Node reference
Vercel
Vercel node reference - all 262 operations, the credential it needs, and a worked example.
Vercel REST API (Deploy & infra). 262 operations: deployments (create, cancel, delete, events, files, promote, rollback, runtime logs); aliases; projects, members and settings; project, shared and custom environment variables; project domains, account domains and DNS records; Edge Config and edge cache invalidation; deployment and project checks; certificates; webhooks; log drains; teams and members; account events and access tokens; web analytics; firewall and Attack Challenge mode; feature flags; rolling releases; project routes and bulk redirects; access groups; integrations and Git namespaces; remote-cache artifacts; container registry; microfrontends; Secure Compute networks; observability; the domain registrar; and Blob stores.
Credential: Vercel personal access token - see Credentials.
Each operation below lists the access requirement it needs. Access requirements are not ticked anywhere - Vercel publishes NO per-operation scopes. There is no OAuth authorization-code flow for normal API use, no scope checkboxes when a token is created, and - checked against Vercel's own machine-readable OpenAPI document, where exactly ONE of the 262 operations below mentions a role at all - no published per-endpoint role or plan mapping either. A token inherits whatever the user or team that owns it can already do. So the column below states what IS verifiable rather than inventing scope names: whether the operation reads or writes (Vercel's read-only roles, Viewer and Billing, can do the reads and none of the writes), the exact verb and path the node sends so the claim can be re-checked in one step, and - the field people actually get wrong - how the operation is scoped to a team. That last one is the expensive mistake. 229 of these 262 operations take an optional ?teamId= (or ?slug=) and, without it, resolve against whatever the token's own scope is: a personal token asked for a team's projects returns an EMPTY LIST, not an error, and nothing in the response says you asked the wrong account. Set the node's Team ID or Team Slug for anything a team owns. Twelve operations - the Teams group and the two team-wide feature-flag reads - name the team in the PATH instead, so a Team ID is required there and the node refuses without one; twenty-one more (GET /v2/user, the token reads, the unversioned /domains/records/{id}, /storage/stores/*, the insights toggles, the observability queries and three firewall config routes) take no team scope at all. Read the failures accordingly: a 403 carrying invalidToken is a bad, expired or revoked token (Vercel tokens can be created with an expiry, so "it worked last month" is a common shape of this), while a 403 on a resource you can see in the dashboard is almost always team scope. A 404 on a project you own is usually that same scope problem wearing a different hat. A 429 is not a permission at all - Vercel has no single global rate limit, only hundreds of per-action ones, and the X-RateLimit-Reset header says when the one you hit frees up. If a run fails with a permission error, the node names the missing access requirement in the error - grant it and re-run; you do not need to rebuild the workflow.
| Operation | What it does | Access requirement |
|---|
listDeployments | List deployments | (a read — GET /v7/deployments, team-scoped with ?teamId / ?slug) |
getDeployment | Get deployment | (a read — GET /v13/deployments/{idOrUrl}, team-scoped with ?teamId / ?slug) |
createDeployment | Create deployment | (a write — POST /v13/deployments, team-scoped with ?teamId / ?slug) |
cancelDeployment | Cancel deployment | (a write — PATCH /v12/deployments/{id}/cancel, team-scoped with ?teamId / ?slug) |
deleteDeployment | Delete deployment | (a destructive write — DELETE /v13/deployments/{id}, team-scoped with ?teamId / ?slug) |
getDeploymentEvents | Get deployment events (build logs) | (a read — GET /v3/deployments/{idOrUrl}/events, team-scoped with ?teamId / ?slug) |
listDeploymentFiles | List deployment files | (a read — GET /v6/deployments/{id}/files, team-scoped with ?teamId / ?slug) |
getDeploymentFile | Get deployment file contents | (a read — GET /v8/deployments/{id}/files/{fileId}, team-scoped with ?teamId / ?slug) |
promoteDeployment | Promote deployment to production | (a write — POST /v10/projects/{projectId}/promote/{deploymentId}, team-scoped with ?teamId / ?slug) |
listPromoteAliases | List promote alias status | (a read — GET /v1/projects/{projectId}/promote/aliases, team-scoped with ?teamId / ?slug) |
rollbackDeployment | Roll back production to a deployment | (a write — POST /v1/projects/{projectId}/rollback/{deploymentId}, team-scoped with ?teamId / ?slug) |
getRuntimeLogs | Get deployment runtime logs | (a read — GET /v1/projects/{projectId}/deployments/{deploymentId}/runtime-logs, team-scoped with ?teamId / ?slug) |
| Operation | What it does | Access requirement |
|---|
listAliases | List aliases | (a read — GET /v4/aliases, team-scoped with ?teamId / ?slug) |
getAlias | Get alias | (a read — GET /v4/aliases/{idOrAlias}, team-scoped with ?teamId / ?slug) |
