What this form changes
Installation → Installation settings saves desired Panel metadata only. Its response explicitly reports system_changes_applied: false. Saving does not change Linux hostname, clock/timezone, interface addresses, DNS, firewall, HTTPS listeners or mail configuration. Those have separate reviewed service workflows.
Field reference
The configuration is version 1 and contains hostname, primary_ip, timezone and administrator_contact. Use a lowercase full hostname, an IP actually assigned to an active interface, an installed IANA timezone and a valid contact email. No scheme, path, whitespace or interface-scope suffix belongs in the address. A saved contact is not a verified recovery address or a notification subscription.
Review and save
Load GET /v1/foundation/settings and its current revision/digest/update time. Edit the values, review the before/after table and save with revision plus the configuration object. A fresh administrator with installation:manage is required. The server creates a prechange configuration snapshot before a successful save; inspect the confirmed new revision and refresh the backup list.
Restore saved metadata
GET /v1/foundation/backups?limit=25 lists prechange revisions, creation dates, SHA-256 and whether prior configuration is restorable. Select the intended snapshot, inspect its digest/revision and type RESTORE INSTALLATION SETTINGS exactly. Restore posts current revision, backup_id and confirmation to /v1/foundation/settings/restore; it creates a fresh snapshot first.
These snapshots contain Panel configuration metadata, not customer files, database data, mail or a whole operating system. Do not treat them as disaster-recovery backups.
Verify and handle uncertainty
After save/restore, reload and compare the exact revision, values and digest. Separately inspect Linux/service state if a real service change was intended. If the outcome, revision or backup inventory cannot be verified, use Reload saved settings before any retry. A stale or ambiguous response must not be treated as a failed save that can be repeated blindly. Preserve private configuration and use your own verified contact setup in Security for recovery/notification delivery.