# Cheat sheet

> Everything on one page. Install, upgrade, models, Doctor, CLI, the API calls you use most, Keychain, licence, keyboard shortcuts, query language, files and ports.

Source: https://docs.3am.si/reference/cheat-sheet · Markdown: https://docs.3am.si/reference/cheat-sheet.md · All docs: https://docs.3am.si/llms.txt
3AM is an on-prem AI on-call engineer for regulated enterprises (https://3am.si).

## Install and upgrade

```bash
./install.sh --model-url https://openrouter.ai/api/v1 --model meta-llama/llama-3.3-70b-instruct --model-key-file ~/k   # no GPU
./install.sh                                    # a GPU host (8 GB+ VRAM), or an upgrade (options remembered)
./install.sh --doctor [--json]                  # 3AM Doctor
./install.sh --forget                           # ignore remembered options
./install.sh --uninstall [--purge]              # remove (and delete data)
./install.sh --keychain-join URL --keychain-site-key-file site.key   # a new site from its Keychain home
./install.sh --keychain file.json --keychain-passphrase-file pass    # a sealed Keychain
helm upgrade --install 3am 3am-0.4.23/helm/3am-0.4.23.tgz -n bank-ops --reuse-values
```

Recommended host: **8 vCPU, 32 GB, 100 GB SSD** (GCP `e2-standard-8`), models on a GPU or behind endpoints, **never the
CPU**. [Requirements](https://docs.3am.si/getting-started/requirements) · [Models](https://docs.3am.si/install/models) · [Every installer option](https://docs.3am.si/install/linux#every-installer-option)

## CLI (`podman exec 3am-core /opt/3am/3am-core …`)

| Command                                | Does                               |
| -------------------------------------- | ---------------------------------- |
| `doctor [--json]`                      | Health, check by check             |
| `preflight [--deep] [--json]`          | Host, licence, reach of every tool |
| `fingerprint`                          | This install's fingerprint         |
| `version`, `health`                    | Version; exit 0 if up              |
| `checks run ALERT…`                    | The diagnosis, read-only, now      |
| `packs list`                           | Packs the licence opens            |
| `connectors list\|check`               | Kinds; health of each              |
| `estate build`, `estate resolve ALERT` | Discovery; where an alert belongs  |
| `ledger-verify`, `licence-verify`      | The audit log; a licence file      |
| `digest [DAY]`                         | Write the daily digest             |

## API you use most

```bash
H="Authorization: Bearer $TOKEN"
curl -s -H "$H" $URL/v1/status                                   # mode, licence, version (no token needed)
curl -s -H "$H" $URL/v1/doctor?fresh=1                           # health
curl -s -H "$H" "$URL/v1/episodes?group=incident&limit=20"       # incidents
curl -sG -H "$H" $URL/v1/episodes --data-urlencode 'query=result:handed_over opened<7d'
curl -s -H "$H" $URL/v1/live                                     # what's running now
curl -s -X POST -H "$H" -d '{"reason":"freeze"}' $URL/v1/halt    # stop every action
curl -s -X POST -H "$H" $URL/v1/resume
curl -s -H "$H" "$URL/v1/ledger?order=asc&after_seq=0&limit=2000" # export the audit log
curl -s -X POST -H "Authorization: Bearer $INGEST" -d @alert.json $URL/v1/alerts/auto   # push an alert
```

[Every endpoint](https://docs.3am.si/reference/api)

## Keychain

| Do                     | Where                                                                                    |
| ---------------------- | ---------------------------------------------------------------------------------------- |
| Make the home          | Keychain → Make this the home · `POST /v1/keychain/home`                                 |
| Add a new host         | Add a site → A new host → its key → the line on the host · `POST /v1/keychain/site-keys` |
| Pair a running install | Add a site → An install already running → Open for 10 minutes; Join → Pair on the other  |
| No network             | Add a site → No network between them → seal; `install.sh --keychain` there               |
| Change what it carries | What it carries → switches · `POST /v1/keychain/scope`                                   |
| Keep a member's own    | Each part → Keep my own · `POST /v1/keychain/own`                                        |
| Move the home          | Members → Make it the home → six digits typed on the member                              |
| Home lost (15 min)     | On a member, an owner: Take over as the home                                             |

Not answering after 3 min; gone after a day; nothing removed by itself. [Keychain](https://docs.3am.si/licensing/keychain)

## Licence

|                |                                                                                                                               |
| -------------- | ----------------------------------------------------------------------------------------------------------------------------- |
| Tiers          | Starter (50 services, prod + DR), Enterprise (250+, **10 installs**, Keychain), Strategic (unlimited, site licence, Keychain) |
| Add an install | New install: Ask to join → six digits; an install on the licence: paste + type the digits                                     |
| Confirmation   | Warden, every 6 h; `THREEAM_LICENCE_CHECK=auto\|strict\|offline`                                                              |
| Trial          | 30 days, one install, `POST /v1/licence/redeem`                                                                               |

## Autonomy

`off` → `shadow` (default, records) → `L1` (asks) → `L2` (safe actions unasked). Raising: two approvers. Lowering: at
once. Fix mode: `advise` (default) or `draft` (drafted fixes and restore moves, two approvers each).

## Keyboard

`⌘K` command bar · `/` search · `?` this map · `[` fold nav · `g o` Overview · `g i` Incidents · `g a` Approvals ·
`g d` Digest · `g b` Impact · `g e` Estate · `g y` Study · `g u` Autonomy · `g c` Connections · `g l` Learned ·
`g t` Audit · `g h` Doctor · `g m` Team · `g r` Branding · `g k` Keychain · `g s` Settings · `g g` Guide · lists:
`j`/`k` `↵` `n`/`p` `f` `r`. [Keyboard](https://docs.3am.si/console/keyboard)

## Query language

`service:x outcome:mitigated` · `alert:MySQL* OR alert:X` · `-kind:symptom` · `note~"dead ?lock"` · `duration>5m` ·
`opened<7d` · `last:90d` · `data.channel:slack`. [Query language](https://docs.3am.si/reference/query-language)

## Files and ports

| Where                                | What                                                                                |
| ------------------------------------ | ----------------------------------------------------------------------------------- |
| `/var/lib/3am`                       | Data: audit log, incidents, settings, secrets (back it up)                          |
| `/etc/3am`                           | Optional config as code: `licence.json`, `connectors.json`, `policy.json`, `packs/` |
| `~/.3am/install.env`, `~/.3am/keys/` | The installer's remembered options and key copies                                   |
| `~/.3am/ingest-token`                | The ingest token                                                                    |
| `8700/tcp`                           | Console and API (in); optional webhooks and Keychain sync                           |
| `443` out                            | Your tools, model endpoints, `warden.3am.si`                                        |