listDeploymentAliases | List aliases of a deployment | (a read — GET /v2/deployments/{id}/aliases, team-scoped with ?teamId / ?slug) |
assignAlias | Assign alias to a deployment | (a write — POST /v2/deployments/{id}/aliases, team-scoped with ?teamId / ?slug) |
deleteAlias | Delete alias | (a destructive write — DELETE /v2/aliases/{aliasId}, team-scoped with ?teamId / ?slug) |
updateAliasProtectionBypass | Update protection bypass for a URL | (a write — PATCH /aliases/{id}/protection-bypass, team-scoped with ?teamId / ?slug) |
| Operation | What it does | Access requirement |
|---|
listProjects | List projects | (a read — GET /v10/projects, team-scoped with ?teamId / ?slug) |
getProject | Get project | (a read — GET /v9/projects/{idOrName}, team-scoped with ?teamId / ?slug) |
createProject | Create project | (a write — POST /v11/projects, team-scoped with ?teamId / ?slug) |
updateProject | Update project settings | (a write — PATCH /v9/projects/{idOrName}, team-scoped with ?teamId / ?slug) |
deleteProject | Delete project | (a destructive write — DELETE /v9/projects/{idOrName}, team-scoped with ?teamId / ?slug) |
pauseProject | Pause project | (a write — POST /v1/projects/{projectId}/pause, team-scoped with ?teamId / ?slug) |
unpauseProject | Unpause project | (a write — POST /v1/projects/{projectId}/unpause, team-scoped with ?teamId / ?slug) |
updateProjectProtectionBypass | Update automation bypass secret | (a write — PATCH /v1/projects/{idOrName}/protection-bypass, team-scoped with ?teamId / ?slug) |
listProjectMembers | List project members | (a read — GET /v1/projects/{idOrName}/members, team-scoped with ?teamId / ?slug) |
addProjectMember | Add project member | (a write — POST /v1/projects/{idOrName}/members, team-scoped with ?teamId / ?slug) |
removeProjectMember | Remove project member | (a destructive write — DELETE /v1/projects/{idOrName}/members/{uid}, team-scoped with ?teamId / ?slug) |
| Operation | What it does | Access requirement |
|---|
listProjectEnvs | List project environment variables | (a read — GET /v10/projects/{idOrName}/env, team-scoped with ?teamId / ?slug) |
getProjectEnv | Get environment variable (decrypted) | (a read — GET /v1/projects/{idOrName}/env/{id}, team-scoped with ?teamId / ?slug) |
createProjectEnv | Create environment variable(s) | (a write — POST /v10/projects/{idOrName}/env, team-scoped with ?teamId / ?slug) |
updateProjectEnv | Update environment variable | (a write — PATCH /v9/projects/{idOrName}/env/{id}, team-scoped with ?teamId / ?slug) |
deleteProjectEnv | Delete environment variable | (a destructive write — DELETE /v9/projects/{idOrName}/env/{id}, team-scoped with ?teamId / ?slug) |
batchDeleteProjectEnvs | Delete several environment variables | (a destructive write — DELETE /v1/projects/{idOrName}/env, team-scoped with ?teamId / ?slug) |
| Operation | What it does | Access requirement |
|---|
listSharedEnvs | List shared environment variables | (a read — GET /v1/env, team-scoped with ?teamId / ?slug) |
getSharedEnv | Get shared environment variable (decrypted) | (a read — GET /v1/env/{id}, team-scoped with ?teamId / ?slug) |
createSharedEnvs | Create shared environment variable(s) | (a write — POST /v1/env, team-scoped with ?teamId / ?slug) |
updateSharedEnvs | Update shared environment variable(s) | (a write — PATCH /v1/env, team-scoped with ?teamId / ?slug) |
deleteSharedEnvs | Delete shared environment variable(s) | (a destructive write — DELETE /v1/env, team-scoped with ?teamId / ?slug) |
unlinkSharedEnv | Unlink shared variable from a project | (a write — PATCH /v1/env/{id}/unlink/{projectId}, team-scoped with ?teamId / ?slug) |
listCustomEnvironments | List custom environments | (a read — GET /v9/projects/{idOrName}/custom-environments, team-scoped with ?teamId / ?slug) |
createCustomEnvironment | Create custom environment | (a write — POST /v9/projects/{idOrName}/custom-environments, team-scoped with ?teamId / ?slug) |
getCustomEnvironment | Get custom environment | (a read — GET /v9/projects/{idOrName}/custom-environments/{environmentSlugOrId}, team-scoped with ?teamId / ?slug) |
updateCustomEnvironment | Update custom environment | (a write — PATCH /v9/projects/{idOrName}/custom-environments/{environmentSlugOrId}, team-scoped with ?teamId / ?slug) |
deleteCustomEnvironment | Delete custom environment | (a destructive write — DELETE /v9/projects/{idOrName}/custom-environments/{environmentSlugOrId}, team-scoped with ?teamId / ?slug) |
| Operation | What it does | Access requirement |
|---|
listProjectDomains | List project domains | (a read — GET /v9/projects/{idOrName}/domains, team-scoped with ?teamId / ?slug) |
getProjectDomain | Get project domain | (a read — GET /v9/projects/{idOrName}/domains/{domain}, team-scoped with ?teamId / ?slug) |
addProjectDomain | Add domain to project | (a write — POST /v10/projects/{idOrName}/domains, team-scoped with ?teamId / ?slug) |
updateProjectDomain | Update project domain | (a write — PATCH /v9/projects/{idOrName}/domains/{domain}, team-scoped with ?teamId / ?slug) |
