# AIRCTRL

> Documentation for AIRCTRL — the zero-knowledge secrets manager.

- [Introduction](https://docs.airctrl.dev/index.md): AIRCTRL is a zero-knowledge secrets manager. Your secrets are encrypted on your device, and the backend never sees them in plaintext.
- [Quickstart](https://docs.airctrl.dev/getting-started/quickstart.md): Connect to AIRCTRL and list the projects you can access.
- [Authentication](https://docs.airctrl.dev/getting-started/authentication.md): Choose a human PAT or a Service Account credential without mixing their responsibilities.
- [Combine AIRCTRL tools](https://docs.airctrl.dev/guides/tool-workflows.md): Use the dashboard, CLI, SDK and MCP together without duplicating credentials or adding secret files to your repository.
- [Projects](https://docs.airctrl.dev/guides/projects.md): Discover, create, update and archive projects through every developer surface.
- [Records and secrets](https://docs.airctrl.dev/guides/records.md): Create, read, inject, rotate and share encrypted records without sending plaintext to AIRCTRL.
- [AI gateways](https://docs.airctrl.dev/guides/gateways.md): Configure AI providers, gateways, tokens, routing, limits and observability.
- [Service Accounts](https://docs.airctrl.dev/guides/service-accounts.md): Use a machine identity safely while keeping credential administration in the dashboard.
- [Feature availability](https://docs.airctrl.dev/reference/availability.md): See which AIRCTRL capabilities are available through API, SDK, CLI, MCP, or only the dashboard.
- [API usage patterns](https://docs.airctrl.dev/reference/api-usage.md): Use AIRCTRL API requests safely beyond the happy path.
- [API cookbook](https://docs.airctrl.dev/reference/api-cookbook.md): Practical REST workflows with account context, safe writes, encrypted records and clear failure handling.
- [REST client recipes](https://docs.airctrl.dev/reference/rest-client-recipes.md): Call the AIRCTRL API from JavaScript, TypeScript, Python, Go, Java, C#, Ruby, or PHP.
- [API errors by operation](https://docs.airctrl.dev/reference/api-errors.md): Likely failure reasons for every public AIRCTRL API operation.
- [Errors and retries](https://docs.airctrl.dev/reference/errors.md): Read AIRCTRL errors, decide when to retry, and keep requests safe from duplicates.
- [Integration options](https://docs.airctrl.dev/reference/integration-support.md): Choose the AIRCTRL API, SDK, CLI, or MCP integration that fits your workflow.
- [Glossary](https://docs.airctrl.dev/reference/glossary.md): Plain-language definitions for AIRCTRL concepts, credentials, encryption, and gateway operations.
- [List record anomalies](https://docs.airctrl.dev/api-reference/audit/list-record-anomalies.md): Returns unusual record events for the caller or one project. Project scope requires audit:read.
- [Get daily record activity](https://docs.airctrl.dev/api-reference/audit/get-daily-record-activity.md): Returns read, write, sharing and lifecycle counts for one day. Project scope requires audit:read.
- [List record alerts](https://docs.airctrl.dev/api-reference/audit/list-record-alerts.md): Returns a paginated alert feed for the caller or one project. Project scope requires audit:read.
- [List record access events](https://docs.airctrl.dev/api-reference/audit/list-record-access-events.md): Returns a paginated record access feed. It can be filtered by action. Project scope requires audit:read.
- [List your accounts](https://docs.airctrl.dev/api-reference/context/list-your-accounts.md): Returns the AIRCTRL accounts available to the signed-in human. Use an account ID from this list as the active account for later requests.
- [List your projects](https://docs.airctrl.dev/api-reference/projects/list-your-projects.md): Returns projects the caller can access in one account. Archived projects are hidden unless includeArchived is true.
- [Create a project](https://docs.airctrl.dev/api-reference/projects/create-a-project.md): Creates a project in an account and makes the creator its Project Administrator. Requires projects:create.
- [Get a project](https://docs.airctrl.dev/api-reference/projects/get-a-project.md): Returns one project when the caller belongs to it in the selected account. Returns null when it is not available to the caller.
- [Update a project](https://docs.airctrl.dev/api-reference/projects/update-a-project.md): Replaces the editable name, description and active state of a project. Requires projects:update.
