A managed runtime for custom API integrations. Manage lines, endpoints, keys, logs and DLQ via MCP.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Bearer <MCP token> — create one in the EchoRelay panel under the project's API keys.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Activate and immediately publish an inactive line so it serves traffic again. Blocked at the active-line cap — deactivate another line first. Requires edit access.
The line key, e.g. "v1".
Defaults to publish. Draft writes require draftRevision.
Current line draft revision, required for draft writes.
This tool isn't marked read-only, so it may change something on the server or in an account you connected.
Tool list last changed Oct 25, 2026.
Activate and immediately publish an inactive line so it serves traffic again. Blocked at the active-line cap — deactivate another line first. Requires edit access.
| Argument | Type | Description |
|---|---|---|
| lineKey* | string | The line key, e.g. "v1". |
| commitMode | string | Defaults to publish. Draft writes require draftRevision. |
| draftRevision | integer | Current line draft revision, required for draft writes. |
{
"type": "object",
"required": [
"lineKey"
],
"properties": {
"lineKey": {
"type": "string",
"description": "The line key, e.g. \"v1\"."
},
"commitMode": {
"enum": [
"draft",
"publish"
],
"type": "string",
"description": "Defaults to publish. Draft writes require draftRevision."
},
"draftRevision": {
"type": "integer",
"description": "Current line draft revision, required for draft writes."
}
}
}Archive a project you own. Reversible: the project + slug persist and credits are kept, but the data plane drops the tenant (callers get 404). Idempotent. Fails with an error if the project has archive protection enabled. That is a support-only unlock, not something this call can override. Requires an ACCOUNT-scoped management token and the `config` scope.
| Argument | Type | Description |
|---|---|---|
| slug* | string | The slug of a project you own. |
{
"type": "object",
"required": [
"slug"
],
"properties": {
"slug": {
"type": "string",
"description": "The slug of a project you own."
}
}
}Cancel one line schedule before its two-minute lock.
| Argument | Type | Description |
|---|---|---|
| lineKey* | string | |
| draftRevision* | integer |
{
"type": "object",
"required": [
"lineKey",
"draftRevision"
],
"properties": {
"lineKey": {
"type": "string"
},
"draftRevision": {
"type": "integer"
}
}
}Schedule the project owner's subscription for cancellation at the end of the current billing period. Returns `{kind: 'scheduled', newPlan: 'free', effectiveAt}`. Add-ons keep renewing while the plan is active; after it ends they stop renewing and each already-paid add-on cycle stays active until its own end date (use unsubscribe_addon to stop one sooner). Owner-only; requires a token minted with the billing scope.
No arguments.
{
"type": "object",
"properties": {}
}Switch the project owner between Pro and Scale, or cancel the subscription (effectively dropping to Free at period end). Returns `{kind, newPlan, effectiveAt, applied}` — `applied=true` means Paddle was charged immediately, otherwise the change is queued for the current period end. Use preview_plan_change first to see the dollar impact. Owner-only; requires a token minted with the billing scope.
| Argument | Type | Description |
|---|---|---|
| plan* | string |
{
"type": "object",
"required": [
"plan"
],
"properties": {
"plan": {
"enum": [
"free",
"pro",
"scale"
],
"type": "string"
}
}
}Preview what Save & Publish (or the pending scheduled publish, if one exists) would change: added/removed/changed lines, and within each changed line the added/removed/changed endpoints and targets, plus any project-level setting change. Outbound auth secrets are redacted the same as get_config.
No arguments.
{
"type": "object",
"properties": {}
}Mint an inbound relay (data-plane) API key for callers to send traffic to this project. Its `er_live_` or `er_test_` secret authenticates relay requests; it cannot call management MCP or REST. Returns the plaintext exactly once — store it now, it cannot be retrieved later. Editor + owner; subject to the project key policy (see get_key_policy).
| Argument | Type | Description |
|---|---|---|
| mode | string | live → paid pool, test → testing pool (rate-limited to the plan's live rate). Omit for live. |
| name* | string | Human-readable label, up to 120 characters. |
| ttlDays | integer | null | Lifetime in days. Omit to use the project's defaultKeyTtlDays from get_key_policy. Null = never expires (owner-only unless editorsMayCreateNonExpiringKeys is set). |
{
"type": "object",
"required": [
"name"
],
"properties": {
"mode": {
"enum": [
"live",
"test"
],
"type": "string",
"default": "live",
"description": "live → paid pool, test → testing pool (rate-limited to the plan's live rate). Omit for live."
},
"name": {
"type": "string",
"description": "Human-readable label, up to 120 characters."
},
"ttlDays": {
"type": [
"integer",
"null"
],
"description": "Lifetime in days. Omit to use the project's defaultKeyTtlDays from get_key_policy. Null = never expires (owner-only unless editorsMayCreateNonExpiringKeys is set)."
}
}
}Save a new reusable credential, sealed with the project's encryption key at write time. Neither this call nor any later read ever returns the secret back — reference it from a target by id (see create_endpoint/update_endpoint's target.credentialVaultEntryId) instead of copying the secret around. `auth.type` selects which fields apply: bearer→token, basic→username+password, apiKeyHeader→headerName+key, apiKeyQuery→paramName+key, publicPrivateKey→secret+key, oauthClientCredentials→tokenUrl+clientId+clientSecret (+ optional scope, audience, clientAuth "basic"|"post"; the access token is fetched at delivery, and clientSecret is never returned. The client secret is only ever sent to tokenUrl, and the access token only to the bound destinationHost; tokenUrl is permanent like destinationHost — it must pass the project's outbound host allowlist at create, and an update that changes it is refused), signingSecret→secret (the secret a sender such as GitHub or Stripe signs the webhooks it sends you with; attach it to an endpoint as senderSignature.credentialId). `destinationHost` is required and permanent: the credential is only ever sent to that host, over https, and no later call can re-aim it. A signingSecret credential is never sent anywhere, so it takes no destinationHost.
| Argument | Type | Description |
|---|---|---|
| auth* | object | The credential's auth shape. |
| name* | string | Human-readable label, up to 120 characters. |
| destinationHost | string | The only host this credential may be sent to, e.g. "api.stripe.com", or a single-label wildcard, e.g. "*.stripe.com" (matches api.stripe.com, not stripe.com and not a.b.stripe.com). Host only — no scheme, port or path. Internationalised hosts must be given in punycode ("xn--…"). Permanent: attaching this credential to a target on any other host is refused, and it cannot be changed later — a different destination means a new credential, which means entering the secret again. |
Create an endpoint under a line. Defaults to immediate publish; draft mode requires draftRevision. scheduledAt stages the line draft then schedules it. Requires edit access.
| Argument | Type | Description |
|---|---|---|
| lineKey* | string | The line key to create the endpoint under. |
| endpoint* | object | An EchoRelay endpoint. Round-trips with the JSON returned by get_endpoint. |
| commitMode | string | Defaults to publish. Draft writes require draftRevision. |
| scheduledAt | string | Compatibility alias: stage this endpoint in its line draft then schedule that line. |
| draftRevision | integer | Current line draft revision, required for draft writes. |
{
"type": "object",
"required": [
"lineKey",
"endpoint"
],
"properties": {
"lineKey": {
"type": "string",
"description": "The line key to create the endpoint under."
},
"endpoint": {
"type": "object",
"properties": {
"url": {
"type": "string",
"pattern": "^/[A-Za-z0-9/_\\-{}]*$",
"description": "Path under the line, e.g. \"/webhook\". Must start with \"/\" and contain only [A-Za-z0-9/_-{}]."
},
"mock": {
"type": "boolean",
"description": "When true, callers receive mockResponse without fan-out to targets. Targets are saved but not invoked."