removeProjectDomain | Remove domain from project | (a destructive write — DELETE /v9/projects/{idOrName}/domains/{domain}, team-scoped with ?teamId / ?slug) |
verifyProjectDomain | Verify project domain | (a write — POST /v9/projects/{idOrName}/domains/{domain}/verify, team-scoped with ?teamId / ?slug) |
moveProjectDomain | Move project domain | (a write — POST /v1/projects/{idOrName}/domains/{domain}/move, team-scoped with ?teamId / ?slug) |
| Operation | What it does | Access requirement |
|---|
listDomains | List domains | (a read — GET /v5/domains, team-scoped with ?teamId / ?slug) |
getDomain | Get domain | (a read — GET /v5/domains/{domain}, team-scoped with ?teamId / ?slug) |
addDomain | Add / transfer-in a domain | (a write — POST /v7/domains, team-scoped with ?teamId / ?slug) |
updateDomain | Update or move apex domain | (a write — PATCH /v3/domains/{domain}, team-scoped with ?teamId / ?slug) |
deleteDomain | Remove domain | (a destructive write — DELETE /v6/domains/{domain}, team-scoped with ?teamId / ?slug) |
getDomainConfig | Get domain configuration | (a read — GET /v6/domains/{domain}/config, team-scoped with ?teamId / ?slug) |
getDomainVerification | Get domain verification record | (a read — GET /v9/domains/{domain}/verification, team-scoped with ?teamId / ?slug) |
claimDomain | Claim domain ownership | (a write — POST /v9/domains/{domain}/claim, team-scoped with ?teamId / ?slug) |
listDomainProjectDomains | List project domains by apex domain | (a read — GET /v1/domains/{domain}/project-domains, team-scoped with ?teamId / ?slug) |
| Operation | What it does | Access requirement |
|---|
listDnsRecords | List DNS records | (a read — GET /v5/domains/{domain}/records, team-scoped with ?teamId / ?slug) |
getDnsRecord | Get DNS record | (a read — GET /domains/records/{recordId}, account-global, so the token's own scope decides) |
createDnsRecord | Create DNS record | (a write — POST /v2/domains/{domain}/records, team-scoped with ?teamId / ?slug) |
updateDnsRecord | Update DNS record | (a write — PATCH /v1/domains/records/{recordId}, team-scoped with ?teamId / ?slug) |
deleteDnsRecord | Delete DNS record | (a destructive write — DELETE /v2/domains/{domain}/records/{recordId}, team-scoped with ?teamId / ?slug) |
replaceDnsRecords | Replace all DNS records for a domain | (a write — PUT /domains/{domain}/records, account-global, so the token's own scope decides) |
| Operation | What it does | Access requirement |
|---|
listEdgeConfigs | List Edge Configs | (a read — GET /v1/global-config, team-scoped with ?teamId / ?slug) |
createEdgeConfig | Create Edge Config | (a write — POST /v1/global-config, team-scoped with ?teamId / ?slug) |
getEdgeConfig | Get Edge Config | (a read — GET /v1/global-config/{edgeConfigId}, team-scoped with ?teamId / ?slug) |
updateEdgeConfig | Update Edge Config | (a write — PUT /v1/global-config/{edgeConfigId}, team-scoped with ?teamId / ?slug) |
deleteEdgeConfig | Delete Edge Config | (a destructive write — DELETE /v1/global-config/{edgeConfigId}, team-scoped with ?teamId / ?slug) |
listEdgeConfigItems | List Edge Config items | (a read — GET /v1/global-config/{edgeConfigId}/items, team-scoped with ?teamId / ?slug) |
getEdgeConfigItem | Get one Edge Config item | (a read — GET /v1/global-config/{edgeConfigId}/item/{edgeConfigItemKey}, team-scoped with ?teamId / ?slug) |
updateEdgeConfigItems | Upsert / delete items in batch | (a write — PATCH /v1/global-config/{edgeConfigId}/items, team-scoped with ?teamId / ?slug) |
getEdgeConfigSchema | Get Edge Config schema | (a read — GET /v1/global-config/{edgeConfigId}/schema, team-scoped with ?teamId / ?slug) |
updateEdgeConfigSchema | Update Edge Config schema | (a write — POST /v1/global-config/{edgeConfigId}/schema, team-scoped with ?teamId / ?slug) |
deleteEdgeConfigSchema | Delete Edge Config schema | (a destructive write — DELETE /v1/global-config/{edgeConfigId}/schema, team-scoped with ?teamId / ?slug) |
listEdgeConfigTokens | List Edge Config read tokens | (a read — GET /v1/global-config/{edgeConfigId}/tokens, team-scoped with ?teamId / ?slug) |
createEdgeConfigToken | Create Edge Config read token | (a write — POST /v1/global-config/{edgeConfigId}/token, team-scoped with ?teamId / ?slug) |
getEdgeConfigToken | Get Edge Config read token | (a read — GET /v1/global-config/{edgeConfigId}/token/{token}, team-scoped with ?teamId / ?slug) |
deleteEdgeConfigTokens | Delete Edge Config read tokens | (a destructive write — DELETE /v1/global-config/{edgeConfigId}/tokens, team-scoped with ?teamId / ?slug) |
listEdgeConfigBackups | List Edge Config backups | (a read — GET /v1/global-config/{edgeConfigId}/backups, team-scoped with ?teamId / ?slug) |
getEdgeConfigBackup | Get Edge Config backup | (a read — GET /v1/global-config/{edgeConfigId}/backups/{edgeConfigBackupVersionId}, team-scoped with ?teamId / ?slug) |
restoreEdgeConfigBackup | Restore Edge Config backup | (a write — POST /v1/global-config/{edgeConfigId}/backups/{edgeConfigBackupVersionId}/restore, team-scoped with ?teamId / ?slug) |
| Operation | What it does | Access requirement |
|---|
invalidateCacheByTags | Invalidate cached responses by tag | (a write — POST /v1/edge-cache/invalidate-by-tags, team-scoped with ?teamId / ?slug) |
