Organisation: team, notifications, billing, audit log
Inviting members and their roles, notification channels, bills, the audit log, and the paths to do the same over HTTP (/api/v1).
Organisation: team, notifications, billing, audit log
Projects belong to an organisation. The tools below apply to the whole organisation, but like the other tools you call them with the ref of any project in it.
Each role has a fixed set of things it can do, and a token has exactly its owner's role.
With several organisations, the org of create_project (the organisation_id from list_projects, or the organisation's name) chooses which one to create it in. Only its owners, admins and developers can, within the number of projects its plan allows.
Team
list_team members, roles, two-step status, invitations not yet accepted
invite_member invite by email (admin | developer | billing | viewer)
cancel_invitation cancel an invitation you sent
set_member_role change a member's role
remove_member remove (the owner cannot be removed)
set_mfa_required require two-step sign-in for every memberThere is no way to add someone directly. They join when they open the link in the invitation email (7 days). Only owners and admins can change any of this.
Access groups and project access
list_access_groups groups, members, the role on each project
create_access_group make an empty group
update_access_group name, members (emails), the role on each project (developer | billing | viewer)
remove_access_group remove a group (its name in confirm)
get_member_access the projects one member opens
set_member_access every project (scoped false) or chosen ones only (scoped true)Shared environment variables
list_shared_env_vars variables the organisation gives several projects (developers and above)
create_shared_env_var create one (key, value, targets, projects)
update_shared_env_var change the value, targets and linked projects
remove_shared_env_var remove one (its name in confirm)Audit log drains, organisation webhooks
list_audit_drains where the audit log is sent (https | datadog | splunk | syslog)
create_audit_drain add a destination (the plan must include it)
set_audit_drain_enabled pause or send again
test_audit_drain send one test record
remove_audit_drain remove one
list_org_webhooks webhooks that send the organisation's notices, with signing secrets
create_org_webhook create one (events, projects: empty is all)
set_org_webhook_enabled pause or send again
test_org_webhook send a test event
list_org_webhook_deliveries deliveries
retry_org_webhook_delivery send one delivery again
remove_org_webhook remove oneOutside committers, SSO, deployment policies
get_committer_settings the outside committer policy, trusted committers, waiting previews
set_committer_policy auto | require
trust_committer previews by this email build without approval
remove_trusted_committer wait for approval again
answer_preview_approval answer a waiting preview (approve | trust | decline)
get_org_sso the organisation's OpenID Connect sign-in and domains
set_org_sso create or change it (only what is given, the plan must include it)
remove_org_sso remove it (the issuer in confirm)
add_org_sso_domain add a domain (returns the TXT record)
verify_org_sso_domain check the TXT record in DNS
remove_org_sso_domain remove a domain
get_org_policies new projects' default protection, ways to deploy, the preview domain
set_org_policies change them (only what is given)
set_preview_suffix set the preview domain (returns the TXT record)
verify_preview_suffix check the TXT record in DNS
remove_preview_suffix remove the preview domainAll of these apply to the whole organisation, so a connection held to one project (project_ref) does not show them. Only owners and admins can change them (audit log drains, those who read the audit log; reading shared variables, developers and above; a waiting preview, whoever can write to its project).
The organisation's OAuth apps (/org/apps) are credentials that act in the organisation's name, so the tools do not make them. A person makes them in the console.
Notification channels
list_channels Slack, KakaoWork and webhook channels, with the last delivery result
create_channel add (notices: deployments, domains, usage, billing)
test_channel send one test message
set_channel_enabled pause or resume
remove_channel deleteBilling and records
get_billing a month's bill and usage by day (owners, admins, billing)
get_audit_log who changed what (activity), who accessed personal data (access) (owners, admins)
rename_project rename the project or the organisation (owners, admins)
list_transfer_targets other organizations the project can move to (owners, admins)
transfer_project move the project to another organization (an owner of its organization, project name in confirm)
get_plan the current plan and the plans you can choose (owners, admins, billing)
get_spend_controls the spend cap, the monthly limit and this month's usage (owners, admins, billing)
set_spend_cap turn the spend cap on or off (owners, admins, billing)
set_spend_limit the monthly overage limit and its alert webhook (owners, admins, billing)Registering a card, changing plans, account passwords and tokens, and support requests are not done with tools. A person does them in the console.
The same over HTTP
Under https://<zone>/api/v1, send the same token as Authorization: Bearer. Paths for a project are under /projects/<ref>.
