Pinecone node reference - all 88 operations, the credential it needs, and a worked example.
Pinecone vector database (Data Store). 88 operations: vectors (upsert, query, fetch by ID or metadata, update, delete, list IDs, index stats), integrated-embedding records, namespaces, bulk imports, indexes, collections, backups and restore jobs, Inference (embed, rerank, models), Assistants (management, files, chat, context, evaluation), and the Admin API (organizations, projects, API keys, users, invites, service accounts, role bindings).
Credential: Pinecone API key + index host - see Credentials.
Each operation below lists the role it needs. Roles are chosen when the API key is created at app.pinecone.io and NEVER changeable afterwards - a key with the wrong role has to be replaced, not edited. Pinecone has no OAuth scopes and no per-operation grants; every key carries one role out of ProjectEditor/ProjectViewer (everything in the project), ControlPlaneEditor/ControlPlaneViewer (indexes, collections, backups, restore jobs, assistant management) and DataPlaneEditor/DataPlaneViewer (vectors, records, namespaces, imports). Editor implies Viewer, so a DataPlaneViewer key can query but not upsert - and Pinecone answers that write with a 403 whose body never names the missing role. Four things a failure here is NOT a role. First, and most expensive: the 32 Admin operations cannot be reached with an API key at all. /admin/* accepts only an Authorization: Bearer token minted at login.pinecone.io/oauth/token from an OAuth2 SERVICE ACCOUNT; a request carrying Api-Key gets 401 UNAUTHENTICATED - "Missing authorization header", because the key header is not merely insufficient, it is ignored - Pinecone's admin OpenAPI document declares no API-key scheme at all. Service accounts are additionally an Enterprise-plan feature in public preview, so on any other plan those operations cannot be made to work whatever is in the credential. Second, a 401 on the other planes is usually the PROJECT: keys are project-scoped, and a key from a different project in the same organization is rejected exactly like an invalid one. Third, a 404 on the data plane is very often the HOST - each index has its own regional host, and a request sent to the wrong index's host answers 404 identically to a record that does not exist. Fourth, a 400 is usually shape rather than permission: a vector whose length does not match the index dimension, a filtered delete on a serverless index (unsupported there), or a collection operation against a serverless index (collections are pod-only). And one trap that is not an error at all - pinning X-Pinecone-Api-Version to a stale version is ACCEPTED and silently routes to that version's much smaller surface, while omitting the header falls back to the OLDEST supported version rather than the newest. If a run fails with a permission error, the node names the missing role in the error - grant it and re-run; you do not need to rebuild the workflow.
| Operation | What it does | Role |
|---|
upsert | Upsert vectors | DataPlaneEditor |
query | Query vectors | DataPlaneViewer |
fetch | Fetch vectors by ID | DataPlaneViewer |
fetchByMetadata | Fetch vectors by metadata | DataPlaneViewer |
update | Update a vector | DataPlaneEditor |
deleteVectors | Delete vectors | DataPlaneEditor |
listVectorIds | List vector IDs | DataPlaneViewer |
describeIndexStats | Describe index stats | DataPlaneViewer |
| Operation | What it does | Role |
|---|
upsertRecords | Upsert text records | DataPlaneEditor |
searchRecords | Search records | DataPlaneViewer |
| Operation | What it does | Role |
|---|
listNamespaces | List namespaces | DataPlaneViewer |
describeNamespace | Describe namespace | DataPlaneViewer |
createNamespace | Create namespace | DataPlaneEditor |
deleteNamespace | Delete namespace | DataPlaneEditor |
| Operation | What it does | Role |
|---|
startImport | Start bulk import | DataPlaneEditor |
listImports | List bulk imports | DataPlaneViewer |
describeImport | Describe bulk import | DataPlaneViewer |
cancelImport | Cancel bulk import | DataPlaneEditor |
| Operation | What it does | Role |
|---|
listIndexes | List indexes | ControlPlaneViewer |
describeIndex | Describe index | ControlPlaneViewer |
createIndex | Create index | ControlPlaneEditor |
createIndexForModel | Create index with integrated embedding | ControlPlaneEditor |
configureIndex | Configure index | ControlPlaneEditor |
deleteIndex | Delete index | ControlPlaneEditor |
| Operation | What it does | Role |
|---|
listCollections | List collections | ControlPlaneViewer |
describeCollection | Describe collection | ControlPlaneViewer |