invalidateCacheBySrcImages | Invalidate optimized images by source | (a write — POST /v1/edge-cache/invalidate-by-src-images, team-scoped with ?teamId / ?slug) |
| Operation | What it does | Access requirement |
|---|
listDeploymentChecks | List checks on a deployment | (a read — GET /v1/deployments/{deploymentId}/checks, team-scoped with ?teamId / ?slug) |
createDeploymentCheck | Create check on a deployment | (a write — POST /v1/deployments/{deploymentId}/checks, team-scoped with ?teamId / ?slug) |
getDeploymentCheck | Get check | (a read — GET /v1/deployments/{deploymentId}/checks/{checkId}, team-scoped with ?teamId / ?slug) |
updateDeploymentCheck | Update check | (a write — PATCH /v1/deployments/{deploymentId}/checks/{checkId}, team-scoped with ?teamId / ?slug) |
rerequestDeploymentCheck | Re-request check | (a write — POST /v1/deployments/{deploymentId}/checks/{checkId}/rerequest, team-scoped with ?teamId / ?slug) |
| Operation | What it does | Access requirement |
|---|
listProjectChecks | List project checks | (a read — GET /v2/projects/{projectIdOrName}/checks, team-scoped with ?teamId / ?slug) |
createProjectCheck | Create project check | (a write — POST /v2/projects/{projectIdOrName}/checks, team-scoped with ?teamId / ?slug) |
getProjectCheck | Get project check | (a read — GET /v2/projects/{projectIdOrName}/checks/{checkId}, team-scoped with ?teamId / ?slug) |
updateProjectCheck | Update project check | (a write — PATCH /v2/projects/{projectIdOrName}/checks/{checkId}, team-scoped with ?teamId / ?slug) |
deleteProjectCheck | Delete project check | (a destructive write — DELETE /v2/projects/{projectIdOrName}/checks/{checkId}, team-scoped with ?teamId / ?slug) |
listProjectCheckRuns | List runs of a project check | (a read — GET /v2/projects/{projectIdOrName}/checks/{checkId}/runs, team-scoped with ?teamId / ?slug) |
listDeploymentCheckRuns | List check runs on a deployment | (a read — GET /v2/deployments/{deploymentId}/check-runs, team-scoped with ?teamId / ?slug) |
createDeploymentCheckRun | Create check run | (a write — POST /v2/deployments/{deploymentId}/check-runs, team-scoped with ?teamId / ?slug) |
getDeploymentCheckRun | Get check run | (a read — GET /v2/deployments/{deploymentId}/check-runs/{checkRunId}, team-scoped with ?teamId / ?slug) |
updateDeploymentCheckRun | Update check run | (a write — PATCH /v2/deployments/{deploymentId}/check-runs/{checkRunId}, team-scoped with ?teamId / ?slug) |
| Operation | What it does | Access requirement |
|---|
listCerts | List certificates | (a read — GET /v8/certs, team-scoped with ?teamId / ?slug) |
getCert | Get certificate | (a read — GET /v8/certs/{id}, team-scoped with ?teamId / ?slug) |
issueCert | Issue certificate | (a write — POST /v8/certs, team-scoped with ?teamId / ?slug) |
uploadCert | Upload certificate | (a write — PUT /v8/certs, team-scoped with ?teamId / ?slug) |
removeCert | Remove certificate | (a destructive write — DELETE /v8/certs/{id}, team-scoped with ?teamId / ?slug) |
| Operation | What it does | Access requirement |
|---|
listWebhooks | List webhooks | (a read — GET /v1/webhooks, team-scoped with ?teamId / ?slug) |
createWebhook | Create webhook | (a write — POST /v1/webhooks, team-scoped with ?teamId / ?slug) |
getWebhook | Get webhook | (a read — GET /v1/webhooks/{id}, team-scoped with ?teamId / ?slug) |
deleteWebhook | Delete webhook | (a destructive write — DELETE /v1/webhooks/{id}, team-scoped with ?teamId / ?slug) |
| Operation | What it does | Access requirement |
|---|
listDrains | List drains | (a read — GET /v1/drains, team-scoped with ?teamId / ?slug) |
createDrain | Create drain | (a write — POST /v1/drains, team-scoped with ?teamId / ?slug) |
getDrain | Get drain | (a read — GET /v1/drains/{id}, team-scoped with ?teamId / ?slug) |
updateDrain | Update drain | (a write — PATCH /v1/drains/{id}, team-scoped with ?teamId / ?slug) |
deleteDrain | Delete drain | (a destructive write — DELETE /v1/drains/{id}, team-scoped with ?teamId / ?slug) |
testDrain | Validate drain delivery configuration | (a read — POST /v1/drains/test, team-scoped with ?teamId / ?slug) |
| Operation | What it does | Access requirement |
|---|
listTeams | List teams | (a read — GET /v2/teams, account-global, so the token's own scope decides) |
getTeam | Get team | (a read — GET /v2/teams/{teamId}, the team is named in the path so a Team ID is required) |
createTeam | Create team | (a write — POST /v1/teams, account-global, so the token's own scope decides) |
updateTeam | Update team | (a write — PATCH /v2/teams/{teamId}, the team is named in the path so a Team ID is required) |
listTeamMembers | List team members | (a read — GET /v3/teams/{teamId}/members, the team is named in the path so a Team ID is required) |
inviteTeamMember | Invite user to team | (a write — POST /v2/teams/{teamId}/members, the team is named in the path so a Team ID is required) |
updateTeamMember | Update team member | (a write — PATCH /v1/teams/{teamId}/members/{uid}, the team is named in the path so a Team ID is required) |