},
"name": {
"type": "string",
"minLength": 1,
"description": "Human-readable label for the endpoint."
},
"strict": {
"type": "boolean",
"description": "When true, validation rejects any attribute not declared in attributes[]. Default false."
},
"targets": {
"type": "array",
"items": {
"type": "object",
"required": [
"name",
"targetUrl",
"auth",
"deliveryMode"
],
"properties": {
"id": {
"type": "string",
"description": "Returned on reads. Send it back unchanged to update that target and keep its stored secrets. Targets are matched by id; without one, by the same name and targetUrl; without either, a patch to the target in the same position keeps its secrets, as long as the list keeps its length, the patch does not change both its name and targetUrl, and a changed targetUrl stays on the same host. Any other target is new and must carry its own secrets."
},
"auth": {
"type": "object",
"required": [
"type"
],
"properties": {
"key": {
"type": "string",
"description": "Required when type=apiKeyHeader or type=apiKeyQuery or type=publicPrivateKey."
},
"type": {
"enum": [
"none",
"bearer",
"basic",
"apiKeyHeader",
"apiKeyQuery",
"publicPrivateKey",
"oauthClientCredentials"
],
"type": "string"
},
"scope": {
"type": "string",
"description": "Optional, type=oauthClientCredentials. Space-separated scopes."
},
"token": {
"type": "string",
"description": "Required when type=bearer."
},
"secret": {
"type": "string",
"description": "Required when type=publicPrivateKey."
},
"audience": {
"type": "string",
"description": "Optional, type=oauthClientCredentials."
},
"clientId": {
"type": "string",
"description": "Required when type=oauthClientCredentials."
},
"password": {
"type": "string",
"description": "Required when type=basic."
},
"tokenUrl": {
"type": "string",
"description": "Required when type=oauthClientCredentials. An https URL."
},
"username": {
"type": "string",
"description": "Required when type=basic."
},
"paramName": {
"type": "string",
"description": "Required when type=apiKeyQuery."
},
"clientAuth": {
"enum": [
"basic",
"post"
],
"type": "string",
"description": "type=oauthClientCredentials only. How client credentials are sent to the token URL: basic (Authorization header, default) or post (request body)."
},
"headerName": {
"type": "string",
"description": "Required when type=apiKeyHeader."
},
"clientSecret": {
"type": "string",
"description": "Required when type=oauthClientCredentials. Never returned on reads."
}
},
"description": "Outbound auth applied to the request. On reads, secrets are redacted to \"***\" — round-trip the sentinel to keep the stored secret. Ignored when credentialVaultEntryId is set.",
"additionalProperties": false
},
"name": {
"type": "string",
"description": "Display name for the target."
},
"mapping": {
"type": "array",
"items": {
"type": "object",
"required": [
"sourceIn",
"sourceName",
"targetIn",
"targetName"
],
"properties": {
"sourceIn": {
"enum": [
"body",
"query",
"header",
"path"
],
"type": "string"
},
"targetIn": {
"enum": [
"body",
"query",
"header"
],
"type": "string"
},
"template": {
"type": "string",
"description": "Optional templated value (e.g. \"Bearer {value}\")."
},
"sourceName": {
"type": "string",
"description": "Inbound field name to read."
},
"targetName": {
"type": "string",
"description": "Outbound field name to write."
}
},
"additionalProperties": false
},
"description": "Optional transformer rules. Each rule moves or renames a field from the inbound request to the outbound one."
},
"targetUrl": {
"type": "string",
"format": "uri",
"description": "Outbound URL. Cannot point back to this project (the Framework rejects relay loops)."
},
"callbackURL": {
"type": "string",
"format": "uri",
"description": "Pushed once this target's delivery reaches a terminal status — see get_receipts' callbackState. Must be https. Meaningful for async targets only — refused on sync/stream. Cannot point back into this project (the same relay-loop rule as targetUrl) and must be inside the project's outbound host allowlist when one is set. Unset = the customer polls the receipt instead."
},
"retryPolicy": {
"type": [
"object",
"null"
],
"properties": {
"retryOn": {
"type": "array",
"items": {
"type": "integer",
"maximum": 599,
"minimum": 100
},
"description": "HTTP status codes that trigger a retry. Default [429, 500, 502, 503, 504]."
},
"maxAttempts": {
"type": "integer",
"maximum": 14,
"minimum": 1,
"description": "Total delivery attempts, counting the first. 1 fails fast: one try, then the dead-letter queue. Higher values keep retrying with a widening gap between tries — at the default backoffMultiplier, roughly under a minute at 4, a few minutes at 7, about an hour at 10, a few hours at 14. Anything still undelivered lands in the dead-letter queue. Defaults to 14."
},
"backoffMultiplier": {
"type": "number",
"maximum": 5,
"minimum": 1,
"description": "How sharply the gap between tries widens. Higher spends the same attempts over a longer stretch. Defaults to 2.0."
}
},
"description": "Async retry policy. Ignored unless deliveryMode=async. Leave it unset (null) and the platform default applies, which behaves the same as maxAttempts at its maximum. get_endpoint reports which is in effect: this object when set, null when the platform default applies.",
"additionalProperties": false
},
"syncTimeout": {
"type": "integer",
"maximum": 90,
"minimum": 1,
"description": "Seconds the caller waits for a sync target. Ignored unless deliveryMode=sync."
},
"deliveryMode": {
"enum": [
"async",
"sync",
"stream"
],
"type": "string",
"description": "async = queued + retried (default); sync = caller waits up to syncTimeout for the target response; stream = SSE pass-through (max 1 per endpoint)."
},
"transformers": {
"type": "array",
"items": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"enum": [
"mergeFields",
"renameField",
"removeField",
"addField",
"mapValue",
"binaryToUrl"
],
"type": "string",
"description": "mergeFields: from+to(+separator). renameField: from+to. removeField: field. addField: to+value. mapValue: field+mapping. binaryToUrl: ttlSeconds?+maxSizeMB? (both clamped server-side — omit for the server default)."
},
"params": {
"type": [
"object",
"null"
],
"properties": {
"to": {
"type": "string",
"description": "Destination field — mergeFields / renameField / addField."
},
"from": {
"type": "array",
"items": {
"type": "string"
},
"description": "mergeFields (all sources) / renameField (first element is the source)."
},
"field": {
"type": "string",
"description": "Target field — removeField / mapValue."
},
"value": {
"type": "string",
"description": "Constant value to set — addField."
},
"mapping": {
"type": "object",
"description": "Value lookup table — mapValue.",
"additionalProperties": {
"type": "string"
}
},
"maxSizeMB": {
"type": "integer",
"minimum": 1,
"description": "Max upload size in MB — binaryToUrl."
},
"separator": {
"type": "string",
"description": "Join separator — mergeFields (default \" \")."
},
"ttlSeconds": {
"type": "integer",
"minimum": 1,
"description": "Temp file lifetime in seconds — binaryToUrl."
}
},
"description": "Only the keys the chosen type reads are accepted; see the type description above.",
"additionalProperties": false
}
},
"additionalProperties": false
},
"description": "Request transformation pipeline applied to this target before delivery. Empty array = no transformation."
},
"answerMapping": {
"type": [
"object",
"null"
],
"description": "Reshapes this target's answer into what the caller receives — a tree of typed nodes conforming to the same published grammar as outgoingMapping. Refused on a stream target (deliveryMode=stream) — a stream's response is proxied straight through and never reshaped. null = no reshaping, the answer reaches the caller verbatim; paths, types and cycles are checked server-side."
