Diagnostics

A certificate of the owner’s own: how it stands

Plex’s "Custom certificate location", "Custom certificate encryption key" and "Custom certificate domain" (2026-10-11): the file on the server’s disk (a PKCS#12 file, or a PEM certificate with its key), the domain and the HTTPS port it is served on, whether a passphrase is kept (never the passphrase), what the certificate says (subject, issuer, names, dates, fingerprint, whether the domain is one of its names), and whether its port serves it — problem says why not. address is https://<domain>[:<port>] while it is served: handed to apps in /server/connections and trusted as this server’s own.

Authorisation

Bearer token or API key · Session cookie

• 200Success. application/json · object
• 401UNAUTHENTICATED: no session, or the access token expired. application/json · ErrorEnvelope
• 403FORBIDDEN: the account lacks settings:manage, or the library, label, age or schedule scope refuses it. application/json · ErrorEnvelope

Serve a certificate of the owner’s own

Read, checked and served before it is kept, without a restart: the file readable, a certificate, its key the certificate’s, the domain one of its names, not run out, the port free and not one this server already uses (the HTTP port, HTTPS_PORT). The port is 8443 unless given. passphrase left out keeps the one kept, for the same files only; null clears it. It is sealed at rest and never sent back. Anything wrong is a VALIDATION_FAILED whose details.reason names it, and nothing changes. The files are read again twice a day, so a certificate renewed in place is taken up by itself.

Authorisation

Bearer token or API key · Session cookie

Body

application/json · object

• 200Success. application/json · object
• 400VALIDATION_FAILED: the request did not match the schema; details.issues lists what. VALIDATION_FAILED: The certificate cannot be served (details.reason: unreadable, not-a-certificate, passphrase, passphrase-sealed, no-key, key-mismatch, domain, expired, not-yet-valid, port). application/json · ErrorEnvelope
• 401UNAUTHENTICATED: no session, or the access token expired. application/json · ErrorEnvelope
• 403FORBIDDEN: the account lacks settings:manage, or the library, label, age or schedule scope refuses it. application/json · ErrorEnvelope

Stop serving the certificate of the owner’s own

Its port is closed, and the setting is forgotten with its passphrase; the files on disk are left alone.

Authorisation

Bearer token or API key · Session cookie

• 200Success. application/json · object
• 401UNAUTHENTICATED: no session, or the access token expired. application/json · ErrorEnvelope
• 403FORBIDDEN: the account lacks settings:manage, or the library, label, age or schedule scope refuses it. application/json · ErrorEnvelope

List what is being converted

Plex’s Status → Conversions: the download queue’s jobs, optimised copies and offline copies, the one being made first, with its progress.

Authorisation

Bearer token or API key · Session cookie

• 200Success. application/json · object
• 401UNAUTHENTICATED: no session, or the access token expired. application/json · ErrorEnvelope
• 403FORBIDDEN: the account lacks settings:manage, or the library, label, age or schedule scope refuses it. application/json · ErrorEnvelope

Read the server’s recent log

Admin → Console (Plex’s Console): the most recent lines this process logged, oldest first, at or above level, after after. Only plain values ride along with a line, never a request or a header, and values under keys that name secrets are replaced. A server with a separate worker shows the API process’s lines.

Authorisation

Bearer token or API key · Session cookie

• 200Success. application/json · object
• 400VALIDATION_FAILED: the request did not match the schema; details.issues lists what. application/json · ErrorEnvelope
• 401UNAUTHENTICATED: no session, or the access token expired. application/json · ErrorEnvelope
• 403FORBIDDEN: the account lacks settings:manage, or the library, label, age or schedule scope refuses it. application/json · ErrorEnvelope

Download the server’s recent log

Every line kept, as text, one a line: time, level, message and its values.

Authorisation

Bearer token or API key · Session cookie

• 200Success. text/plain ·
• 401UNAUTHENTICATED: no session, or the access token expired. application/json · ErrorEnvelope
• 403FORBIDDEN: the account lacks settings:manage, or the library, label, age or schedule scope refuses it. application/json · ErrorEnvelope

This host’s network cards

For Plex’s "Preferred network interface" (network.preferred_interface, 2026-10-11): each card with its addresses (loopback left out), whether it is a bridge to containers or virtual machines, whether the saved preference is a card or an address this host has now, and whether the main port listens on IPv6 now (network.ipv6 is read as the server starts).

Authorisation

Bearer token or API key · Session cookie

• 200Success. application/json · object
• 401UNAUTHENTICATED: no session, or the access token expired. application/json · ErrorEnvelope
• 403FORBIDDEN: the account lacks settings:manage, or the library, label, age or schedule scope refuses it. application/json · ErrorEnvelope

List the optimised copies

Plex’s Manage → Optimized Versions: every optimised copy the server keeps, largest first, with its item, library, height and size, and what they take together.