- [Archive or restore a project](https://docs.airctrl.dev/api-reference/projects/archive-or-restore-a-project.md): Sets the project archive time. Send null to restore the project. Requires projects:archive.
- [List accessible records](https://docs.airctrl.dev/api-reference/records/list-accessible-records.md): Returns record metadata across the active account. It never returns plaintext secret values. Human PATs and Service Account tokens are supported.
- [Create an encrypted record](https://docs.airctrl.dev/api-reference/records/create-an-encrypted-record.md): Stores ciphertext and encrypted keys prepared by the client. AIRCTRL does not receive the plaintext secret. Requires records:create.
- [List records in a project](https://docs.airctrl.dev/api-reference/records/list-records-in-a-project.md): Returns record metadata for one project. Archived records are hidden unless includeArchived is true.
- [Get an encrypted record](https://docs.airctrl.dev/api-reference/records/get-an-encrypted-record.md): Returns record metadata and encrypted material when the caller has access. Decryption happens in the SDK, CLI or MCP client.
- [Update record metadata](https://docs.airctrl.dev/api-reference/records/update-record-metadata.md): Updates only the supplied name, tags, due time or rotation interval. It does not change the encrypted value. Requires records:update or record ownership.
- [Read selected record sections](https://docs.airctrl.dev/api-reference/records/read-selected-record-sections.md): Returns only the requested metadata, owner, access or encrypted field sections. This request does not change the record and is allowed for read-only credentials.
- [List record versions](https://docs.airctrl.dev/api-reference/records/list-record-versions.md): Returns the version history without plaintext values. Requires record access and records:read-history when applicable.
- [List record audit events](https://docs.airctrl.dev/api-reference/records/list-record-audit-events.md): Returns recent audit events for one record. Event metadata never contains plaintext secret values. Requires records:read-audit.
- [Save a new encrypted value](https://docs.airctrl.dev/api-reference/records/save-a-new-encrypted-value.md): Adds a new version using ciphertext prepared by the client. Requires a human PAT and records:edit-value.
- [Rotate a record key](https://docs.airctrl.dev/api-reference/records/rotate-a-record-key.md): Stores a newly encrypted value and replacement encrypted keys prepared by the client. Requires records:rotate or record ownership.
- [Share a record with a user](https://docs.airctrl.dev/api-reference/records/share-a-record-with-a-user.md): Grants a user access using an encrypted record key prepared for that user. Requires records:share-user or record ownership.
- [Remove a user from a record](https://docs.airctrl.dev/api-reference/records/remove-a-user-from-a-record.md): Revokes one user grant and removes that user encrypted key. Requires records:revoke-user or record ownership.
- [Remove a Service Account from a record](https://docs.airctrl.dev/api-reference/records/remove-a-service-account-from-a-record.md): Removes one Service Account encrypted key from the record. Requires records:revoke-service-account or record ownership.
- [Share a record with a group](https://docs.airctrl.dev/api-reference/records/share-a-record-with-a-group.md): Stores an encrypted record key for each current group member. Requires records:share-group or record ownership.
- [Remove a group from a record](https://docs.airctrl.dev/api-reference/records/remove-a-group-from-a-record.md): Revokes the group grant and removes encrypted keys created by that grant. Requires records:revoke-group or record ownership.
- [Archive or restore a record](https://docs.airctrl.dev/api-reference/records/archive-or-restore-a-record.md): Archives the record when archived is true and restores it when false. Requires the matching archive or restore permission, or record ownership.
- [Transfer record ownership](https://docs.airctrl.dev/api-reference/records/transfer-record-ownership.md): Makes another project member the record owner. Requires records:transfer-ownership or current ownership.
- [Restore a previous record version](https://docs.airctrl.dev/api-reference/records/restore-a-previous-record-version.md): Creates a new current version from an earlier encrypted version. Existing history is preserved. Requires records:rollback or record ownership.
- [List available providers](https://docs.airctrl.dev/api-reference/providers/list-available-providers.md): Returns enabled AI provider definitions. This registry contains no provider secrets.
- [List provider credentials](https://docs.airctrl.dev/api-reference/provider-credentials/list-provider-credentials.md): Returns safe metadata for provider credentials in one account. Secret values and ciphertext are never returned. Requires provider-credentials:list.
- [Add a provider credential](https://docs.airctrl.dev/api-reference/provider-credentials/add-a-provider-credential.md): Encrypts and stores a provider secret. The plaintext is accepted only for this request and is never returned. Requires provider-credentials:create.
