> ## Documentation Index
> Fetch the complete documentation index at: https://docs.airctrl.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Feature availability

> See which AIRCTRL capabilities are available through API, SDK, CLI, MCP, or only the dashboard.

export function AirctrlWordmark() {
  return <span className="airctrl-wordmark" aria-label="AIRCTRL">
      <span aria-hidden="true" className="airctrl-wordmark-air">AIR</span>
      <span aria-hidden="true" className="airctrl-wordmark-ctrl">CTRL</span>
    </span>;
}

The API defines <AirctrlWordmark />'s public developer surface, including which identity may call each operation. The SDK provides typed methods. The CLI and MCP server use the SDK instead of maintaining separate HTTP behavior.

All 59 public API operations have a named SDK method, CLI command and MCP tool. Identity support is
deliberately narrower: 49 operations are for humans and 10 also accept a Service Account.

| Capability                                                           | Human PAT | Service Account |
| -------------------------------------------------------------------- | --------: | --------------: |
| Discover accounts and manage projects                                |       Yes |              No |
| List accessible record metadata                                      |       Yes |             Yes |
| Decrypt one record or selected fields                                |       Yes |             Yes |
| Decrypt accessible records in one project                            |       Yes |             Yes |
| Update an existing record value by record ID                         |       Yes |              No |
| Create or upsert a record by project and name                        |       Yes |              No |
| Change record metadata, archive state or ownership                   |       Yes |              No |
| Rotate, roll back, share or revoke record access                     |       Yes |              No |
| Read record history or audit feeds                                   |       Yes |              No |
| List enabled AI providers                                            |       Yes |             Yes |
| Read one gateway, its tokens, logs or key-access events              |       Yes |             Yes |
| Create or configure gateways, provider credentials or gateway tokens |       Yes |              No |
| Read project-wide usage or configure OpenTelemetry                   |       Yes |              No |
| List Service Account metadata or share a record with one             |       Yes |              No |

The same identity rules apply to API, SDK, CLI and MCP. A custom role can reduce access further, but
it cannot turn a human-only operation into a Service Account operation.

## Exact Service Account API operations

These are the only public API operations that accept an active Service Account credential:

| Operation                             | Purpose                                                     |
| ------------------------------------- | ----------------------------------------------------------- |
| `GET /records`                        | List accessible record metadata.                            |
| `GET /records/by-project/{projectId}` | List accessible records in one project.                     |
| `GET /records/{id}`                   | Read one accessible encrypted record.                       |
| `POST /records/{id}/read`             | Read selected sections of one accessible record.            |
| `GET /providers`                      | List enabled AI providers.                                  |
| `GET /gateways/{id}`                  | Read one accessible gateway.                                |
| `GET /gateways/{id}/tokens`           | List safe token metadata for one accessible gateway.        |
| `GET /gateways/{id}/logs`             | List request metadata for one accessible gateway.           |
| `GET /gateways/{id}/logs/{logId}`     | Read one accessible gateway log.                            |
| `GET /gateways/{id}/key-access`       | List provider-key access events for one accessible gateway. |

In Service Account mode, MCP registers only tools supported by those 10 API operations plus three
local helpers: `airctrl_status`, `list_secret_types` and `generate_secret`. The CLI rejects human-only
commands before making an API request.

## Dashboard-only security and governance

These actions require deliberate human interaction in the <AirctrlWordmark /> dashboard:

* Create, pause, reactivate or delete a Service Account.
* Provision, migrate, rotate, revoke or repair a Service Account credential.
* Rotate a Service Account cryptographic identity.
* Assign roles or projects to a Service Account.
* Create or revoke human Personal Access Tokens.
* Add members, manage invitations, groups and roles, or transfer account ownership.
* Manage billing, sessions, profile, preferences and recovery.

The public API Reference does not include the internal endpoints behind these workflows.

## Gateway data plane

Gateway traffic uses provider-compatible URLs returned by <AirctrlWordmark />. It is not duplicated as SDK methods, CLI commands, or MCP tools because provider clients already speak that protocol.

Use a gateway token with the returned OpenAI-compatible, OpenAI-native, Anthropic, or Gemini endpoint. Use the developer surfaces above to configure and observe the gateway.