},
"signingSecret": {
"type": [
"string",
"null"
],
"description": "Signs the body delivered to this target — separate from auth above, which authenticates OUTBOUND to the target. Shape: \"whsec_\" followed by base64 of 32 random bytes. Omit to leave unchanged; set to null to disable signing; set to your own whsec_-shaped value to use it verbatim (rejected otherwise, including an empty string — you hold this secret, so only you can supply it). On reads, a configured secret is redacted to \"***\" — round-trip that sentinel to keep the stored secret."
},
"answerVariants": {
"type": [
"object",
"null"
],
"description": "The conditional form of answerMapping, for a target whose answers do not all share one shape: one mapping per reply instead of one for every reply. Requires \"distinguishBy\" naming the single thing that tells them apart ({\"source\":\"status\"}, {\"source\":\"header\",\"name\":…} or {\"source\":\"bodyField\",\"path\":…}), \"variants\" as an object keyed by the value it matches — an exact status like \"429\", a class like \"4XX\", or \"default\" — each holding a tree in the same grammar as answerMapping — or, where the caller should be answered with a status of your own, an object {\"mapping\": <tree>, \"replyStatus\": 402} — and \"onNoMatch\", which has no default and must be either \"passthrough\" (hand the vendor's answer back untouched) or \"fail\" (answer 422 naming the value that matched nothing). A replyStatus is what the caller sees and never what the delivery is measured or charged as; it must be a status that can carry a body (200–599, excluding 204, 205 and redirects), and setting one drops the vendor's own response headers, which describe the answer it replaced. A variant keyed on a status that carries no body (204, 205, 304) is reachable only when it sets one. Mutually exclusive with answerMapping on this target, and refused on a stream target for the same reason answerMapping is. A variant whose tree does not compile is refused when the line is published, not silently dropped. null = no reshaping."
},
"outgoingMapping": {
"type": [
"object",
"null"
],
"description": "Reshapes the request into what this target expects — a tree of typed nodes conforming to the published grammar at \"https://schemas.echorelay.dev/transform/mapping/v1.json\" (its own $schema key must name that value). Mutually exclusive with mapping and transformers on this target, and with the endpoint's own transformers — the write is rejected if both are set. null = no reshaping (today's behaviour, and the only value this schema itself can validate; paths, types and cycles are checked server-side)."
},
"credentialVaultEntryId": {
"type": "string",
"description": "References a saved credential (see list_credentials/create_credential) instead of inline auth — the auth field above is ignored when this is set. Must belong to the same project. The credential is bound to a destination when it is created: targetUrl must be https and its host must match that credential's destinationHost, or the write is rejected."
}
},
"additionalProperties": false
},
"description": "Outbound destinations. Required unless mock=true. Each entry becomes one queue fan-out."
},
"rateLimit": {
"type": [
"object",
"null"
],
"required": [
"requests",
"windowSeconds"
],
"properties": {
"requests": {
"type": "integer",
"minimum": 1,
"description": "Requests allowed per window."
},
"windowSeconds": {
"type": "integer",
"minimum": 1,
"description": "Window size in seconds."
}
},
"description": "Per-endpoint rate limit. Set to null to remove. Both fields required together.",
"additionalProperties": false
},
"allowedIPs": {
"type": "array",
"items": {
"type": "string"
},
"description": "Inbound IP allowlist, in CIDR notation (e.g. \"203.0.113.0/24\", \"::1/128\"). Empty array = allow all."
},
"attributes": {
"type": "array",
"items": {
"type": "object",
"required": [
"name",
"in",
"attributeType"
],
"properties": {
"id": {
"type": "string",
"format": "uuid",
"description": "Stable attribute id. Optional on create; generated when omitted."
},
"in": {
"enum": [
"body",
"query",
"header",
"path"
],
"type": "string",
"description": "Where the attribute is read from on the inbound request."
},
"name": {
"type": "string",
"description": "Attribute field name (matches the inbound payload key)."
},
"params": {
"type": "object",
"description": "Validator parameters. Recognised keys: min, max (range/stringLength/arrayLength), values (oneOf/arraySubset/arrayIntersect), numbers (numberOneOf), type (typeValidator/arrayType).",
"additionalProperties": true
},
"schema": {
"type": [
"object",
"null"
],
"required": [
"type"
],
"properties": {
"type": {
"enum": [
"string",
"int",
"double",
"bool",
"array",
"object"
],
"type": "string"
},
"items": {
"type": "object",
"description": "For type=array: the element schema (same form)."
},
"maxItems": {
"type": "integer",
"minimum": 0
},
"minItems": {
"type": "integer",
"minimum": 0
},
"required": {
"type": "array",
"items": {
"type": "string"
},
"description": "For type=object: property names that must be present."
},
"properties": {
"type": "object",
"description": "For type=object: map of property name → schema (same form)."
},
"additionalProperties": {
"type": "boolean",
"description": "For type=object: when false, reject members not in properties."
}
},
"description": "Optional precise JSON shape, enforced recursively alongside validators[]. scalar: {type}. array: {type:\"array\", items:<schema>, minItems?, maxItems?}. object: {type:\"object\", properties:{name:<schema>}, required?:[...], additionalProperties?:bool}. type must match attributeType.",
"additionalProperties": true
},
"logging": {
"enum": [
"loggable",
"obscured",
"nonLoggable"
],
"type": "string",
"description": "How the value appears in the request log. obscured = masked; nonLoggable = stripped entirely."
},
"required": {
"type": "boolean",
"description": "When true, requests missing this attribute are rejected."
},
"forwarding": {
"enum": [
"blocked",
"forwardInPlace"
],
"type": "string",
"description": "Only meaningful for in=query or in=path. blocked (default): validated, never sent to the target. forwardInPlace: sent to the target in the same location — a query attribute as a query parameter, a path attribute as a path segment. A path attribute forwards only when its name is its own zero-based segment position (\"0\" for the first segment after the endpoint URL, \"1\" for the next, …) — path segments are matched positionally, not by name. To carry a value into the body or a header instead, leave this blocked and add a field mapping on the target sourced from this attribute."
},
"validators": {
"type": "array",
"items": {
"enum": [
"email",
"phone",
"int",
"double",
"bool",
"string",
"array",
"dictionary",
"range",
"oneOf",
"type",
"nil",
"not",
"empty",
"arrayType",
"arrayLength",
"arraySubset",
"arrayIntersect",
"intString",
"doubleString",
"boolString",
"numberString",
"numberOneOf",
"stringLength",
"stringEmpty",
"stringJson",
"dictionaryString"
],
"type": "string"
},
"description": "Validator names to run, in order. See params for any bounds/values they need."
},
"description": {
"type": "string",
"description": "Shown in the auto-generated OpenAPI doc."
},
"defaultValue": {
"description": "Used when the attribute is absent and required=false. Any scalar."
},
"attributeType": {
"enum": [
"string",
"int",
"double",
"bool",
"array",
"object"
],
"type": "string",
"description": "Expected value type."
}
},
"additionalProperties": false
},
"description": "Request validators. One entry per attribute; the Framework rejects callers whose payload fails the configured rules. Empty array = no validation."
},
"httpMethod": {
"enum": [
"GET",
"POST",
"PUT",
"PATCH",
"DELETE",
"HEAD",
"OPTIONS"
],
"type": "string",
"description": "HTTP method callers must use. GET endpoints cannot declare a body attribute (see attributes[].in)."
},
"mockResponse": {
"type": [
"object",
"null"
],
"properties": {
"body": {
"type": "string",
"description": "Literal response body."
},
"statusCode": {
"type": "integer",
"maximum": 599,
"minimum": 100
},
"contentType": {
"type": "string",
"description": "e.g. \"application/json\"."