Authorisation

Bearer token or API key · Session cookie

• 200Success. application/json · object
• 401UNAUTHENTICATED: no session, or the access token expired. application/json · ErrorEnvelope
• 403FORBIDDEN: the account lacks settings:manage, or the library, label, age or schedule scope refuses it. application/json · ErrorEnvelope

Remove an optimised copy

The copy’s file and its row go. A library whose rule keeps copies of everything makes it again at night.

Authorisation

Bearer token or API key · Session cookie

• 204Success. application/json ·
• 401UNAUTHENTICATED: no session, or the access token expired. application/json · ErrorEnvelope
• 403FORBIDDEN: the account lacks settings:manage, or the library, label, age or schedule scope refuses it. application/json · ErrorEnvelope
• 404NOT_FOUND: no such thing, or not one the caller may see. application/json · ErrorEnvelope

Read whether the server can be reached from away

Plex’s Settings → Remote Access: the public address (null while PUBLIC_URL is the default), its last test as Diagnostics keeps it, the addresses at home, whether TRUSTED_PROXY names a proxy, the streams from away now and about what they send together, and the connection this came over. The rules for those streams are settings (network.remote_bitrate_limit_kbps, network.upload_speed_kbps, network.remote_streams_per_user, network.require_https_remote).

Authorisation

Bearer token or API key · Session cookie

• 200Success. application/json · object
• 401UNAUTHENTICATED: no session, or the access token expired. application/json · ErrorEnvelope
• 403FORBIDDEN: the account lacks settings:manage, or the library, label, age or schedule scope refuses it. application/json · ErrorEnvelope

Direct access: how it stands

Free (P6-52, docs/11 §6). The server reached from outside straight at its own HTTPS port (HTTPS_PORT), at the name collectoh.com gives it: address is https://<id>.<direct domain>:<router port>. Whether it may be switched on (claimed by a Collectoh account), whether it is, and how it is doing: the name, its certificate, the router (opened by the server over UPnP or NAT-PMP, or to be opened by its owner, with this server’s address at home to forward to), and collectoh.com’s last look from outside.

Authorisation

Bearer token or API key · Session cookie

• 200Success. application/json · DirectStatus
• 401UNAUTHENTICATED: no session, or the access token expired. application/json · ErrorEnvelope
• 403FORBIDDEN: the account lacks settings:manage, or the library, label, age or schedule scope refuses it. application/json · ErrorEnvelope

Switch direct access on or off, and say how the router is opened

On asks collectoh.com for the name at once; the certificate, the HTTPS port, the router and the look follow, and the answer says how far it got (ask again while it goes on). automatic: false leaves the router to its owner; wantedPort asks the router for another port than this server’s own. Off takes the router’s port back, closes the HTTPS port and tells collectoh.com, whose name then leads nowhere.

Authorisation

Bearer token or API key · Session cookie

Body

application/json · object

• 200Success. application/json · DirectStatus
• 400VALIDATION_FAILED: the request did not match the schema; details.issues lists what. application/json · ErrorEnvelope
• 401UNAUTHENTICATED: no session, or the access token expired. application/json · ErrorEnvelope
• 403FORBIDDEN: the account lacks settings:manage, or the library, label, age or schedule scope refuses it. application/json · ErrorEnvelope
• 409CONFLICT: Switched on before this server is claimed by a Collectoh account (details.reason is claim). application/json · ErrorEnvelope

Ask collectoh.com to look from outside now

What a phone on mobile data would find: TLS to the router’s port at the router’s address, ending with this server’s own certificate for its name. Waits for the answer, which is also how direct access stands now.

Authorisation

Bearer token or API key · Session cookie

• 200Success. application/json · DirectStatus
• 401UNAUTHENTICATED: no session, or the access token expired. application/json · ErrorEnvelope
• 403FORBIDDEN: the account lacks settings:manage, or the library, label, age or schedule scope refuses it. application/json · ErrorEnvelope

Collectoh Relay: how it stands

Plus (P6-21, docs/15). For a server nobody can reach from outside: a tunnel it holds open to a relay of ours, which visitors reach at address. TLS ends on this server, so the relay carries bytes it cannot read. Whether it may be switched on (claimed by a Collectoh account with Plus), whether it is, how it is doing, and what the relay carries for this server.

Authorisation

Bearer token or API key · Session cookie

• 200Success. application/json · RelayStatus
• 401UNAUTHENTICATED: no session, or the access token expired. application/json · ErrorEnvelope
• 403FORBIDDEN: the account lacks settings:manage, or the library, label, age or schedule scope refuses it. application/json · ErrorEnvelope

Switch Collectoh Relay on or off

On asks collectoh.com for a ticket at once, then opens the tunnel and gets the address its certificate. Off closes the tunnel and forgets the ticket. Apps still try the server’s own addresses first.

