SDK example catalog

The snippets use an initialized airctrl client and IDs loaded from your application configuration. Methods return the API’s typed snake_case data unless noted otherwise.

Prepare the examples

The catalog uses these shared values. Validate required environment variables when the process starts; do not let undefined reach a credential or resource field.

import { AirctrlError, createClient } from "@airctrl/sdk";

function required(name: string): string {
  const value = process.env[name];
  if (!value) throw new Error(`Missing ${name}`);
  return value;
}

const airctrl = createClient({
  baseUrl: required("AIRCTRL_API_ORIGIN"),
  auth: required("AIRCTRL_TOKEN"),
});

const accountId = required("AIRCTRL_ACCOUNT_ID");
const projectId = required("AIRCTRL_PROJECT_ID");
const recordId = required("AIRCTRL_RECORD_ID");
const gatewayId = required("AIRCTRL_GATEWAY_ID");
const vaultPassword = required("AIRCTRL_VAULT_PASSPHRASE");

Other names such as credentialId, tokenId, userId and groupId are IDs returned by earlier reads or creates. Values such as sourcePassword and replacementPassword must come from a trusted local source. Never replace them with a literal production secret in source code. Each section shows the smallest useful call. SDK methods contains the full signature, identity boundary, input rules, result rules and common error handling.

Accounts and projects

List accessible accounts

Returns accounts available to the human PAT.

const accounts = await airctrl.listAccounts();

SDK method: listAccounts()

List projects

const projects = await airctrl.listProjects({
  accountId,
  includeArchived: false,
});

SDK method: listProjects()

View a project

const project = await airctrl.getProject(projectId, { accountId });
if (!project) throw new Error("Project not found");

SDK method: getProject()

Create a project

The result contains project_id.

const project = await airctrl.createProject({
  accountId,
  name: "Payments",
  description: "Payment service credentials",
});

SDK method: createProject()

Update a project

This replaces the editable project values.

await airctrl.updateProject(
  projectId,
  {
    name: "Payments production",
    description: "Production credentials",
    isActive: true,
  },
  { accountId },
);

SDK method: updateProject()

Archive or restore a project

The first call archives; the second restores.

await airctrl.setProjectArchiveState(projectId, true, { accountId });
await airctrl.setProjectArchiveState(projectId, false, { accountId });

SDK method: setProjectArchiveState()

Record reading and creation

List accessible record metadata

Returns safe metadata across accessible scope.

const page = await airctrl.listRecords({
  accountId,
  includeArchived: false,
  limit: 50,
  offset: 0,
});

SDK method: listRecords()

List records in one project

const records = await airctrl.listProjectRecords(projectId, {
  includeArchived: false,
  limit: 50,
  offset: 0,
});

SDK method: listProjectRecords()

Read a complete record

secret.fields contains locally decrypted fields. Do not log it.

const secret = await airctrl.getSecret({
  recordId,
  vaultPassword: process.env.AIRCTRL_VAULT_PASSPHRASE,
  audit: true,
});

SDK method: getSecret()

Read selected record sections

Returns only the requested sections. fields contains the complete decrypted field map; scope values are section names, not individual field names. Omit environment for General, or pass development, staging, or production to select exactly that value. A missing value never falls back to another scope.

const selected = await airctrl.readRecord({
  recordId,
  scope: ["meta", "fields"],
  vaultPassword,
});

For an application that selects its Environment from configuration, use the documented AC_ENVIRONMENT convention. The application reads this variable and passes it to the SDK; the SDK does not infer an Environment from its own process or from the PAT:

const environmentRecordId = process.env.AIRCTRL_ENV_RECORD_ID!;
const generalRecordId = process.env.AIRCTRL_GENERAL_RECORD_ID!;
const vaultPassword = process.env.AIRCTRL_VAULT_PASSPHRASE!;
const environment = process.env.AC_ENVIRONMENT;
if (
  environment !== "development" &&
  environment !== "staging" &&
  environment !== "production"
) {
  throw new Error("Set AC_ENVIRONMENT to development, staging, or production");
}
const selectedEnvironment = await airctrl.getSecret({
  recordId: environmentRecordId,
  environment,
  vaultPassword,
});
const general = await airctrl.getSecret({
  recordId: generalRecordId,
  vaultPassword,
});