- [List models for a provider credential](https://docs.airctrl.dev/api-reference/provider-credentials/list-models-for-a-provider-credential.md): Discovers the live model catalogue available through one provider credential. Requires provider-credentials:list-models.
- [Rotate a provider credential](https://docs.airctrl.dev/api-reference/provider-credentials/rotate-a-provider-credential.md): Replaces the encrypted provider secret while keeping the same credential identifier. Requires provider-credentials:rotate.
- [Revoke a provider credential](https://docs.airctrl.dev/api-reference/provider-credentials/revoke-a-provider-credential.md): Revokes the stored provider credential so gateways can no longer use it. Requires provider-credentials:revoke.
- [Rename a provider credential](https://docs.airctrl.dev/api-reference/provider-credentials/rename-a-provider-credential.md): Updates the safe display label without changing the provider secret. Requires provider-credentials:update.
- [List gateways in a project](https://docs.airctrl.dev/api-reference/gateways/list-gateways-in-a-project.md): Returns gateways in one project. Requires gateways:list.
- [Create a gateway](https://docs.airctrl.dev/api-reference/gateways/create-a-gateway.md): Creates a gateway in a project. It may start without routing, or bind an existing provider credential to exactly one supported model verified against that credential's live catalog. Requires gateways:create; adding a binding also requires the provider-credential permissions used by the credential en…
- [Get a gateway](https://docs.airctrl.dev/api-reference/gateways/get-a-gateway.md): Returns one gateway, its settings and its exact provider-credential/model bindings. Requires gateways:read.
- [Delete a gateway](https://docs.airctrl.dev/api-reference/gateways/delete-a-gateway.md): Disables the gateway and revokes its tokens while preserving immutable request history. Requires gateways:delete.
- [Update a gateway](https://docs.airctrl.dev/api-reference/gateways/update-a-gateway.md): Updates the supplied gateway name, active state or default route. A default provider/model pair must already be bound to the gateway. Requires gateways:update.
- [List gateway tokens](https://docs.airctrl.dev/api-reference/gateways/list-gateway-tokens.md): Returns safe token metadata for one gateway. Token plaintext is never included. Requires gateway-tokens:list.
- [Create a gateway token](https://docs.airctrl.dev/api-reference/gateways/create-a-gateway-token.md): Creates a gateway token and returns its plaintext once. Store it before leaving the response. Requires gateway-tokens:create.
- [Revoke a gateway token](https://docs.airctrl.dev/api-reference/gateways/revoke-a-gateway-token.md): Stops a gateway token from authenticating while retaining its metadata. Requires gateway-tokens:revoke.
- [Delete a gateway token](https://docs.airctrl.dev/api-reference/gateways/delete-a-gateway-token.md): Permanently removes gateway token metadata. Revoke first when you need an explicit audit step. Requires gateway-tokens:delete.
- [Rename a gateway token](https://docs.airctrl.dev/api-reference/gateways/rename-a-gateway-token.md): Updates only the safe display name of a gateway token. Requires gateway-tokens:rename.
- [Update gateway settings](https://docs.airctrl.dev/api-reference/gateways/update-gateway-settings.md): Updates only the supplied spend, rate, logging, guardrail, cache or model settings. Requires gateways:manage-settings.
- [Attach a provider credential](https://docs.airctrl.dev/api-reference/gateways/attach-a-provider-credential.md): Validates one live-catalog model and binds it with an existing provider credential to one gateway. Requires gateways:attach-credential and provider-credentials:list-models.
- [Detach a provider credential](https://docs.airctrl.dev/api-reference/gateways/detach-a-provider-credential.md): Removes a provider credential from one gateway without revoking the credential itself. Requires gateways:detach-credential.
- [List gateway request logs](https://docs.airctrl.dev/api-reference/gateways/list-gateway-request-logs.md): Returns paginated request metadata for one gateway. Request and response bodies are not included. Requires gateways:read-logs.
- [Read gateway log bodies](https://docs.airctrl.dev/api-reference/gateways/read-gateway-log-bodies.md): Returns stored request and response bodies for one log. This data can contain sensitive content. Requires usage:read-bodies.
- [List provider key access events](https://docs.airctrl.dev/api-reference/gateways/list-provider-key-access-events.md): Returns granted, denied and failed provider credential access events for one gateway. Requires gateways:read-key-access.
