Operations

HighX generated projects expose operational routes under /_highx. They use the same tenant authentication and operator permissions as the rest of the Worker. The CLI reads bearer tokens from an environment variable, never from an argument.

export HIGHX_URL='https://app.example.com'
export HIGHX_TOKEN='...'

Workflow Runs

Inspect safe metadata without exposing workflow arguments or output:

highx workflow inspect run_123 --url "$HIGHX_URL" --token-env HIGHX_TOKEN

Cancel a run after inspection:

highx workflow cancel run_123 \
  --url "$HIGHX_URL" \
  --token-env HIGHX_TOKEN \
  --reason 'operator requested stop' \
  --yes

Cancellation is durable and idempotent. Completed output is not rewritten, and open approvals are closed so they cannot resume a cancelled run.

Dead Letters

List parked work. Results contain metadata and correlation IDs, never payloads:

highx dead-letter list webhooks --url "$HIGHX_URL" --token-env HIGHX_TOKEN

Replay or discard is explicit and requires confirmation:

highx dead-letter replay webhooks letter_123 --url "$HIGHX_URL" --token-env HIGHX_TOKEN --yes
highx dead-letter discard webhooks letter_123 --url "$HIGHX_URL" --token-env HIGHX_TOKEN --yes

Replay handlers are application-owned and must be idempotent. A failed replay leaves the letter parked; a successful replay removes it after the handler returns.

Backup And Restore

Export and check migration state before destructive changes:

highx tenant export --url "$HIGHX_URL" --token-env HIGHX_TOKEN > tenant-backup.json
highx tenant migration-status --url "$HIGHX_URL" --token-env HIGHX_TOKEN

Restore only into an empty tenant with matching schema and tenant identity:

highx tenant restore \
  --url "$HIGHX_URL" \
  --token-env HIGHX_TOKEN \
  --file tenant-backup.json \
  --yes

Restore rejects schema-version drift, a backup belonging to another tenant, and non-empty storage. Verify exports in a disposable tenant before production use.

Incident Checklist

• Capture run, dead-letter, request, and trace IDs before changing state.
• Inspect before cancelling, replaying, discarding, or restoring.
• Prefer replay over discard when the external effect is safely idempotent.
• Confirm migration status after deployment and before restore.
• Treat rate limits and concurrency limits as signals to investigate, not errors to bypass by retrying blindly.