblemReport \
  --reason "Read our Macs and report problems from automation" \
  --ticket ACCESS-301
```

A call whose action the service account's roles don't grant answers `403`
with the reason `permission_denied`. A role can't add a capability your
account doesn't have: that call still answers `400` with the reason
`tenant_compute_customer_managed`.

## Answers you may see

| Status | Reason | Meaning |
| - | - | - |
| `400` | `tenant_compute_customer_managed` | The operation is not enabled for your account |
| `403` | `permission_denied` | The service account's roles don't grant the operation's action |
| `403` | `machine_credential_not_supported` | The operation doesn't accept a service account credential; call as a person |
| `404` | `not_found` | No Mac with that serial number is in your account |
| `422` | `problem_report_limit_reached` | Your account holds the maximum number of problem reports |
| `429` | | Too many requests; retry later |
| `501` | `unimplemented` | The capability is not available at your site |
| `503` | `unavailable` | Your account is being set up or changed, or the inventory is briefly unavailable; reads keep working while changes are refused. Retry later |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.