- [Get OpenTelemetry export settings](https://docs.airctrl.dev/api-reference/gateways/get-opentelemetry-export-settings.md): Returns safe OpenTelemetry export settings for one gateway. Stored header values are never returned. Requires gateways:manage-settings.
- [Update OpenTelemetry export settings](https://docs.airctrl.dev/api-reference/gateways/update-opentelemetry-export-settings.md): Updates the OTLP endpoint, enabled signals or encrypted headers for one gateway. Requires gateways:manage-settings.
- [List project usage logs](https://docs.airctrl.dev/api-reference/usage/list-project-usage-logs.md): Returns request metadata across all gateways in one project. Request and response bodies are not included. Requires usage:read-logs.
- [Read project log bodies](https://docs.airctrl.dev/api-reference/usage/read-project-log-bodies.md): Returns stored request and response bodies for one project log. This data can contain sensitive content. Requires usage:read-bodies.
- [Get project spend against limits](https://docs.airctrl.dev/api-reference/usage/get-project-spend-against-limits.md): Returns current spend and remaining amounts for project gateway, token and principal limits. Requires usage:read-spend.
- [Get project usage metrics](https://docs.airctrl.dev/api-reference/usage/get-project-usage-metrics.md): Returns request, error, token, latency and permitted spend metrics grouped by hour or day. Requires usage:read-metrics.
- [List Service Accounts](https://docs.airctrl.dev/api-reference/service-accounts/list-service-accounts.md): Returns safe Service Account metadata for one account. Tokens, private keys and credential bundles are never returned.
- [Grant a record to a Service Account](https://docs.airctrl.dev/api-reference/service-accounts/grant-a-record-to-a-service-account.md): Stores a record key encrypted for the current Service Account identity. Requires service-accounts:grant-record. Credential lifecycle remains Web-only.
- [SDK overview](https://docs.airctrl.dev/sdk/overview.md): Use the typed AIRCTRL client from TypeScript or JavaScript.
- [SDK methods](https://docs.airctrl.dev/sdk/methods.md): Complete public capability reference for AirctrlClient.
- [SDK example catalog](https://docs.airctrl.dev/sdk/examples.md): TypeScript examples for every public AirctrlClient method.
- [CLI overview](https://docs.airctrl.dev/cli/overview.md): Install AIRCTRL CLI, authenticate, and run commands safely.
- [CLI commands](https://docs.airctrl.dev/cli/commands.md): Complete command reference for the AIRCTRL CLI.
- [CLI example catalog](https://docs.airctrl.dev/cli/examples.md): Copyable examples for every public AIRCTRL CLI command.
- [Use the CLI with Bash](https://docs.airctrl.dev/cli/bash.md): Install and use AIRCTRL CLI from Bash on macOS or Linux.
- [Use the CLI with PowerShell](https://docs.airctrl.dev/cli/powershell.md): Install and use AIRCTRL CLI from PowerShell on Windows.
- [MCP setup](https://docs.airctrl.dev/mcp/setup.md): Connect AIRCTRL to an MCP-compatible agent without placing credentials in prompts.
- [Connect Claude Code](https://docs.airctrl.dev/mcp/claude-code.md): Configure the local AIRCTRL MCP server in Claude Code.
- [Connect Codex](https://docs.airctrl.dev/mcp/codex.md): Configure the local AIRCTRL MCP server in Codex.
- [Connect Cursor](https://docs.airctrl.dev/mcp/cursor.md): Configure the local AIRCTRL MCP server in Cursor.
- [Connect VS Code](https://docs.airctrl.dev/mcp/vs-code.md): Configure the local AIRCTRL MCP server in Visual Studio Code.
- [Connect Warp](https://docs.airctrl.dev/mcp/warp.md): Configure the local AIRCTRL MCP server in Warp.
- [MCP tools](https://docs.airctrl.dev/mcp/tools.md): Complete tool reference for the AIRCTRL MCP server.
- [MCP prompt catalog](https://docs.airctrl.dev/mcp/prompts.md): Natural-language requests for every AIRCTRL MCP capability.
- [MCP workflow prompts](https://docs.airctrl.dev/mcp/workflows.md): Safe prompts that combine AIRCTRL tools for complete tasks.

## OpenAPI Specs

- [openapi](/api-reference/openapi.json)