removeTeamMember | Remove team member | (a destructive write — DELETE /v1/teams/{teamId}/members/{uid}, the team is named in the path so a Team ID is required) |
deleteTeamInvite | Delete team invite code | (a destructive write — DELETE /v1/teams/{teamId}/invites/{inviteId}, the team is named in the path so a Team ID is required) |
requestTeamAccess | Request access to a team | (a write — POST /v1/teams/{teamId}/request, the team is named in the path so a Team ID is required) |
getTeamAccessRequest | Get team access request status | (a read — GET /v1/teams/{teamId}/request/{userId}, the team is named in the path so a Team ID is required) |
joinTeam | Join a team | (a write — POST /v1/teams/{teamId}/members/teams/join, the team is named in the path so a Team ID is required) |
| Operation | What it does | Access requirement |
|---|
getUser | Get authenticated user | (a read — GET /v2/user, account-global, so the token's own scope decides) |
listUserEvents | List account / team events | (a read — GET /v3/events, team-scoped with ?teamId / ?slug) |
listEventTypes | List event types | (a read — GET /v1/events/types, team-scoped with ?teamId / ?slug) |
listAuthTokens | List access tokens | (a read — GET /v6/user/tokens, account-global, so the token's own scope decides) |
getAuthToken | Get access token metadata | (a read — GET /v5/user/tokens/{tokenId}, account-global, so the token's own scope decides) |
createAuthToken | Create access token | (a write — POST /v3/user/tokens, team-scoped with ?teamId / ?slug) |
deleteAuthToken | Delete access token | (a destructive write — DELETE /v3/user/tokens/{tokenId}, account-global, so the token's own scope decides) |
| Operation | What it does | Access requirement |
|---|
aggregatePageviews | Aggregate page views | (a read — GET /v1/query/web-analytics/visits/aggregate, team-scoped with ?teamId / ?slug) |
countPageviews | Count page views | (a read — GET /v1/query/web-analytics/visits/count, team-scoped with ?teamId / ?slug) |
aggregateCustomEvents | Aggregate custom events | (a read — GET /v1/query/web-analytics/events/aggregate, team-scoped with ?teamId / ?slug) |
countCustomEvents | Count custom events | (a read — GET /v1/query/web-analytics/events/count, team-scoped with ?teamId / ?slug) |
| Operation | What it does | Access requirement |
|---|
updateAttackChallengeMode | Toggle Attack Challenge mode | (a write — POST /v1/security/attack-mode, team-scoped with ?teamId / ?slug) |
getActiveFirewallConfig | Get active firewall configuration | (a read — GET /v1/security/firewall/config, account-global, so the token's own scope decides) |
getFirewallConfigVersion | Get a firewall configuration version | (a read — GET /v1/security/firewall/config/{configVersion}, team-scoped with ?teamId / ?slug) |
updateFirewallConfig | Update firewall configuration | (a write — PATCH /v1/security/firewall/config, team-scoped with ?teamId / ?slug) |
putFirewallConfig | Replace firewall configuration | (a write — PUT /v1/security/firewall/config, team-scoped with ?teamId / ?slug) |
activateFirewallConfig | Activate a firewall configuration version | (a write — POST /v1/security/firewall/config/{configVersion}/activate, account-global, so the token's own scope decides) |
deleteFirewallConfigVersion | Delete a firewall configuration version | (a destructive write — DELETE /v1/security/firewall/config/{configVersion}, account-global, so the token's own scope decides) |
getFirewallAttackStatus | Read active attack data | (a read — GET /v1/security/firewall/attack-status, team-scoped with ?teamId / ?slug) |
getFirewallEvents | Read firewall actions by project | (a read — GET /v1/security/firewall/events, account-global, so the token's own scope decides) |
listFirewallBypass | List system bypass rules | (a read — GET /v1/security/firewall/bypass, team-scoped with ?teamId / ?slug) |
addFirewallBypass | Create system bypass rule | (a write — POST /v1/security/firewall/bypass, team-scoped with ?teamId / ?slug) |
removeFirewallBypass | Remove system bypass rule | (a destructive write — DELETE /v1/security/firewall/bypass, team-scoped with ?teamId / ?slug) |
generateFirewallRule | Generate firewall rule from a description | (a read — POST /v1/security/firewall/config/generate-rule, team-scoped with ?teamId / ?slug) |
| Operation | What it does | Access requirement |
|---|
listFlags | List project flags | (a read — GET /v2/projects/{projectIdOrName}/feature-flags/flags, team-scoped with ?teamId / ?slug) |
createFlag | Create flag | (a write — PUT /v1/projects/{projectIdOrName}/feature-flags/flags, team-scoped with ?teamId / ?slug) |
getFlag | Get flag | (a read — GET /v1/projects/{projectIdOrName}/feature-flags/flags/{flagIdOrSlug}, team-scoped with ?teamId / ?slug) |
updateFlag | Update flag | (a write — PATCH /v1/projects/{projectIdOrName}/feature-flags/flags/{flagIdOrSlug}, team-scoped with ?teamId / ?slug) |
deleteFlag | Delete flag | (a destructive write — DELETE /v1/projects/{projectIdOrName}/feature-flags/flags/{flagIdOrSlug}, team-scoped with ?teamId / ?slug) |
listFlagVersions | List flag versions | (a read — GET /v1/projects/{projectIdOrName}/feature-flags/flags/{flagIdOrSlug}/versions, team-scoped with ?teamId / ?slug) |