SDK method: readRecord()

Load all project records

Use this only when the process needs every accessible project record.

const secrets = await airctrl.getAll({ projectId, vaultPassword, audit: true });

To load only values from one Environment, pass it explicitly. This does not include General records or other Environment values:

const stagingSecrets = await airctrl.getAll({
  projectId,
  environment: "staging",
  vaultPassword,
  audit: true,
});

SDK method: getAll()

Create an encrypted record

Returns { recordId }.

const created = await airctrl.createSecret({
  projectId,
  name: "Database login",
  secretFormat: "password",
  fieldValues: {
    service_name: "Database",
    username: "app_user",
    password: sourcePassword,
  },
  tags: ["production"],
  vaultPassword,
});

For one record with separate values, create an Environment record and add a missing variant later through the same writer. See Records and secrets for the complete SDK, CLI and MCP examples.

SDK method: createSecret()

Create a generated record

Generation and encryption happen locally.

const created = await airctrl.createGeneratedRecord({
  projectId,
  name: "Generated database password",
  secretFormat: "password",
  options: { length: 32 },
  extraFields: { service_name: "Database", username: "app_user" },
  vaultPassword,
});

SDK method: createGeneratedRecord()

Create or replace record fields

Returns updated: true for an existing record. Human mode can also upsert by projectId, name and secretFormat. A by-ID update replaces the complete field map, so include unchanged fields you need to retain. changedFields labels the audit event; it is not a partial-update instruction.

const result = await airctrl.setSecret({
  recordId,
  fieldValues: {
    service_name: "Database",
    username: "app_user",
    password: replacementPassword,
  },
  changedFields: ["password"],
  vaultPassword,
});

SDK method: setSecret()

Update record details

await airctrl.updateRecordMetadata(recordId, {
  tags: ["payments", "production"],
  secretDueAt: "2026-12-01T00:00:00Z",
  rotationIntervalDays: 90,
});

SDK method: updateRecordMetadata()

Archive or restore a record

Pass false to restore.

await airctrl.setRecordArchiveState(recordId, true);

SDK method: setRecordArchiveState()

Transfer record ownership

Confirm both IDs before transferring.

await airctrl.transferRecordOwnership(recordId, newOwnerUserId);

SDK method: transferRecordOwnership()

View record version history

const versions = await airctrl.getRecordVersions(recordId);

SDK method: getRecordVersions()

Review one record’s audit history

const events = await airctrl.getRecordAudit(recordId, 25);

SDK method: getRecordAudit()

Restore a previous record version

The SDK opens the selected version locally, encrypts it under the current record key, and appends a new current version. Older versions stay in history.

await airctrl.rollbackRecordToVersion(recordId, targetVersionId);

SDK method: rollbackRecordToVersion()

Rotate a record

The SDK rotates the record data key and ciphertext locally.

await airctrl.rotateRecord({ recordId, vaultPassword });

SDK method: rotateRecord()

await airctrl.shareRecordWithUser({
  recordId,
  granteeUserId: userId,
  permission: "read",
  vaultPassword,
});

SDK method: shareRecordWithUser()

await airctrl.shareRecordWithServiceAccount({
  accountId,
  recordId,
  serviceAccountId,
  vaultPassword,
});

SDK method: shareRecordWithServiceAccount()

await airctrl.shareRecordWithGroup({ recordId, groupId, vaultPassword });

SDK method: shareRecordWithGroup()

Remove a user’s record access

await airctrl.revokeRecordFromUser(recordId, userId);

SDK method: revokeRecordFromUser()

Remove a Service Account’s record access

await airctrl.revokeRecordFromServiceAccount(recordId, serviceAccountId);

SDK method: revokeRecordFromServiceAccount()

Remove a group’s record access

Each revoke removes only the selected grant.

await airctrl.revokeRecordFromGroup(recordId, groupId);

SDK method: revokeRecordFromGroup()

Groups

Use a human PAT, account context and the required Team+ entitlement and RBAC permissions. These examples reuse the existing SDK and local vault; they do not create another authorization or crypto flow. See the access model.