}
},
"description": "Response returned in mock mode. Required when mock=true.",
"additionalProperties": false
},
"transformers": {
"type": [
"array",
"null"
],
"items": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"enum": [
"mergeFields",
"renameField",
"removeField",
"addField",
"mapValue",
"binaryToUrl"
],
"type": "string",
"description": "mergeFields: from+to(+separator). renameField: from+to. removeField: field. addField: to+value. mapValue: field+mapping. binaryToUrl: ttlSeconds?+maxSizeMB? (both clamped server-side — omit for the server default)."
},
"params": {
"type": [
"object",
"null"
],
"properties": {
"to": {
"type": "string",
"description": "Destination field — mergeFields / renameField / addField."
},
"from": {
"type": "array",
"items": {
"type": "string"
},
"description": "mergeFields (all sources) / renameField (first element is the source)."
},
"field": {
"type": "string",
"description": "Target field — removeField / mapValue."
},
"value": {
"type": "string",
"description": "Constant value to set — addField."
},
"mapping": {
"type": "object",
"description": "Value lookup table — mapValue.",
"additionalProperties": {
"type": "string"
}
},
"maxSizeMB": {
"type": "integer",
"minimum": 1,
"description": "Max upload size in MB — binaryToUrl."
},
"separator": {
"type": "string",
"description": "Join separator — mergeFields (default \" \")."
},
"ttlSeconds": {
"type": "integer",
"minimum": 1,
"description": "Temp file lifetime in seconds — binaryToUrl."
}
},
"description": "Only the keys the chosen type reads are accepted; see the type description above.",
"additionalProperties": false
}
},
"additionalProperties": false
},
"description": "Endpoint-level request transformation pipeline, applied before any target-level transformers. Set to null to remove the override and inherit the line default (if the line has one); set to an empty array to explicitly apply no transformation even when the line has a default. Omit on update_endpoint to leave the existing value unchanged."
},
"senderSignature": {
"type": [
"object",
"null"
],
"required": [
"scheme",
"credentialId"
],
"properties": {
"custom": {
"type": "object",
"required": [
"header",
"algorithm",
"encoding"
],
"properties": {
"header": {
"type": "string",
"description": "Request header carrying the signature, for example X-Shopify-Hmac-Sha256. 1 to 64 bytes of header-name characters (a-z, 0-9 and !#$%&'*+-.^_`|~, case-insensitive). Not authorization, cookie, host, content-length, transfer-encoding, connection or x-api-key."
},
"prefix": {
"type": "string",
"description": "Text in front of the signature in the header, for example v0=. At most 32 bytes. Default empty."
},
"message": {
"type": "string",
"description": "What is signed. At most 256 bytes. Placeholders: {body} (exactly once) and {timestamp} (at most once); any other { is invalid. Default {body}."
},
"encoding": {
"enum": [
"hex",
"base64"
],
"type": "string",
"description": "How the signature is written in the header."
},
"algorithm": {
"enum": [
"sha256",
"sha512",
"sha1"
],
"type": "string",
"description": "HMAC hash algorithm."
},
"secretEncoding": {
"enum": [
"utf8",
"base64"
],
"type": "string",
"description": "How the stored secret is read as the HMAC key. Default utf8."
},
"timestampHeader": {
"type": [
"string",
"null"
],
"description": "Header carrying the timestamp. Required when message contains {timestamp}, otherwise null or omitted. Same name rules as header."
}
},
"description": "Required when scheme is custom-hmac, refused for the other schemes. Describes how the sender signs.",
"additionalProperties": false
},
"scheme": {
"enum": [
"github",
"stripe",
"standard-webhooks",
"custom-hmac"
],
"type": "string",
"description": "How the sender signs: github, stripe, standard-webhooks, or custom-hmac (then `custom` is required)."
},
"credentialId": {
"type": "string",
"description": "UUID of the signingSecret credential holding the sender's secret."
}
},
"description": "Verify the sender's signature. When set, the endpoint accepts only requests signed by the sender (for example GitHub or Stripe) and no longer needs your API key. `credentialId` is a credential of type signingSecret (create_credential). Set to null to turn verification off. Omit on update_endpoint to leave it unchanged.",
"additionalProperties": false
},
"idempotencyEnabled": {
"type": "boolean",
"description": "When true, the Framework deduplicates on the caller's Idempotency-Key header. Default true."
}
},
"description": "An EchoRelay endpoint. Round-trips with the JSON returned by get_endpoint.",
"additionalProperties": false
},
"commitMode": {
"enum": [
"draft",
"publish"
],
"type": "string",
"description": "Defaults to publish. Draft writes require draftRevision."
},
"scheduledAt": {
"type": "string",
"description": "Compatibility alias: stage this endpoint in its line draft then schedule that line."
},
"draftRevision": {
"type": "integer",
"description": "Current line draft revision, required for draft writes."
}
}
}Create a new versioned line. A new line has no endpoints, so creating one publishes nothing and serves no traffic yet — add an endpoint, which publishes the line with it. Draft mode requires draftRevision 0. Requires edit access.
| Argument | Type | Description |
|---|---|---|
| name* | string | Human-readable line name. |
| lineKey* | string | URL key, lowercase letters/digits/hyphens, e.g. "v1". |
| commitMode | string | Defaults to publish. Draft writes require draftRevision. |
| draftRevision | integer | Current line draft revision, required for draft writes. |
{
"type": "object",
"required": [
"name",
"lineKey"
],
"properties": {
"name": {
"type": "string",
"description": "Human-readable line name."
},
"lineKey": {
"type": "string",
"description": "URL key, lowercase letters/digits/hyphens, e.g. \"v1\"."
},
"commitMode": {
"enum": [
"draft",
"publish"
],
"type": "string",
"description": "Defaults to publish. Draft writes require draftRevision."
},
"draftRevision": {
"type": "integer",
"description": "Current line draft revision, required for draft writes."
}
}
}Create a new project on your account so an agent can bootstrap from a fresh account. The slug is derived from the name and validated server-side (format, reserved words, uniqueness). Each plan includes a fixed number of active projects (free tiers one; paid plans more: see list_subscription_plans); at the limit this errors. If an existing project can host this integration, skip create_project and call create_project_token against it instead of adding another. Requires an ACCOUNT-scoped management token and the `config` scope. Returns the created project ({id, slug, name, apiBaseUrl, archived}); call create_project_token next to mint a management token for it.
| Argument | Type | Description |
|---|---|---|
| name* | string | Human-readable project name (1–100 chars). The slug is derived from it. |
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Human-readable project name (1–100 chars). The slug is derived from it."
}
}
}Mint a PROJECT-scoped management token (`er_mcp_`) for MCP and REST; it cannot authenticate relay traffic. Use it after create_project to configure a fresh project, or for any project you already own. Attenuated by design: the scopes must be a subset of THIS management token's own grant (`read` is always included), expiry is mandatory (1–90 days, default 30, never "never"), and the minted management token (being project-scoped) can never mint management tokens itself. `spend` is human-granted only: no management token, of any scope, can mint one carrying it. Mint a spend-scoped token from the project's panel instead. Requires an ACCOUNT-scoped management token and the `config` scope. Returns the plaintext exactly once; only its hash is stored.
| Argument | Type | Description |
|---|---|---|
| slug* | string | The slug of a project you own. |
| label* | string | Human-readable management token label (1–100 chars). |
| scopes | array | Scopes for the minted management token: must be a subset of this management token's own scopes. `read` is always granted. `spend` and the legacy `billing` scope are never mintable here (panel-only). Default: read + config. |
| expiresInDays | integer | Days until the minted management token expires. Default 30. API-minted management tokens always expire. |
{
"type": "object",
"required": [
"slug",
"label"
],
"properties": {
"slug": {
"type": "string",
"description": "The slug of a project you own."