listFlagSegments | List flag segments | (a read — GET /v1/projects/{projectIdOrName}/feature-flags/segments, team-scoped with ?teamId / ?slug) |
createFlagSegment | Create flag segment | (a write — PUT /v1/projects/{projectIdOrName}/feature-flags/segments, team-scoped with ?teamId / ?slug) |
getFlagSegment | Get flag segment | (a read — GET /v1/projects/{projectIdOrName}/feature-flags/segments/{segmentIdOrSlug}, team-scoped with ?teamId / ?slug) |
updateFlagSegment | Update flag segment | (a write — PATCH /v1/projects/{projectIdOrName}/feature-flags/segments/{segmentIdOrSlug}, team-scoped with ?teamId / ?slug) |
deleteFlagSegment | Delete flag segment | (a destructive write — DELETE /v1/projects/{projectIdOrName}/feature-flags/segments/{segmentIdOrSlug}, team-scoped with ?teamId / ?slug) |
getFlagSettings | Get project flag settings | (a read — GET /v1/projects/{projectIdOrName}/feature-flags/settings, team-scoped with ?teamId / ?slug) |
updateFlagSettings | Update project flag settings | (a write — PATCH /v1/projects/{projectIdOrName}/feature-flags/settings, team-scoped with ?teamId / ?slug) |
listSdkKeys | List flag SDK keys | (a read — GET /v1/projects/{projectIdOrName}/feature-flags/sdk-keys, team-scoped with ?teamId / ?slug) |
createSdkKey | Create flag SDK key | (a write — PUT /v1/projects/{projectIdOrName}/feature-flags/sdk-keys, team-scoped with ?teamId / ?slug) |
deleteSdkKey | Delete flag SDK key | (a destructive write — DELETE /v1/projects/{projectIdOrName}/feature-flags/sdk-keys/{hashKey}, team-scoped with ?teamId / ?slug) |
listTeamFlags | List all flags for a team | (a read — GET /v2/teams/{teamId}/feature-flags/flags, the team is named in the path so a Team ID is required) |
listTeamFlagSettings | List team project flag settings | (a read — GET /v1/teams/{teamId}/feature-flags/settings, the team is named in the path so a Team ID is required) |
getDeploymentFeatureFlags | Get feature flags of a deployment | (a read — GET /v1/deployments/{deploymentId}/feature-flags, team-scoped with ?teamId / ?slug) |
| Operation | What it does | Access requirement |
|---|
getRollingRelease | Get active rolling release | (a read — GET /v1/projects/{idOrName}/rolling-release, team-scoped with ?teamId / ?slug) |
getRollingReleaseConfig | Get rolling release configuration | (a read — GET /v1/projects/{idOrName}/rolling-release/config, team-scoped with ?teamId / ?slug) |
updateRollingReleaseConfig | Update rolling release configuration | (a write — PATCH /v1/projects/{idOrName}/rolling-release/config, team-scoped with ?teamId / ?slug) |
deleteRollingReleaseConfig | Delete rolling release configuration | (a destructive write — DELETE /v1/projects/{idOrName}/rolling-release/config, team-scoped with ?teamId / ?slug) |
startRollingRelease | Start rolling release | (a write — POST /v1/projects/{idOrName}/rolling-release/start, team-scoped with ?teamId / ?slug) |
approveRollingReleaseStage | Approve next rolling release stage | (a write — POST /v1/projects/{idOrName}/rolling-release/approve-stage, team-scoped with ?teamId / ?slug) |
completeRollingRelease | Complete rolling release | (a write — POST /v1/projects/{idOrName}/rolling-release/complete, team-scoped with ?teamId / ?slug) |
getRollingReleaseBilling | Get rolling release billing status | (a read — GET /v1/projects/{idOrName}/rolling-release/billing, team-scoped with ?teamId / ?slug) |
| Operation | What it does | Access requirement |
|---|
listProjectRoutes | Get project routing rules | (a read — GET /v1/projects/{projectId}/routes, team-scoped with ?teamId / ?slug) |
addProjectRoute | Add routing rule | (a write — POST /v1/projects/{projectId}/routes, team-scoped with ?teamId / ?slug) |
stageProjectRoutes | Stage routing rules | (a write — PUT /v1/projects/{projectId}/routes, team-scoped with ?teamId / ?slug) |
updateProjectRoute | Edit routing rule | (a write — PATCH /v1/projects/{projectId}/routes/{routeId}, team-scoped with ?teamId / ?slug) |
deleteProjectRoutes | Delete routing rules | (a destructive write — DELETE /v1/projects/{projectId}/routes, team-scoped with ?teamId / ?slug) |
generateProjectRoute | Generate routing rule from a description | (a read — POST /v1/projects/{projectId}/routes/generate, team-scoped with ?teamId / ?slug) |
listProjectRouteVersions | Get routing rule version history | (a read — GET /v1/projects/{projectId}/routes/versions, team-scoped with ?teamId / ?slug) |
updateProjectRouteVersion | Promote / restore a routing rule version | (a write — POST /v1/projects/{projectId}/routes/versions, team-scoped with ?teamId / ?slug) |
| Operation | What it does | Access requirement |
|---|
listBulkRedirects | Get project-level redirects | (a read — GET /v1/bulk-redirects, team-scoped with ?teamId / ?slug) |
stageBulkRedirects | Stage new redirects | (a write — PUT /v1/bulk-redirects, team-scoped with ?teamId / ?slug) |
updateBulkRedirect | Edit a redirect | (a write — PATCH /v1/bulk-redirects, team-scoped with ?teamId / ?slug) |
deleteBulkRedirects | Delete redirects | (a destructive write — DELETE /v1/bulk-redirects, team-scoped with ?teamId / ?slug) |