List context groups

const groups = await airctrl.listGroups(projectId, { accountId });

SDK method: listGroups()

Read available groups and roles

Returns available groups, delegable roles and permissions; use returned role IDs for grants.

const catalog = await airctrl.getGroupCatalog(projectId, { accountId });

SDK method: getGroupCatalog()

Read a record’s group grants

const catalog = await airctrl.getRecordGroupCatalog(recordId, { accountId });

SDK method: getRecordGroupCatalog()

Create a group

Creation does not grant a project role.

const group = await airctrl.createGroup(
  projectId,
  { name: "Payments team", description: "Payments operators" },
  { accountId },
);

SDK method: createGroup()

Rename a group

This replaces both fields; omit description only to clear it.

await airctrl.updateGroup(
  groupId,
  { name: "Payments operators", description: "Payments access" },
  { accountId },
);

SDK method: updateGroup()

Delete a group

Removes this group’s paths only. Review remaining sources and pending re-keying.

const result = await airctrl.deleteGroup(groupId, { accountId });

SDK method: deleteGroup()

List group members and candidates

const members = await airctrl.listGroupMembers(groupId, { accountId });
const candidates = await airctrl.listGroupMembers(groupId, {
  accountId,
  candidates: true,
});

SDK method: listGroupMembers()

Add a group member

The member must be onboarded. Existing group grants apply; encrypted material may remain pending.

const result = await airctrl.addGroupMember(groupId, userId, { accountId });

SDK method: addGroupMember()

Remove a group member

Other group, project or direct record paths remain effective.

const result = await airctrl.removeGroupMember(groupId, userId, { accountId });

SDK method: removeGroupMember()

Grant a project role to a group

Choose roleId from getGroupCatalog; the API checks delegation.

const result = await airctrl.grantProjectGroup(projectId, groupId, roleId, {
  accountId,
});

SDK method: grantProjectGroup()

Revoke one project role from a group

Removes only this assignment, not other roles or direct record shares.

const result = await airctrl.revokeProjectGroup(projectId, groupId, roleId, {
  accountId,
});

SDK method: revokeProjectGroup()

Complete pending encrypted access

Run as an authorized key holder. Project IDs limit projects, not pending direct group-record repairs. attemptedProjectIds records attempts; verify recipient access separately.

const result = await airctrl.reconcileGroupAccess({
  accountId,
  projectIds: [projectId],
  vaultPassword,
});

SDK method: reconcileGroupAccess()

Record audit feeds

Page and filter one record’s audit history

const auditPage = await airctrl.listRecordAudit(recordId, {
  limit: 25,
  action: "record.update",
  actor: "david",
});

const nextAuditPage = auditPage.pagination.next_cursor
  ? await airctrl.listRecordAudit(recordId, {
      limit: 25,
      action: "record.update",
      actor: "david",
      cursor: auditPage.pagination.next_cursor,
    })
  : null;

SDK method: listRecordAudit()

Find unusual record activity

const anomalies = await airctrl.listRecordAnomalies({
  accountId,
  scopeType: "project",
  scopeId: projectId,
});

SDK method: listRecordAnomalies()

Review daily record activity

The day uses UTC YYYY-MM-DD.

const activity = await airctrl.listRecordActivity("2026-09-10", {
  accountId,
  scopeType: "project",
  scopeId: projectId,
});

SDK method: listRecordActivity()