},
"label": {
"type": "string",
"description": "Human-readable management token label (1–100 chars)."
},
"scopes": {
"type": "array",
"items": {
"enum": [
"read",
"config",
"mint:keys",
"manage:billing"
],
"type": "string"
},
"description": "Scopes for the minted management token: must be a subset of this management token's own scopes. `read` is always granted. `spend` and the legacy `billing` scope are never mintable here (panel-only). Default: read + config."
},
"expiresInDays": {
"type": "integer",
"maximum": 90,
"minimum": 1,
"description": "Days until the minted management token expires. Default 30. API-minted management tokens always expire."
}
}
}Take a line off the data plane immediately (callers get 404) without deleting it — endpoints/targets/config are preserved and it can be reactivated later. A deliberate action; live traffic is never auto-disabled. Requires edit access.
| Argument | Type | Description |
|---|---|---|
| lineKey* | string | The line key, e.g. "v1". |
| commitMode | string | Defaults to publish. Draft writes require draftRevision. |
| draftRevision | integer | Current line draft revision, required for draft writes. |
{
"type": "object",
"required": [
"lineKey"
],
"properties": {
"lineKey": {
"type": "string",
"description": "The line key, e.g. \"v1\"."
},
"commitMode": {
"enum": [
"draft",
"publish"
],
"type": "string",
"description": "Defaults to publish. Draft writes require draftRevision."
},
"draftRevision": {
"type": "integer",
"description": "Current line draft revision, required for draft writes."
}
}
}Return a canonical minimal-valid endpoint JSON for a fresh line. POST it verbatim to create_endpoint to land an immediately-working endpoint, then customise. It comes back with `mock: true`: it answers callers with its own canned body and never dials the target it carries, so a 200 from it proves the endpoint is reachable and nothing about delivery. Set `mock: false` and give the target a real URL before treating a call as delivered. Read-only.
| Argument | Type | Description |
|---|---|---|
| lineKey* | string | The line key, e.g. "v1". |
{
"type": "object",
"required": [
"lineKey"
],
"properties": {
"lineKey": {
"type": "string",
"description": "The line key, e.g. \"v1\"."
}
}
}Delete a saved credential. Blocked (not a permission or not-found error — a validation error) while any target still references it; repoint or remove those targets first.
| Argument | Type | Description |
|---|---|---|
| credentialId* | string | UUID of the credential to delete. |
{
"type": "object",
"required": [
"credentialId"
],
"properties": {
"credentialId": {
"type": "string",
"description": "UUID of the credential to delete."
}
}
}Delete an endpoint and its targets, immediately or by staging the removal in the line's draft with commitMode "draft" and draftRevision (returns `{draft}` instead of deleting right away). An immediate delete publishes a new revision without the endpoint and returns `{deleted: true, endpointId}`, but the line's prior revision still has it, so list_config_revisions can find that revision and rollback_config can republish over the deletion. Errors when `lineKey`/`endpointId` is missing, the line or endpoint doesn't exist, the draft revision is stale, removing the endpoint would leave an active line with no endpoints, or the publish is refused (a rejected target mapping or an outbound-allowlist violation is a validation error; a publish the platform could not verify is retryable). Requires edit access.
| Argument | Type | Description |
|---|---|---|
| lineKey* | string | The line key, e.g. "v1". |
| commitMode | string | Defaults to publish. Draft writes require draftRevision. |
| endpointId* | string | The endpoint UUID. |
| draftRevision | integer | Current line draft revision, required for draft writes. |
{
"type": "object",
"required": [
"lineKey",
"endpointId"
],
"properties": {
"lineKey": {
"type": "string",
"description": "The line key, e.g. \"v1\"."
},
"commitMode": {
"enum": [
"draft",
"publish"
],
"type": "string",
"description": "Defaults to publish. Draft writes require draftRevision."
},
"endpointId": {
"type": "string",
"description": "The endpoint UUID."
},
"draftRevision": {
"type": "integer",
"description": "Current line draft revision, required for draft writes."
}
}
}Delete a line and every endpoint under it, immediately or by staging the removal in the line's draft with commitMode "draft" and draftRevision (returns `{draft}`, discardable via discard_line_draft, instead of deleting right away). An immediate delete removes the line's own revision history along with it, so list_config_revisions has nothing left to list and rollback_config cannot bring the line back. Errors when `lineKey` is missing, doesn't match a line in the project, or the draft revision is stale. Requires edit access.
| Argument | Type | Description |
|---|---|---|
| lineKey* | string | The line key, e.g. "v1". |
| commitMode | string | Defaults to publish. Draft writes require draftRevision. |
| draftRevision | integer | Current line draft revision, required for draft writes. |
{
"type": "object",
"required": [
"lineKey"
],
"properties": {
"lineKey": {
"type": "string",
"description": "The line key, e.g. \"v1\"."
},
"commitMode": {
"enum": [
"draft",
"publish"
],
"type": "string",
"description": "Defaults to publish. Draft writes require draftRevision."
},
"draftRevision": {
"type": "integer",
"description": "Current line draft revision, required for draft writes."
}
}
}Permanently delete a DLQ entry without retrying it: the delivery is never re-sent and the entry cannot be restored. Use retry_dlq_entry instead when the delivery should still reach its target. The inbound request stays answerable through get_request for the project's requestLogRetentionDays window. Errors if the entry is already gone (retried, discarded, purged or evicted). Requires edit access.
| Argument | Type | Description |
|---|---|---|
| id* | string | Dead-letter entry id from list_dlq. |
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"description": "Dead-letter entry id from list_dlq."
}
}
}Discard one endpoint change from a line draft.
| Argument | Type | Description |
|---|---|---|
| lineKey* | string | |
| endpointId* | string | |
| draftRevision* | integer |
{
"type": "object",
"required": [
"lineKey",
"endpointId",
"draftRevision"
],
"properties": {
"lineKey": {
"type": "string"
},
"endpointId": {
"type": "string"
},
"draftRevision": {
"type": "integer"
}
}
}Discard every unpublished change and schedule for one line.
| Argument | Type | Description |
|---|---|---|
| lineKey* | string | |
| draftRevision* | integer |
{
"type": "object",
"required": [
"lineKey",
"draftRevision"
],
"properties": {
"lineKey": {
"type": "string"
},
"draftRevision": {
"type": "integer"
}
}
}Schedule a tier downgrade for a non-stackable add-on (RPM tier). The current tier stays active until `nextRenewalAt`; at that point the lower tier is charged and activated. No mid-cycle charge. Use list_addons to find available keys. Returns {addonKey, targetAddonKey, project, effectiveAt}. Owner-only; requires a token minted with the billing scope.
| Argument | Type | Description |
|---|---|---|
| addonKey* | string | Current active add-on key to downgrade from. |
| targetAddonKey* | string | Target (lower) add-on key to downgrade to. |
{
"type": "object",
"required": [
"addonKey",
"targetAddonKey"
],
"properties": {
"addonKey": {
"type": "string",
"description": "Current active add-on key to downgrade from."
},
"targetAddonKey": {
"type": "string",
"description": "Target (lower) add-on key to downgrade to."