restoreBulkRedirects | Restore staged redirects to production | (a write — POST /v1/bulk-redirects/restore, team-scoped with ?teamId / ?slug) |
listBulkRedirectVersions | Get redirect version history | (a read — GET /v1/bulk-redirects/versions, team-scoped with ?teamId / ?slug) |
updateBulkRedirectVersion | Promote / restore a redirect version | (a write — POST /v1/bulk-redirects/versions, team-scoped with ?teamId / ?slug) |
| Operation | What it does | Access requirement |
|---|
listAccessGroups | List access groups | (a read — GET /v1/access-groups, team-scoped with ?teamId / ?slug) |
createAccessGroup | Create access group | (a write — POST /v1/access-groups, team-scoped with ?teamId / ?slug) |
getAccessGroup | Get access group | (a read — GET /v1/access-groups/{idOrName}, team-scoped with ?teamId / ?slug) |
updateAccessGroup | Update access group | (a write — POST /v1/access-groups/{idOrName}, team-scoped with ?teamId / ?slug) |
deleteAccessGroup | Delete access group | (a destructive write — DELETE /v1/access-groups/{idOrName}, team-scoped with ?teamId / ?slug) |
listAccessGroupMembers | List access group members | (a read — GET /v1/access-groups/{idOrName}/members, team-scoped with ?teamId / ?slug) |
listAccessGroupProjects | List access group projects | (a read — GET /v1/access-groups/{idOrName}/projects, team-scoped with ?teamId / ?slug) |
addAccessGroupProject | Add project to access group | (a write — POST /v1/access-groups/{accessGroupIdOrName}/projects, team-scoped with ?teamId / ?slug) |
getAccessGroupProject | Get access group project | (a read — GET /v1/access-groups/{accessGroupIdOrName}/projects/{projectId}, team-scoped with ?teamId / ?slug) |
updateAccessGroupProject | Update access group project role | (a write — PATCH /v1/access-groups/{accessGroupIdOrName}/projects/{projectId}, team-scoped with ?teamId / ?slug) |
removeAccessGroupProject | Remove project from access group | (a destructive write — DELETE /v1/access-groups/{accessGroupIdOrName}/projects/{projectId}, team-scoped with ?teamId / ?slug) |
| Operation | What it does | Access requirement |
|---|
listIntegrationConfigurations | List integration configurations | (a read — GET /v1/integrations/configurations, team-scoped with ?teamId / ?slug) |
getIntegrationConfiguration | Get integration configuration | (a read — GET /v1/integrations/configuration/{id}, team-scoped with ?teamId / ?slug) |
deleteIntegrationConfiguration | Delete integration configuration | (a destructive write — DELETE /v1/integrations/configuration/{id}, team-scoped with ?teamId / ?slug) |
listIntegrationProducts | List integration configuration products | (a read — GET /v1/integrations/configuration/{id}/products, team-scoped with ?teamId / ?slug) |
listGitNamespaces | List Git namespaces | (a read — GET /v1/integrations/git-namespaces, account-global, so the token's own scope decides) |
searchGitRepos | Search Git repositories | (a read — GET /v1/integrations/search-repo, team-scoped with ?teamId / ?slug) |
| Operation | What it does | Access requirement |
|---|
getArtifactStatus | Get Remote Caching status | (a read — GET /v8/artifacts/status, team-scoped with ?teamId / ?slug) |
queryArtifacts | Query artifact information | (a read — POST /v8/artifacts, team-scoped with ?teamId / ?slug) |
deleteAllArtifacts | Delete all cache artifacts | (a destructive write — DELETE /v8/artifacts, team-scoped with ?teamId / ?slug) |
| Operation | What it does | Access requirement |
|---|
listRegistryRepositories | List registry repositories | (a read — GET /v1/vcr/repository, team-scoped with ?teamId / ?slug) |
createRegistryRepository | Create registry repository | (a write — POST /v1/vcr/repository, team-scoped with ?teamId / ?slug) |
getRegistryRepository | Get registry repository | (a read — GET /v1/vcr/repository/{idOrName}, team-scoped with ?teamId / ?slug) |
deleteRegistryRepository | Delete registry repository | (a destructive write — DELETE /v1/vcr/repository/{idOrName}, team-scoped with ?teamId / ?slug) |
listRegistryImages | List registry images | (a read — GET /v1/vcr/repository/{idOrName}/images, team-scoped with ?teamId / ?slug) |
getRegistryImage | Get registry image | (a read — GET /v1/vcr/repository/{idOrName}/images/{imageIdOrDigest}, team-scoped with ?teamId / ?slug) |
deleteRegistryImage | Delete registry image | (a destructive write — DELETE /v1/vcr/repository/{idOrName}/images/{imageId}, team-scoped with ?teamId / ?slug) |
listRegistryTags | List registry tags | (a read — GET /v1/vcr/repository/{idOrName}/tags, team-scoped with ?teamId / ?slug) |
getRegistryTag | Get registry tag | (a read — GET /v1/vcr/repository/{idOrName}/tags/{tag}, team-scoped with ?teamId / ?slug) |
| Operation | What it does | Access requirement |
|---|
listMicrofrontendGroups | List microfrontend groups | (a read — GET /v1/microfrontends/groups, team-scoped with ?teamId / ?slug) |
createMicrofrontendGroup | Create microfrontend group | (a write — POST /v1/microfrontends/group, team-scoped with ?teamId / ?slug) |
listMicrofrontendGroupProjects | List projects in a group | (a read — GET /v1/microfrontends/groups/{groupId}/projects, team-scoped with ?teamId / ?slug) |