Review record alerts

const alerts = await airctrl.listRecordAlerts({
  accountId,
  scopeType: "project",
  scopeId: projectId,
  limit: 25,
});

SDK method: listRecordAlerts()

Review secret access events

const access = await airctrl.listRecordAccess({
  accountId,
  scopeType: "project",
  scopeId: projectId,
  actions: ["record.secret_access"],
  limit: 25,
});

SDK method: listRecordAccess()

Providers and gateways

List supported AI providers

const providers = await airctrl.listProviders();

SDK method: listProviders()

List provider credentials

The result contains metadata, never provider secret values.

const credentials = await airctrl.listProviderCredentials(accountId);

SDK method: listProviderCredentials()

Add a provider credential

const credential = await airctrl.createProviderCredential({
  accountId,
  providerId,
  label: "Production OpenAI",
  apiKey: process.env.OPENAI_PRODUCTION_KEY!,
  credentialKind: "api_key",
});

SDK method: createProviderCredential()

List models for a credential

Each result includes the provider capabilities, the subset supports, and airctrlSupport as supported, partial, or unsupported. Unsupported entries remain visible for discovery but cannot be bound to a gateway.

const models = await airctrl.listProviderCredentialModels(credentialId, {
  accountId,
});

SDK method: listProviderCredentialModels()

Replace a provider key

await airctrl.rotateProviderCredential(
  credentialId,
  process.env.OPENAI_REPLACEMENT_KEY!,
  { accountId },
);

SDK method: rotateProviderCredential()

Rename a provider credential

await airctrl.updateProviderCredentialLabel(credentialId, "Primary OpenAI", {
  accountId,
});

SDK method: updateProviderCredentialLabel()

Revoke a provider credential

Check dependent gateways before revocation.

await airctrl.revokeProviderCredential(credentialId, { accountId });

SDK method: revokeProviderCredential()

List gateways

const gateways = await airctrl.listGateways(projectId);

SDK method: listGateways()

View a gateway

const gateway = await airctrl.getGateway(gatewayId);

SDK method: getGateway()

Create a gateway

const gateway = await airctrl.createGateway({
  accountId,
  projectId,
  name: "Payments AI",
  credentialBindings: [
    { credentialId, modelId: "gpt-5" },
    { credentialId, modelId: "gpt-5-mini" },
  ],
});

SDK method: createGateway()

Update a gateway

await airctrl.updateGateway(
  gatewayId,
  { name: "Payments AI production", isActive: true },
  { accountId },
);

SDK method: updateGateway()

Delete a gateway

Deletion disables the gateway and revokes its tokens.

await airctrl.deleteGateway(gatewayId, { accountId });

SDK method: deleteGateway()

Attach a provider credential

await airctrl.attachGatewayCredential(
  gatewayId,
  credentialId,
  ["gpt-5", "gpt-5-mini"],
  { accountId },
);

SDK method: attachGatewayCredential()

Detach one model

await airctrl.detachGatewayCredentialModel(gatewayId, credentialId, "gpt-5", {
  accountId,
});

This keeps the provider credential and its other model bindings attached.

SDK method: detachGatewayCredentialModel()

Detach a provider credential

Detach does not revoke the provider credential.

await airctrl.detachGatewayCredential(gatewayId, credentialId, { accountId });

SDK method: detachGatewayCredential()

Change gateway limits and behavior

await airctrl.updateGatewaySettings(
  gatewayId,
  {
    spendLimit: 100,
    spendWindow: "monthly",
    rateLimitPerMin: 120,
    loggingEnabled: true,
    logBodies: false,
    guardrailMode: "flag",
  },
  { accountId },
);

SDK method: updateGatewaySettings()

Gateway tokens

List gateway tokens

const tokens = await airctrl.listGatewayTokens(gatewayId);

SDK method: listGatewayTokens()

Create a gateway token

The plaintext appears only in this result.