}
},
"additionalProperties": false
}Validate an endpoint document without writing it. Returns either {ok: true, resolved: <Framework config slice>} or {ok: false, errors: {...}}. Pass endpointId to dry-run a PATCH against an existing endpoint; omit it to dry-run a create. Supply sample and/or answerSample to also run each target's mapping against a real payload and see what it produces, which field came from which node, and every rule that failed with the value that broke it. No DB write, no queue entry, no billing, and the payload is never sent anywhere.
| Argument | Type | Description |
|---|---|---|
| sample | object | array | string | number | boolean | null | Optional: a request payload, shaped as one a caller would actually send, passed as JSON rather than as a string containing JSON. Every target carrying an outgoingMapping is evaluated against it and the verdict is attached to that target as outgoingMappingEvaluation. |
| lineKey* | string | The line key. |
| endpoint* | object | Endpoint document (for create dry-run) or PATCH body (when endpointId is supplied). |
| endpointId | string | Optional: dry-run a PATCH against this endpoint UUID. |
| answerSample | object | array | string | number | boolean | null | Optional: an answer payload, shaped as one a target would actually return. Drives answerMapping the same way, as answerMappingEvaluation. It cannot be inferred from sample — the two travel in opposite directions. |
Copy a line and all its endpoints/targets/rules into a new line key — build v2 from v1. The copy is saved inactive and remains off the data plane; edit it, then activate_line when ready. Requires edit access.
| Argument | Type | Description |
|---|---|---|
| name | string | Optional name for the copy (defaults to "<source name> (copy)"). |
| lineKey* | string | The source line key to copy. |
| commitMode | string | Defaults to publish. Draft writes require draftRevision. |
| newLineKey* | string | New line key for the copy, e.g. "v2". |
| draftRevision | integer | Current line draft revision, required for draft writes. |
{
"type": "object",
"required": [
"lineKey",
"newLineKey"
],
"properties": {
"name": {
"type": "string",
"description": "Optional name for the copy (defaults to \"<source name> (copy)\")."
},
"lineKey": {
"type": "string",
"description": "The source line key to copy."
},
"commitMode": {
"enum": [
"draft",
"publish"
],
"type": "string",
"description": "Defaults to publish. Draft writes require draftRevision."
},
"newLineKey": {
"type": "string",
"description": "New line key for the copy, e.g. \"v2\"."
},
"draftRevision": {
"type": "integer",
"description": "Current line draft revision, required for draft writes."
}
}
}Generate a draft endpoint under a line from a sample inbound request and a description of the target: infers the inbound body schema from the sample, reads the target's method/URL/fields from an OpenAPI document (targetDocument) or a bare sample plus targetUrl, and proposes an outgoingMapping pairing every target field to a same-named inbound field. Nothing is guessed — a target field with no same-named match is reported in the "unmapped" list instead of being mapped, and every field it did map carries "inferred": true in the stored mapping tree. Always writes a draft (never publishes); the draft flows through preview_line_draft, dry_run_endpoint, config_diff and publish_line_draft like any other. Requires edit access.
| Argument | Type | Description |
|---|---|---|
| sample* | object | A sample inbound request body, shaped as one a real caller would send — one JSON field per key. |
| lineKey* | string | The line key to draft the generated endpoint under. |
| targetUrl | string | The target URL. Required when targetSample is used; ignored when targetDocument is used (its servers[] entry wins). |
| deliveryMode* | string | The caller contract this endpoint offers: async acceptance with later outcomes, one sync reply, or a stream. |
| targetSample | object | A raw sample of the target's own request body, used instead of targetDocument when there is no spec to read. Requires targetUrl. |
| draftRevision |
Get the project's credit balances (paid + testing) and which ledger it settles on. `billingModel` is `prepaid` (metered against the credit balance) or `invoiceable` (an Enterprise account, settled on the contract — its credit fields read empty/zero by design, not because it is out of credits). A zero balance is not on its own a reason to stop: live traffic is never refused for an empty balance, and a free-tier project is exempt from live credit billing entirely. Only the testing pool refuses when exhausted (402 `testing_credits_exhausted`). Read this before concluding from any other field that a project cannot send. On a Pro or Scale plan billed for overage, `overage` reports the billing cycle running now: `usedCredits`, `overageCredits` (beyond the allowance and prepaid credits), `amount` so far in minor units of `currency` (null when it cannot be worked out), `windowEndsAt`, `throttled` (true while this cycle's request limit is halved because spend passed five times the plan's credits) and `throttledUntil` (when the halved limit ends, or null); it is absent otherwise. On Pro or Scale, `overageBilling` is the account's own overage setting, changed with set_overage_billing.
No arguments.
{
"type": "object",
"properties": {}
}Get the project's published relay configuration — the exact JSON the EchoRelay Framework consumes. Includes pendingPublish with its frozen, redacted config when one is scheduled.
No arguments.
{
"type": "object",
"properties": {}
}Get DLQ entries by entry id (`{ms}-{seq}`, as returned by list_dlq's `id`) or by `requestId`. `requestId` is the durable handle — stable across a retry, unlike `id`, which changes every time an entry is replayed and later dead-letters again — and returns every fanned-out target's entry for that inbound request (one request can fan out to N targets, and several may dead-letter); `id` returns at most one. Each entry includes configVersion (the published config that authorised the delivery; 0 means unstamped). Errors if nothing matches this project — purged, retried, or discarded entries age out the same as any other.
| Argument | Type | Description |
|---|---|---|
| id | string | Dead-letter entry id, e.g. "1717930000000-0" (as returned by list_dlq). Changes on every retry — prefer requestId to track an entry across replays. |
| requestId | string | The UUID the relay returned in its 202, or from list_requests / list_dlq rows. Stable across retries. Returns every fanned-out target's DLQ entry for this request. Provide exactly one of id / requestId. |
{
"type": "object",
"oneOf": [
{
"required": [
"id"
]
},
{
"required": [
"requestId"
]
}
],
"properties": {
"id": {
"type": "string",
"description": "Dead-letter entry id, e.g. \"1717930000000-0\" (as returned by list_dlq). Changes on every retry — prefer requestId to track an entry across replays."
},
"requestId": {
"type": "string",
"description": "The UUID the relay returned in its 202, or from list_requests / list_dlq rows. Stable across retries. Returns every fanned-out target's DLQ entry for this request. Provide exactly one of id / requestId."
}
}
}Get one endpoint's full document by `lineKey` and `endpointId`: `id`, `lineKey`, `name`, `url`, `httpMethod`, `strict`, `rateLimit`, `allowedIPs`, `idempotencyEnabled`, `senderSignature` (`{scheme, credentialId}`, plus `custom` for the custom-hmac scheme, or null: whether the sender's signature is verified, never the secret), `mock`, `mockResponse`, `attributes`, `targets` (auth redacted), and `transformers`. Each target carries its `id`, and its secrets come back redacted: the `targets` array can be edited and sent back in update_endpoint's `patch`, where a target that keeps its `id` keeps its stored secrets unless new ones are given. Errors when either argument is missing or when the line or endpoint doesn't exist in this project.
| Argument | Type | Description |
|---|---|---|
| lineKey* | string | The line key, e.g. "v1". |
| endpointId* | string | The endpoint UUID. |
{
"type": "object",
"required": [
"lineKey",
"endpointId"
],
"properties": {
"lineKey": {
"type": "string",
"description": "The line key, e.g. \"v1\"."
},
"endpointId": {
"type": "string",
"description": "The endpoint UUID."
}
}
}Return the project's key policy: `defaultKeyTtlDays` (what create_api_key uses when `ttlDays` is omitted), plus `maxKeyTtlDays` and `editorsMayCreateNonExpiringKeys`, the limits create_api_key enforces when minting a key. Read-only; use set_key_policy to change these values.
No arguments.