createCollection | Create collection | ControlPlaneEditor |
deleteCollection | Delete collection | ControlPlaneEditor |
| Operation | What it does | Role |
|---|
createBackup | Create backup | ControlPlaneEditor |
listIndexBackups | List backups for an index | ControlPlaneViewer |
listProjectBackups | List all backups | ControlPlaneViewer |
describeBackup | Describe backup | ControlPlaneViewer |
deleteBackup | Delete backup | ControlPlaneEditor |
createIndexFromBackup | Create index from backup | ControlPlaneEditor |
listRestoreJobs | List restore jobs | ControlPlaneViewer |
describeRestoreJob | Describe restore job | ControlPlaneViewer |
| Operation | What it does | Role |
|---|
embed | Generate embeddings | (any project API key — Inference is not role-gated) |
rerank | Rerank documents | (any project API key — Inference is not role-gated) |
listModels | List hosted models | (any project API key — Inference is not role-gated) |
describeModel | Describe hosted model | (any project API key — Inference is not role-gated) |
| Operation | What it does | Role |
|---|
listAssistants | List assistants | ControlPlaneViewer |
describeAssistant | Describe assistant | ControlPlaneViewer |
createAssistant | Create assistant | ControlPlaneEditor |
updateAssistant | Update assistant | ControlPlaneEditor |
deleteAssistant | Delete assistant | ControlPlaneEditor |
| Operation | What it does | Role |
|---|
listAssistantFiles | List assistant files | DataPlaneViewer |
describeAssistantFile | Describe assistant file | DataPlaneViewer |
uploadAssistantFile | Upload assistant file | DataPlaneEditor |
upsertAssistantFile | Replace assistant file | DataPlaneEditor |
deleteAssistantFile | Delete assistant file | DataPlaneEditor |
listAssistantOperations | List assistant operations | DataPlaneViewer |
describeAssistantOperation | Describe assistant operation | DataPlaneViewer |
| Operation | What it does | Role |
|---|
chatAssistant | Chat with assistant | DataPlaneViewer |
chatAssistantCompletions | Chat (OpenAI-compatible) | DataPlaneViewer |
assistantContext | Retrieve context snippets | DataPlaneViewer |
evaluateAnswer | Evaluate an answer | DataPlaneViewer |
| Operation | What it does | Role |
|---|
listOrganizations | List organizations | (no API-key role — the Admin API accepts only an OAuth2 service account, and the grant is that account's organization role. Service accounts are Enterprise-plan, public preview.) |
describeOrganization | Describe organization | (no API-key role — the Admin API accepts only an OAuth2 service account, and the grant is that account's organization role. Service accounts are Enterprise-plan, public preview.) |
updateOrganization | Update organization | (no API-key role — the Admin API accepts only an OAuth2 service account, and the grant is that account's organization role. Service accounts are Enterprise-plan, public preview.) |
deleteOrganization | Delete organization | (no API-key role — the Admin API accepts only an OAuth2 service account, and the grant is that account's organization role. Service accounts are Enterprise-plan, public preview.) |
listProjects | List projects | (no API-key role — the Admin API accepts only an OAuth2 service account, and the grant is that account's organization role. Service accounts are Enterprise-plan, public preview.) |
describeProject | Describe project | (no API-key role — the Admin API accepts only an OAuth2 service account, and the grant is that account's organization role. Service accounts are Enterprise-plan, public preview.) |
createProject | Create project | (no API-key role — the Admin API accepts only an OAuth2 service account, and the grant is that account's organization role. Service accounts are Enterprise-plan, public preview.) |
updateProject | Update project | (no API-key role — the Admin API accepts only an OAuth2 service account, and the grant is that account's organization role. Service accounts are Enterprise-plan, public preview.) |
deleteProject | Delete project | (no API-key role — the Admin API accepts only an OAuth2 service account, and the grant is that account's organization role. Service accounts are Enterprise-plan, public preview.) |
| Operation | What it does | Role |
|---|
listApiKeys | List API keys | (no API-key role — the Admin API accepts only an OAuth2 service account, and the grant is that account's organization role. Service accounts are Enterprise-plan, public preview.) |
describeApiKey | Describe API key | (no API-key role — the Admin API accepts only an OAuth2 service account, and the grant is that account's organization role. Service accounts are Enterprise-plan, public preview.) |