const token = await airctrl.createGatewayToken(
  gatewayId,
  {
    name: "Local development",
    scopes: ["run", "read_logs"],
    expiresInDays: 30,
    allowedModels: ["gpt-5"],
    rateLimitPerMin: 60,
  },
  { accountId },
);
await approvedCustody.write(token.plaintext);

SDK method: createGatewayToken()

Rename a gateway token

await airctrl.renameGatewayToken(gatewayId, tokenId, "CI production", {
  accountId,
});

SDK method: renameGatewayToken()

Revoke a gateway token

await airctrl.revokeGatewayToken(gatewayId, tokenId, { accountId });

SDK method: revokeGatewayToken()

Delete a gateway token

await airctrl.deleteGatewayToken(gatewayId, tokenId, { accountId });

SDK method: deleteGatewayToken()

Usage and observability

Review gateway requests

const logs = await airctrl.listGatewayLogs(gatewayId, {
  since: "2026-09-01T00:00:00Z",
  until: "2026-10-01T00:00:00Z",
  statusClass: "5xx",
  search: "claim denied",
  limit: 50,
});

const nextLogs = logs.pagination.next_cursor
  ? await airctrl.listGatewayLogs(gatewayId, {
      since: "2026-09-01T00:00:00Z",
      until: "2026-10-01T00:00:00Z",
      statusClass: "5xx",
      search: "claim denied",
      limit: 50,
      cursor: logs.pagination.next_cursor,
    })
  : null;

SDK method: listGatewayLogs()

Inspect one gateway request

This may contain stored request and response bodies.

const detail = await airctrl.getGatewayLogDetail(gatewayId, logId);

SDK method: getGatewayLogDetail()

Review provider-key access

const access = await airctrl.listGatewayKeyAccess(gatewayId, {
  outcome: "denied",
  since: "2026-09-01T00:00:00Z",
  until: "2026-10-01T00:00:00Z",
  limit: 50,
  offset: 0,
});

SDK method: listGatewayKeyAccess()

Review project usage logs

const logs = await airctrl.listUsageLogs({
  projectId,
  gatewayId,
  since: "2026-09-01T00:00:00Z",
  until: "2026-10-01T00:00:00Z",
  limit: 50,
});

const nextLogs = logs.pagination.next_cursor
  ? await airctrl.listUsageLogs({
      projectId,
      gatewayId,
      since: "2026-09-01T00:00:00Z",
      until: "2026-10-01T00:00:00Z",
      limit: 50,
      cursor: logs.pagination.next_cursor,
    })
  : null;

SDK method: listUsageLogs()

Inspect one project usage log

const detail = await airctrl.getUsageLogDetail(projectId, logId);

SDK method: getUsageLogDetail()

Review project spend

const spend = await airctrl.getUsageSpend(projectId, gatewayId);

SDK method: getUsageSpend()

Review project usage metrics

const metrics = await airctrl.getUsageMetrics(projectId, {
  since: "2026-09-01T00:00:00Z",
  until: "2026-10-01T00:00:00Z",
  bucket: "day",
  gatewayId,
  provider: "novita",
  statusClass: "2xx",
});

SDK method: getUsageMetrics()

View OpenTelemetry settings

Stored header values are never returned.

const otel = await airctrl.getGatewayOtelExport(gatewayId, { accountId });

SDK method: getGatewayOtelExport()

Change OpenTelemetry settings

const otelHeaders = JSON.parse(process.env.OTEL_EXPORT_HEADERS_JSON!) as Record<
  string,
  string
>;
await airctrl.updateGatewayOtelExport(
  gatewayId,
  {
    enabled: true,
    endpoint: "https://otel.example.com",
    exportMetrics: true,
    exportTraces: true,
    exportBodies: true,
    headers: otelHeaders,
  },
  { accountId },
);

SDK method: updateGatewayOtelExport()

Service Account metadata

List Service Accounts

const serviceAccounts = await airctrl.listServiceAccounts({ accountId });

SDK method: listServiceAccounts()

View a Service Account

These methods expose safe metadata to a human PAT. Service Account lifecycle remains dashboard-only.

const serviceAccount = await airctrl.getServiceAccount(serviceAccountId, {
  accountId,
});
if (!serviceAccount) throw new Error("Service Account not found");

SDK method: getServiceAccount()

Error handling

Every API-backed method throws AirctrlError. Read status, code, message and details. Do not retry validation, permission or missing-resource failures unchanged. Reuse the same idempotency key only for the same intended write.