GET /regions POST /regions/requests {region, note}
GET /server-sizes?region=¤cy= server sizes and their monthly price per region (list_server_sizes)
PATCH /projects/<ref> {name, organisation}
GET /projects/<ref>/transfer POST /projects/<ref>/transfer {organisation, confirm}
GET /git POST /git/repos {provider, repo, branch}
PUT /git/tokens/<github|gitlab> {token, gitlab_base} DELETE same path
DELETE /git/github-app
GET /log-drains POST /log-drains {name, kind, url, secret, sources}
PATCH /log-drains/<id> {enabled} DELETE /log-drains/<id>
DELETE /users/<id> PUT /auth/anonymous {enabled}
GET /auth/sms PUT /auth/sms {provider, key, secret, account, sender, allowed_countries}
DELETE /auth/sms GET /auth/sso
GET /auth/smtp PUT /auth/smtp {sender_email, sender_name, host, port, username, password}
DELETE /auth/smtp POST /auth/smtp/test {to}
GET /auth/templates GET /auth/templates/<type> PUT /auth/templates/<type> {subject, body}
DELETE /auth/templates/<type> POST /auth/templates/<type>/preview {subject, body}
POST /auth/sso {metadata_url, domains} PUT /auth/sso/<id> {domains} DELETE /auth/sso/<id>
GET /config/auth PATCH /config/auth {<key>: <value>}
GET /config/auth/custom-providers POST /config/auth/custom-providers {identifier, name, provider_type, issuer, client_id, client_secret, claim_map, token_auth, pkce, jwks_uri, email_optional}
PUT /config/auth/custom-providers/<identifier> PATCH same path {enabled} DELETE same path
GET /config/auth/third-party-auth POST /config/auth/third-party-auth {type, value, region, audiences} DELETE /config/auth/third-party-auth/<id>
PUT /function-egress {enabled}
GET /server-memory
PUT /server-memory {memory_mb}
GET /concurrent-builds PUT /concurrent-builds {concurrent_builds}
GET /network POST /network/static-outbound-ip DELETE the same path
GET /team POST /team/invitations {email, role}
DELETE /team/invitations/<id> PUT /team/mfa {required}
PATCH /team/members/<email> {role} DELETE /team/members/<email>
GET /channels POST /channels {kind, name, url, notices}
POST /channels/<id>/test PATCH /channels/<id> {enabled} DELETE /channels/<id>
GET /realtime PUT /realtime/<table> {enabled}
GET /extensions PUT /extensions/<name> DELETE /extensions/<name>
GET /branches POST /branches {name, git_branch, with_seed} PUT /branching {automatic, seed_sql, lifetime_days}
POST /branches/<name>/merge POST /branches/<name>/reset DELETE /branches/<name>
GET /queues POST /queues {name, unlogged} PUT /queues/api {exposed} DELETE /queues/<name>
POST /queues/<name>/messages {message, delay} GET /queues/<name>/messages?limit= POST /queues/<name>/purge
GET /vault POST /vault {name, value, description} PATCH·DELETE /vault/<name>
GET /network-restrictions PUT /network-restrictions {allowed_cidrs, allow_all, enforce_ssl, confirm}
GET /metrics?range=24h GET /billing?period=YYYY-MM
GET /billing/plan GET /billing/spend
PUT /billing/spend-cap {enabled} PUT /billing/spend-limit {spend_limit_minor, webhook_url}
POST /deployments/sources (body: an archive) POST /deployments {source | files, target, prebuilt}
GET /buckets/<bucket>/objects?prefix= POST /buckets/<bucket>/objects {name, content, encoding, upsert}
GET /buckets/<bucket>/object?name= DELETE /buckets/<bucket>/object?name=
POST /buckets/<bucket>/signed-urls {name, expires_in}
PATCH /buckets/<bucket> {public, file_size_limit, allowed_mime_types} POST /buckets/<bucket>/empty DELETE /buckets/<bucket> {confirm}
PATCH /users/<id> {email, password, email_confirm, ban_duration, user_metadata, app_metadata}
POST /users/import {users, dry_run}
POST /users/<email>/links {type, password, data, redirect_to}
GET /tables/<table>/csv?column=&op=&value=&sort=&desc= POST /tables/<table>/csv {csv, columns}
POST /deployments/sources/upload-urls then PUT to that url (body: an archive, no token)
POST /projects {name, region, org}
GET /audit?tab=activity|access&from=&to=&actor=&action=&limit=&offset=
GET /signing PUT /signing {alg}
POST /signing/rotate {grace_hours} DELETE /signing/keys/<kid>
PUT /domains/<domain>/certificate {certificate, key} DELETE same path
PUT /domains/<domain>/redirect {to, status} to: a domain or domain/path, empty turns it off