createApiKey | Create API key | (no API-key role — the Admin API accepts only an OAuth2 service account, and the grant is that account's organization role. Service accounts are Enterprise-plan, public preview.) |
updateApiKey | Update API key | (no API-key role — the Admin API accepts only an OAuth2 service account, and the grant is that account's organization role. Service accounts are Enterprise-plan, public preview.) |
deleteApiKey | Delete API key | (no API-key role — the Admin API accepts only an OAuth2 service account, and the grant is that account's organization role. Service accounts are Enterprise-plan, public preview.) |
| Operation | What it does | Role |
|---|
listUsers | List users | (no API-key role — the Admin API accepts only an OAuth2 service account, and the grant is that account's organization role. Service accounts are Enterprise-plan, public preview.) |
describeUser | Describe user | (no API-key role — the Admin API accepts only an OAuth2 service account, and the grant is that account's organization role. Service accounts are Enterprise-plan, public preview.) |
deleteUser | Remove user | (no API-key role — the Admin API accepts only an OAuth2 service account, and the grant is that account's organization role. Service accounts are Enterprise-plan, public preview.) |
listInvites | List invites | (no API-key role — the Admin API accepts only an OAuth2 service account, and the grant is that account's organization role. Service accounts are Enterprise-plan, public preview.) |
describeInvite | Describe invite | (no API-key role — the Admin API accepts only an OAuth2 service account, and the grant is that account's organization role. Service accounts are Enterprise-plan, public preview.) |
createInvite | Invite a user | (no API-key role — the Admin API accepts only an OAuth2 service account, and the grant is that account's organization role. Service accounts are Enterprise-plan, public preview.) |
resendInvite | Resend invite | (no API-key role — the Admin API accepts only an OAuth2 service account, and the grant is that account's organization role. Service accounts are Enterprise-plan, public preview.) |
deleteInvite | Revoke invite | (no API-key role — the Admin API accepts only an OAuth2 service account, and the grant is that account's organization role. Service accounts are Enterprise-plan, public preview.) |
| Operation | What it does | Role |
|---|
listServiceAccounts | List service accounts | (no API-key role — the Admin API accepts only an OAuth2 service account, and the grant is that account's organization role. Service accounts are Enterprise-plan, public preview.) |
describeServiceAccount | Describe service account | (no API-key role — the Admin API accepts only an OAuth2 service account, and the grant is that account's organization role. Service accounts are Enterprise-plan, public preview.) |
createServiceAccount | Create service account | (no API-key role — the Admin API accepts only an OAuth2 service account, and the grant is that account's organization role. Service accounts are Enterprise-plan, public preview.) |
updateServiceAccount | Update service account | (no API-key role — the Admin API accepts only an OAuth2 service account, and the grant is that account's organization role. Service accounts are Enterprise-plan, public preview.) |
deleteServiceAccount | Delete service account | (no API-key role — the Admin API accepts only an OAuth2 service account, and the grant is that account's organization role. Service accounts are Enterprise-plan, public preview.) |
rotateServiceAccountSecret | Rotate service account secret | (no API-key role — the Admin API accepts only an OAuth2 service account, and the grant is that account's organization role. Service accounts are Enterprise-plan, public preview.) |
listRoleBindings | List role bindings | (no API-key role — the Admin API accepts only an OAuth2 service account, and the grant is that account's organization role. Service accounts are Enterprise-plan, public preview.) |
describeRoleBinding | Describe role binding | (no API-key role — the Admin API accepts only an OAuth2 service account, and the grant is that account's organization role. Service accounts are Enterprise-plan, public preview.) |
createRoleBinding | Create role binding | (no API-key role — the Admin API accepts only an OAuth2 service account, and the grant is that account's organization role. Service accounts are Enterprise-plan, public preview.) |
deleteRoleBinding | Delete role binding | (no API-key role — the Admin API accepts only an OAuth2 service account, and the grant is that account's organization role. Service accounts are Enterprise-plan, public preview.) |