getProjectMicrofrontendConfig | Get project microfrontend config | (a read — GET /v1/microfrontends/projects/{projectIdOrName}/production-mfe-config, team-scoped with ?teamId / ?slug) |
getDeploymentMicrofrontendConfig | Get deployment microfrontend config | (a read — GET /v1/microfrontends/{deploymentId}/config, team-scoped with ?teamId / ?slug) |
updateProjectMicrofrontends | Update project microfrontend settings | (a write — PATCH /v1/projects/{projectId}/microfrontends, team-scoped with ?teamId / ?slug) |
| Operation | What it does | Access requirement |
|---|
listNetworks | List Secure Compute networks | (a read — GET /v1/connect/networks, team-scoped with ?teamId / ?slug) |
createNetwork | Create Secure Compute network | (a write — POST /v1/connect/networks, team-scoped with ?teamId / ?slug) |
getNetwork | Get Secure Compute network | (a read — GET /v1/connect/networks/{networkId}, team-scoped with ?teamId / ?slug) |
updateNetwork | Update Secure Compute network | (a write — PATCH /v1/connect/networks/{networkId}, team-scoped with ?teamId / ?slug) |
deleteNetwork | Delete Secure Compute network | (a destructive write — DELETE /v1/connect/networks/{networkId}, team-scoped with ?teamId / ?slug) |
updateProjectStaticIps | Configure static IPs for a project | (a write — PATCH /v1/projects/{idOrName}/shared-connect-links, team-scoped with ?teamId / ?slug) |
| Operation | What it does | Access requirement |
|---|
queryObservability | Query observability metrics | (a read — POST /v2/observability/query, account-global, so the token's own scope decides) |
getObservabilitySchema | Get observability metric schema | (a read — GET /v2/observability/schema, account-global, so the token's own scope decides) |
getObservabilityMetricSchema | Get one observability metric schema | (a read — GET /v2/observability/schema/{metricId}, account-global, so the token's own scope decides) |
listDisabledObservabilityProjects | List disabled Observability Plus projects | (a read — GET /v1/observability/manage/configuration/projects, team-scoped with ?teamId / ?slug) |
updateObservabilityProject | Update Observability Plus for a project | (a write — PUT /v1/observability/manage/configuration/projects/{projectIdOrName}, team-scoped with ?teamId / ?slug) |
toggleSpeedInsights | Toggle Speed Insights for a project | (a write — POST /speed-insights/toggle, account-global, so the token's own scope decides) |
toggleWebAnalytics | Toggle Web Analytics for a project | (a write — POST /web/insights/toggle, account-global, so the token's own scope decides) |
getProjectTrace | Get a project trace by request ID | (a read — GET /v1/projects/traces, team-scoped with ?teamId / ?slug) |
createTraceSession | Create a trace session token | (a write — POST /v1/projects/traces/session, team-scoped with ?teamId / ?slug) |
| Operation | What it does | Access requirement |
|---|
checkDomainAvailability | Check domain availability | (a read — GET /v1/registrar/domains/{domain}/availability, team-scoped with ?teamId / ?slug) |
checkBulkDomainAvailability | Check availability of several domains | (a read — POST /v1/registrar/domains/availability, team-scoped with ?teamId / ?slug) |
getDomainPrice | Get domain price | (a read — GET /v1/registrar/domains/{domain}/price, team-scoped with ?teamId / ?slug) |
listSupportedTlds | List supported TLDs | (a read — GET /v1/registrar/tlds/supported, team-scoped with ?teamId / ?slug) |
getTld | Get TLD | (a read — GET /v1/registrar/tlds/{tld}, team-scoped with ?teamId / ?slug) |
getTldPrice | Get TLD price | (a read — GET /v1/registrar/tlds/{tld}/price, team-scoped with ?teamId / ?slug) |
getDomainAuthCode | Get domain auth code | (a read — GET /v1/registrar/domains/{domain}/auth-code, team-scoped with ?teamId / ?slug) |
getDomainTransferStatus | Get domain transfer status | (a read — GET /v1/registrar/domains/{domain}/transfer, team-scoped with ?teamId / ?slug) |
getDomainContactSchema | Get domain contact info schema | (a read — GET /v1/registrar/domains/{domain}/contact-info/schema, team-scoped with ?teamId / ?slug) |
getDomainContactVerification | Get domain contact verification status | (a read — GET /v1/registrar/domains/{domain}/contact-verification, team-scoped with ?teamId / ?slug) |
updateDomainAutoRenew | Update domain auto-renew | (a write — PATCH /v1/registrar/domains/{domain}/auto-renew, team-scoped with ?teamId / ?slug) |
updateDomainNameservers | Update domain nameservers | (a write — PATCH /v1/registrar/domains/{domain}/nameservers, team-scoped with ?teamId / ?slug) |
getDomainOrder | Get domain order | (a read — GET /v1/registrar/orders/{orderId}, team-scoped with ?teamId / ?slug) |
| Operation | What it does | Access requirement |
|---|
createBlobStore | Create Blob store | (a write — POST /storage/stores/blob, account-global, so the token's own scope decides) |
deleteBlobStore | Delete Blob store | (a destructive write — DELETE /storage/stores/blob/{id}, account-global, so the token's own scope decides) |
getStore | Get storage store | (a read — GET /storage/stores/{id}, account-global, so the token's own scope decides) |