{
"type": "object",
"properties": {}
}Read one line draft, its optimistic revision, preview, and schedule.
| Argument | Type | Description |
|---|---|---|
| lineKey* | string | The line key, e.g. "v1". |
{
"type": "object",
"required": [
"lineKey"
],
"properties": {
"lineKey": {
"type": "string",
"description": "The line key, e.g. \"v1\"."
}
}
}Aggregate request metrics for this project over a time window — volume, error rate and p50/p95/p99 latency, bucketed for charting. By default the series cover inbound requests; pass `targetId` to slice over one outbound target's per-attempt rows instead (answers "which target is degraded?"); pass `endpointId` to slice over inbound rows for a single endpoint (answers "is this endpoint receiving traffic / erroring?"). Pass at most one of targetId / endpointId. Free plans see "hour" and "day"; "week" and "month" require an active paid subscription on the project owner and are silently downgraded to "day" otherwise (the response includes `planGated: true` when that happens). Returns `{window, requestedWindow, planGated, scope, targetId?, endpointId?, bucketSeconds, buckets[], volume[], errors[], totalVolume, totalErrors, errorRate}` plus latency series whose keys depend on scope: an inbound read (project-wide, or `endpointId`) carries `relayP50[]/relayP95[]/relayP99[]` for our own time and `targetP50[]/targetP95[]/targetP99[]` for the destination's, never blended; a `targetId` read carries `p50[]/p95[]/p99[]` for that target's attempts — series arrays are dense (one point per bucket, zero-filled when no traffic).
| Argument | Type | Description |
|---|---|---|
| window | string | Time horizon. Defaults to "day". "week"/"month" require a paid plan; otherwise the server returns "day" with planGated=true. |
| targetId | string | Optional outbound target UUID (from get_endpoint targets). When set, the series aggregate the per-attempt rows for that target instead of the project-wide inbound rows. |
| endpointId | string | Optional endpoint UUID (from list_endpoints / get_endpoint). When set, the series aggregate inbound request rows for that endpoint only. Mutually exclusive with targetId. |
Get the EchoRelay project this token is scoped to: id, slug, name, caller-facing API base URL, whether the token has edit access, and the request-log hot-tier retention window.
No arguments.
{
"type": "object",
"properties": {}
}Get every target this request fanned out to, each with its delivery receipt or the reason it has none. A still-moving delivery (queued/retrying) answers from the live tracking copy, a terminal one (delivered/failed) from durable storage — the response shape is identical either way, so poll this on an interval with the same requestId a 202 response returned and watch `status` move to a terminal value. Each entry has targetId, targetURL, available, and when available: status (queued/retrying/delivered/failed), attempt, enqueuedAt/updatedAt/completedAt (unix ms), terminalError, callbackState (none/pending/delivered/failed — whether the target's completion-callback URL, if any, has been notified). When available is false, `reason` is "sync_or_stream_delivery" (the target answers inside the original HTTP response and is never tracked here — see the response body from that call instead) or "not_found" (no record for this target, e.g. aged past the retention window).
| Argument | Type | Description |
|---|---|---|
| requestId* | string | UUID returned by the relay in 202 responses or visible in list_requests rows. |
{
"type": "object",
"required": [
"requestId"
],
"properties": {
"requestId": {
"type": "string",
"description": "UUID returned by the relay in 202 responses or visible in list_requests rows."
}
}
}Get one inbound request envelope + every per-target delivery attempt made on the way out (success / permanent_failure / retry_scheduled / dlq). The request and each attempt carry configVersion, the published config that authorised them; 0 means unstamped. Scoped to this project; returns null once the request has aged out of the project's log-retention window (requestLogRetentionDays — see get_project).
| Argument | Type | Description |
|---|---|---|
| requestId* | string | UUID returned by the relay in 202 responses or visible in list_requests rows. |
{
"type": "object",
"required": [
"requestId"
],
"properties": {
"requestId": {
"type": "string",
"description": "UUID returned by the relay in 202 responses or visible in list_requests rows."
}
}
}Get the project owner's current subscription: plan, active flag, period start/end, cancel-at-period-end flag, external Paddle subscription id, and whether a payment method is on file at the provider. Owner-only; requires a token minted with the billing scope.
No arguments.
{
"type": "object",
"properties": {}
}Invite a person by email to collaborate on this project. Returns the new invitation record; the invitee receives an email with an accept link. Enforces the seat cap for the plan tier. Owner only.
| Argument | Type | Description |
|---|---|---|
| role* | string | Role to assign on acceptance. |
| email* | string | Email address to invite. |
{
"type": "object",
"required": [
"email",
"role"
],
"properties": {
"role": {
"enum": [
"editor",
"viewer",
"billing"
],
"type": "string",
"description": "Role to assign on acceptance."
},
"email": {
"type": "string",
"description": "Email address to invite."
}
}
}List the project owner`s currently-active add-ons. Returns `[{addonKey, project, monthlyEurCents, activatedAt, nextRenewalAt, consecutiveFailures}, ...]`. RPM upgrades are per-project; `project` is the slug they apply to (null for account-wide add-ons). Owner-only; requires a token minted with the billing scope.
No arguments.
{
"type": "object",
"properties": {}
}List the optional add-on subscriptions (RPM upgrades, extra team seats, extended log retention, extra file-delivery storage in +5 GB blocks, …). Each entry is monthly, renews every 30 days until cancelled, and carries `scope` (per_account or per_project). Read-only.
No arguments.
{
"type": "object",
"properties": {}
}List the project's inbound API keys as metadata only — the secret plaintext is never returned, only `id`, `name`, `mode`, `prefix`, `createdAt`, `createdBy`, `lastUsedAt`, `expiresAt`, `revokedAt`, `successorId`, `predecessorId`, and `successorRevealedAt`. Returns `{keys: []}` with no paging — every key on the project comes back in one call.
No arguments.
{
"type": "object",
"properties": {}
}List project audit-log entries, newest first. Captures who changed what — lines, endpoints, targets, API keys. Outbound-target `auth.token` / `auth.password` are redacted in the diff per the same policy used for endpoint reads. Retention is the `auditRetentionDays` advertised on get_project (default 365 days); rows older than that are purged by the cleanup job. Returns `{total, limit, offset, retentionDays, rows[]}` where each row has `id`, `createdAt`, `actor` (email or null), `action`, `entityType`, `entityId`, `entityLabel`, `diff`.
| Argument | Type | Description |
|---|---|---|
| limit | integer | Page size. Default 50. |
| since | integer | Lower bound on createdAt (unix ms). Inclusive. |
| until | integer | Upper bound on createdAt (unix ms). Inclusive. |
| action | string | Exact action match, e.g. "endpoint.updated", "target.created", "key.revoked". |
| offset | integer | Page offset. Default 0. |
| entityId | string | Exact entity id (UUID or stream id depending on entityType). |
| entityType | string | Exact entity type, e.g. "endpoint", "target", "line", "key". |
List every retained revision of one line, newest first, so a target revision can be picked for rollback_config. Returns `{revisions: []}` with no paging; each entry has `revision`, `publishedAt`, `current`, and `active`. Errors when `lineKey` is missing or doesn't match a line in the project.
| Argument | Type | Description |
|---|---|---|
| lineKey* | string | The line key, e.g. "v1". |
{
"type": "object",
"required": [
"lineKey"
],
"properties": {
"lineKey": {
"type": "string",
"description": "The line key, e.g. \"v1\"."
}
}
}List the project's saved credentials — reusable target-auth secrets that can be referenced from any number of targets instead of entering auth inline per target. `auth` is redacted (secret fields never returned, even encrypted — see create_credential for why).
No arguments.