Connect a confidential OAuth partner

The example assumes redirectUri, state, provider/external-key values, idempotency keys, and the partner-owned encryptedTokenStore, encryptedRuntimeTokenStore, and refreshLock are initialized in the confidential backend.

import { AirctrlOAuthError, OAuthPartnerClient, createPkce } from "@airctrl/sdk";

const oauth = new OAuthPartnerClient(
  process.env.AIRCTRL_CLIENT_ID!,
  process.env.AIRCTRL_CLIENT_SECRET!,
  {
    apiBaseUrl: process.env.AIRCTRL_API_ORIGIN!,
    webBaseUrl: process.env.AIRCTRL_WEB_URL!,
  },
);
const { verifier: codeVerifier, challenge: codeChallenge } = await createPkce();

const authorizeUrl = oauth.authorizationUrl({
  redirectUri,
  scopes: [
    "protections:provision",
    "protections:read",
    "protections:update",
    "protections:manage",
    "protections:read-logs",
    "protections:read-spend",
    "offline_access",
  ],
  state,
  codeChallenge,
});
const tokens = await oauth.exchangeCode({ code, redirectUri, codeVerifier });

// This backend flow is identical for private and public Apps. AIRCTRL consent binds
// the token to the fixed owner organization or the selected customer organization.
const providers = await oauth.listProvisioningProviders(tokens.access_token);
const provider = providers.find((candidate) => candidate.slug === selectedProviderSlug);
if (!provider) throw new Error("provider_unavailable");
const preflight = await oauth.preflightProtection(tokens.access_token, {
  providerId: provider.provider_id,
  otel: false,
});
if (!preflight.allowed) throw new Error(preflight.blockers.join(", "));
const catalog = await oauth.discoverProvisioningProviderModels(
  tokens.access_token,
  provider.provider_id,
  providerKey,
);
if (catalog.invalidApiKey) throw new Error("provider_key_invalid");

const protection = await oauth.provisionProtection(
  tokens.access_token,
  crypto.randomUUID(),
  {
    externalResourceId: externalKeyId,
    providerId: provider.provider_id,
    providerKey,
    credentialLabel: "Support AI key",
    gatewayName: "Support AI",
    models: ["model-standard"],
    settings: {
      loggingEnabled: true,
      logBodies: false,
      guardrailMode: "redact",
    },
  },
);

// Persist every one-time runtime secret before acknowledging the operation.
await encryptedRuntimeTokenStore.save(
  externalKeyId,
  protection.gatewayToken.plaintext!,
);
const protections = await oauth.listProtections(tokens.access_token);
const currentProtection = await oauth.getProtection(
  tokens.access_token,
  protection.protectionId,
);
const logs = await oauth.listProtectionLogs(
  tokens.access_token,
  protection.protectionId,
  { limit: 50 },
);
const spend = await oauth.getProtectionSpend(
  tokens.access_token,
  protection.protectionId,
);
await oauth.updateProtection(tokens.access_token, protection.protectionId, {
  gatewayName: "Support AI v2",
  models: ["model-standard", "model-vision"],
  settings: { rateLimitPerMin: 240 },
});
await oauth.rotateProtectionProviderKey(
  tokens.access_token,
  protection.protectionId,
  replacementProviderKey,
);
const rotatedRuntime = await oauth.rotateProtectionRuntimeToken(
  tokens.access_token,
  protection.protectionId,
  runtimeRotationIdempotencyKey,
);
await encryptedRuntimeTokenStore.save(
  externalKeyId,
  rotatedRuntime.gatewayToken.plaintext!,
);
await oauth.revokeProtection(tokens.access_token, protection.protectionId);
const reactivated = await oauth.reactivateProtection(
  tokens.access_token,
  protection.protectionId,
  reactivationIdempotencyKey,
);
await encryptedRuntimeTokenStore.save(
  externalKeyId,
  reactivated.gatewayToken.plaintext!,
);
const rotated = await refreshLock.run(installationId, async () => {
  const current = await encryptedTokenStore.require(installationId);
  const next = await oauth.refresh(current.refresh_token!);
  await encryptedTokenStore.compareAndSwap(current.refresh_token!, next);
  return next;
});
await oauth.revoke(rotated.refresh_token ?? rotated.access_token);

