Feature availability

The API defines ‘s public developer surface, including which identity may call each operation. The SDK provides typed methods. The CLI and MCP server use the SDK instead of maintaining separate HTTP behavior. All 59 public API operations have a named SDK method, CLI command and MCP tool. Identity support is deliberately narrower: 49 operations are for humans and 10 also accept a Service Account.

Capability	Human PAT	Service Account
Discover accounts and manage projects	Yes	No
List accessible record metadata	Yes	Yes
Decrypt one record or selected fields	Yes	Yes
Decrypt accessible records in one project	Yes	Yes
Update an existing record value by record ID	Yes	No
Create or upsert a record by project and name	Yes	No
Change record metadata, archive state or ownership	Yes	No
Rotate, roll back, share or revoke record access	Yes	No
Read record history or audit feeds	Yes	No
List enabled AI providers	Yes	Yes
Read one gateway, its tokens, logs or key-access events	Yes	Yes
Create or configure gateways, provider credentials or gateway tokens	Yes	No
Read project-wide usage or configure OpenTelemetry	Yes	No
List Service Account metadata or share a record with one	Yes	No

The same identity rules apply to API, SDK, CLI and MCP. A custom role can reduce access further, but it cannot turn a human-only operation into a Service Account operation.

Exact Service Account API operations

These are the only public API operations that accept an active Service Account credential:

Operation	Purpose
`GET /records`	List accessible record metadata.
`GET /records/by-project/{projectId}`	List accessible records in one project.
`GET /records/{id}`	Read one accessible encrypted record.
`POST /records/{id}/read`	Read selected sections of one accessible record.
`GET /providers`	List enabled AI providers.
`GET /gateways/{id}`	Read one accessible gateway.
`GET /gateways/{id}/tokens`	List safe token metadata for one accessible gateway.
`GET /gateways/{id}/logs`	List request metadata for one accessible gateway.
`GET /gateways/{id}/logs/{logId}`	Read one accessible gateway log.
`GET /gateways/{id}/key-access`	List provider-key access events for one accessible gateway.

In Service Account mode, MCP registers only tools supported by those 10 API operations plus three local helpers: airctrl_status, list_secret_types and generate_secret. The CLI rejects human-only commands before making an API request.

Dashboard-only security and governance

These actions require deliberate human interaction in the dashboard:

Create, pause, reactivate or delete a Service Account.
Provision, migrate, rotate, revoke or repair a Service Account credential.
Rotate a Service Account cryptographic identity.
Assign roles or projects to a Service Account.
Create or revoke human Personal Access Tokens.
Add members, manage invitations, groups and roles, or transfer account ownership.
Manage billing, sessions, profile, preferences and recovery.

The public API Reference does not include the internal endpoints behind these workflows.

Gateway data plane

Gateway traffic uses provider-compatible URLs returned by . It is not duplicated as SDK methods, CLI commands, or MCP tools because provider clients already speak that protocol. Use a gateway token with the returned OpenAI-compatible, OpenAI-native, Anthropic, or Gemini endpoint. Use the developer surfaces above to configure and observe the gateway.

​Exact Service Account API operations

​Dashboard-only security and governance

​Gateway data plane

Exact Service Account API operations

Dashboard-only security and governance

Gateway data plane