Authorisation

Bearer token or API key · Session cookie

Body

application/json · object

• 200Success. application/json · RelayStatus
• 400VALIDATION_FAILED: the request did not match the schema; details.issues lists what. application/json · ErrorEnvelope
• 401UNAUTHENTICATED: no session, or the access token expired. application/json · ErrorEnvelope
• 402PLUS_REQUIRED: The account has no Plus. application/json · ErrorEnvelope
• 403FORBIDDEN: the account lacks settings:manage, or the library, label, age or schedule scope refuses it. application/json · ErrorEnvelope
• 409CONFLICT: Switched on before this server is claimed by a Collectoh account (details.reason is claim). application/json · ErrorEnvelope

Read what the server is using

The dashboard’s graphs (Plex’s Status → Dashboard): the machine’s and this process’s processor and memory, and the bits a second sent to players at home and away, sampled every few seconds over the last hour, oldest first. In memory: a restart starts them again.

Authorisation

Bearer token or API key · Session cookie

• 200Success. application/json · object
• 401UNAUTHENTICATED: no session, or the access token expired. application/json · ErrorEnvelope
• 403FORBIDDEN: the account lacks settings:manage, or the library, label, age or schedule scope refuses it. application/json · ErrorEnvelope

Read whether a newer Collectoh is out

Plex’s "Check for updates": the running version (0.0.0 for a development build), whether the server looks by itself once a day (server.update_check), and what the last look at the release manifest found, kept through a failed look, whose reason is error.

Authorisation

Bearer token or API key · Session cookie

• 200Success. application/json · object
• 401UNAUTHENTICATED: no session, or the access token expired. application/json · ErrorEnvelope
• 403FORBIDDEN: the account lacks settings:manage, or the library, label, age or schedule scope refuses it. application/json · ErrorEnvelope

Look for a newer Collectoh now

One GET of the release manifest, whether or not the daily look is on. A newer version than the server’s is told to the admins once; a development build never tells.

Authorisation

Bearer token or API key · Session cookie

• 200Success. application/json · object
• 401UNAUTHENTICATED: no session, or the access token expired. application/json · ErrorEnvelope
• 403FORBIDDEN: the account lacks settings:manage, or the library, label, age or schedule scope refuses it. application/json · ErrorEnvelope

The diagnostics report

Authorisation

Bearer token or API key · Session cookie

• 200Success. application/json · DiagnosticsReport
• 400VALIDATION_FAILED: the request did not match the schema; details.issues lists what. application/json · ErrorEnvelope
• 401UNAUTHENTICATED: no session, or the access token expired. application/json · ErrorEnvelope
• 403FORBIDDEN: the account lacks settings:manage, or the library, label, age or schedule scope refuses it. application/json · ErrorEnvelope

The hardware report

What the last detection found, read as Settings stand now: the encoders and their probes, what a conversion will use, the device it opens and the devices there are to choose from for transcode.hw_device (render nodes, NVIDIA GPUs, Windows display adapters), whether the probes were run for the device chosen, and whether the card encodes or only decodes (transcode.hw_encode). Detects at once when nothing was stored yet.

Authorisation

Bearer token or API key · Session cookie

• 200Success. application/json · HardwareReport
• 401UNAUTHENTICATED: no session, or the access token expired. application/json · ErrorEnvelope
• 403FORBIDDEN: the account lacks settings:manage, or the library, label, age or schedule scope refuses it. application/json · ErrorEnvelope

Re-probe the hardware encoders

Runs the detection again — the synthetic probes on the device transcode.hw_device chooses, and the list of devices — and answers the new report; Settings → Transcoding’s "Look again" and the diagnostics page ask it. Detections run one at a time (2026-10-11): one asked for while another runs waits for it, and one already waiting is shared, reading the settings as it starts, so the newest device wins. A detection that fails says why on the report (detectionError).

Authorisation

Bearer token or API key · Session cookie

• 200Success. application/json · HardwareReport
• 401UNAUTHENTICATED: no session, or the access token expired. application/json · ErrorEnvelope
• 403FORBIDDEN: the account lacks settings:manage, or the library, label, age or schedule scope refuses it. application/json · ErrorEnvelope

Check remote access

Authorisation

Bearer token or API key · Session cookie

Body

application/json · object

• 200Success. application/json · object
• 400VALIDATION_FAILED: the request did not match the schema; details.issues lists what. application/json · ErrorEnvelope
• 401UNAUTHENTICATED: no session, or the access token expired. application/json · ErrorEnvelope
• 403FORBIDDEN: the account lacks settings:manage, or the library, label, age or schedule scope refuses it. application/json · ErrorEnvelope

Download the support bundle

Logs, the report and the config with secrets redacted, as a zip.

Authorisation

Bearer token or API key · Session cookie

• 200Success. application/zip ·
• 401UNAUTHENTICATED: no session, or the access token expired. application/json · ErrorEnvelope
• 403FORBIDDEN: the account lacks settings:manage, or the library, label, age or schedule scope refuses it. application/json · ErrorEnvelope