Use only scopes shown in the OAuth app registration and current server metadata. The provider key is sent only from the confidential backend over TLS. validates it before any write, encrypts it at rest and never returns it. Retry an uncertain provision with the same idempotency key and identical request; changing the request under that key returns 409. Serialize refreshes per installation. Omit OTel headers on PATCH to preserve them; send null or {} to clear them. An older lifecycle idempotency key returns idempotency_operation_superseded after a newer runtime-token operation wins. OAuthPartnerClient throws AirctrlOAuthError with status, error, and optional description:

try {
  await oauth.getProtection(tokens.access_token, protection.protectionId);
} catch (error) {
  if (!(error instanceof AirctrlOAuthError)) throw error;
  console.error(error.status, error.error, error.description);
}

SDK method: authorizationUrl()SDK method: exchangeCode()SDK method: refresh()SDK method: revoke()SDK method: listProvisioningProviders()SDK method: discoverProvisioningProviderModels()SDK method: preflightProtection()SDK method: provisionProtection()SDK method: listProtections()SDK method: getProtection()SDK method: updateProtection()SDK method: listProtectionLogs()SDK method: getProtectionSpend()SDK method: rotateProtectionProviderKey()SDK method: rotateProtectionRuntimeToken()SDK method: revokeProtection()SDK method: reactivateProtection()

​Prepare the examples

​Accounts and projects

​List accessible accounts

​List projects

​View a project

​Create a project

​Update a project

​Archive or restore a project

​Record reading and creation

​List accessible record metadata

​List records in one project

​Read a complete record

​Read selected record sections

​Load all project records

​Create an encrypted record

​Create a generated record

​Create or replace record fields

​Record lifecycle and sharing

​Update record details

​Archive or restore a record

​Transfer record ownership

​View record version history

​Review one record’s audit history

​Restore a previous record version

​Rotate a record

​Share a record with a user

​Share a record with a Service Account

​Share a record with a group

​Remove a user’s record access

​Remove a Service Account’s record access

​Remove a group’s record access

​Groups

​List context groups

​Read available groups and roles

​Read a record’s group grants

​Create a group

​Rename a group

​Delete a group

​List group members and candidates

​Add a group member

​Remove a group member

​Grant a project role to a group

​Revoke one project role from a group

​Complete pending encrypted access

​Record audit feeds

​Page and filter one record’s audit history

​Find unusual record activity

​Review daily record activity

​Review record alerts

​Review secret access events

​Providers and gateways

​List supported AI providers

​List provider credentials

​Add a provider credential

​List models for a credential

​Replace a provider key

​Rename a provider credential

​Revoke a provider credential

​List gateways

​View a gateway

​Create a gateway

​Update a gateway

​Delete a gateway

​Attach a provider credential

​Detach one model

​Detach a provider credential

​Change gateway limits and behavior

​Gateway tokens

​List gateway tokens

​Create a gateway token

​Rename a gateway token

​Revoke a gateway token

​Delete a gateway token

​Usage and observability

​Review gateway requests

​Inspect one gateway request

​Review provider-key access

​Review project usage logs

​Inspect one project usage log

​Review project spend