{
"type": "object",
"properties": {}
}List the prepaid credit packs available to purchase, returned as a bare array of `{credits, eurCents, usdCents, plnGrosze, welcomeEligible}` objects — not wrapped in an envelope, and not paginated (the whole catalog every time). Read-only; identify a pack to start_topup by its `eurCents`.
No arguments.
{
"type": "object",
"properties": {}
}List entries currently in this project's dead-letter queue, newest first. One inbound request fans out per-target, so a single request may produce several DLQ entries, one per target that didn't accept it (different `targetId`s). Returns `{total, limit, offset, rows[], evictedCount}` where each row has `id` (the dead-letter entry id, `{ms}-{seq}`), `requestId`, `targetId`, `configVersion` (the published config that authorised the delivery; 0 means unstamped), `failureReason`, `failureCode` (stable machine-readable cause; `unclassified` for entries written before codes existed), `failedAttempts`, `failedAt`, `payload` (the JSON of the queued delivery as it was attempted); `evictedCount` is the lifetime count of entries the queue's capacity cap discarded before they could be triaged. DLQ entries — including the original request body and headers — are kept for up to 30 days from the failure time or until cleared, then purged automatically (or discarded early past capacity — see `evictedCount`); they are never written to a database. get_request still answers what happened to a purged/evicted/discarded entry's inbound request for the project's requestLogRetentionDays window, independent of whether the DLQ row itself still exists. `requestId` is the durable handle across a retry: an entry's own `id` changes every time it is replayed and later dead-letters again, so get_dlq_entry accepts a `requestId` lookup as well as `id`.
| Argument | Type | Description |
|---|---|---|
| limit | integer | Page size. Default 50. |
| offset | integer | Page offset. Default 0. |
{
"type": "object",
"properties": {
"limit": {
"type": "integer",
"maximum": 200,
"minimum": 1,
"description": "Page size. Default 50."
},
"offset": {
"type": "integer",
"minimum": 0,
"description": "Page offset. Default 0."
}
}
}List the endpoints under one line, identified by `lineKey`; returns `{lineKey, endpoints: []}` with no paging. Each entry reports `id`, `name`, `path`, `httpMethod`, `strict`, `mock`, and `targetCount` — not the endpoint's full body, which get_endpoint returns. Errors when `lineKey` is missing or doesn't match a line in the project.
| Argument | Type | Description |
|---|---|---|
| lineKey* | string | The line key, e.g. "v1". |
{
"type": "object",
"required": [
"lineKey"
],
"properties": {
"lineKey": {
"type": "string",
"description": "The line key, e.g. \"v1\"."
}
}
}List every line in the project: returns `{lines: []}` in one call, with no paging. Each entry reports `lineKey`, `name`, `active`, `docsShared`, `publishedAt`, `endpointCount`, and its draft state (`draftRevision`, `hasDraft`, `scheduledPublish`). A project with no lines yet returns an empty `lines` array rather than an error.
No arguments.
{
"type": "object",
"properties": {}
}List accepted and pending members of this project, plus the owner (role "owner"), each with `id`, `email`, `name`, `role`, and whether the invite has been accepted. Returns `{members: [], count, seatCap, seatsUsed}` with no paging — `count` is the roster size, `seatCap`/`seatsUsed` are the plan's seat limit and how many seats are used. Errors when the caller isn't the project owner or the token lacks the config scope. Owner only.
No arguments.
{
"type": "object",
"properties": {}
}List the management tokens scoped to a project you own (any holder): id, label, scopes, createdAt, lastUsedAt, expiresAt, revokedAt: never the secret (only its hash is stored). Requires an ACCOUNT-scoped management token and the `read` scope.
| Argument | Type | Description |
|---|---|---|
| slug* | string | The slug of a project you own. |
{
"type": "object",
"required": [
"slug"
],
"properties": {
"slug": {
"type": "string",
"description": "The slug of a project you own."
}
}
}List the projects on your account (archived included), each with `id`, `slug`, `name`, `apiBaseUrl` and `archived`, plus `accountEmail` — the account this token authenticates as. Requires an ACCOUNT-scoped management token (one minted with no project) and the `read` scope. A PROJECT-scoped management token cannot call this: use it on its own project's tools instead.
No arguments.
{
"type": "object",
"properties": {}
}List inbound API requests the relay has processed for this project, newest first. Hot-tier window is the project's requestLogRetentionDays (see get_project). Optional filters narrow the result. Returns {total, limit, offset, rows[]} where each row has ts (unix ms), requestId, method, path, status, durationMs, targets, creditsDeducted, authType, errorMessage, bytesSent, configVersion (the published config that authorised the request; 0 means unstamped), and closeReason (for a streaming request: complete / abortedOrError / byteCap / noValue; empty for non-stream requests).
| Argument | Type | Description |
|---|---|---|
| path | string | Substring of the request path (e.g. "/webhook"). LIKE-matched. |
| limit | integer | Page size. Default 50. |
| since | integer | Lower bound on ts (unix ms). Inclusive. |
| until | integer | Upper bound on ts (unix ms). Inclusive. |
| method | string | HTTP method (POST, GET, …). Case-insensitive. |
| offset | integer | Page offset. Default 0. |
| status | integer | Exact HTTP status code (e.g. 404). |
| targetOutcome |
List the available subscription plans (Free, Pro, Scale) with monthly EUR price, credit allowance, per-project RPM cap, and how many active projects the plan includes. Read-only.
No arguments.
{
"type": "object",
"properties": {}
}Preview one line draft without publishing it.
| Argument | Type | Description |
|---|---|---|
| lineKey* | string | The line key, e.g. "v1". |
{
"type": "object",
"required": [
"lineKey"
],
"properties": {
"lineKey": {
"type": "string",
"description": "The line key, e.g. \"v1\"."
}
}
}Preview what would happen if change_plan were called with this plan: the immediate-charge amount (cents), the next-invoice amount, the effective date, and the kind (`applied` for in-cycle upgrade, `scheduled` for at-period-end downgrade / cancel). Owner-only; requires a token minted with the billing scope.
| Argument | Type | Description |
|---|---|---|
| plan* | string | Target plan to preview a switch to. |
{
"type": "object",
"required": [
"plan"
],
"properties": {
"plan": {
"enum": [
"free",
"pro",
"scale"
],
"type": "string",
"description": "Target plan to preview a switch to."
}
}
}Turn on archive protection for a project you own: archive_project (on every surface: panel, REST, and this tool) then refuses until it is lifted. Idempotent. Permanent from here: there is no tool or API call to turn it back off; only contacting support can. Requires an ACCOUNT-scoped management token and the `config` scope.
| Argument | Type | Description |
|---|---|---|
| slug* | string | The slug of a project you own. |
{
"type": "object",
"required": [
"slug"
],
"properties": {
"slug": {
"type": "string",
"description": "The slug of a project you own."
}
}
}Publish one line draft now and clear only its schedule.
| Argument | Type | Description |
|---|---|---|
| lineKey* | string | |
| draftRevision* | integer |
{
"type": "object",
"required": [
"lineKey",
"draftRevision"
],
"properties": {
"lineKey": {
"type": "string"
},
"draftRevision": {
"type": "integer"
}
}
}Remove a member (accepted or pending) from this project by memberId or email, matching the first record found; returns `{message, email}`. This deletes the membership record outright with no undo, so getting the person back onto the project takes a fresh invite_member call, not a restore. Errors when neither `memberId` nor `email` is given, no member matches, the caller isn't the project owner, or the token lacks the config scope. Owner only.
| Argument | Type | Description |
|---|---|---|
| string | Email address (alternative to memberId — removes the first matching member). | |
| memberId | string | Member record UUID (from list_members). |
{
"type": "object",
"properties": {
"email": {
"type": "string",
"description": "Email address (alternative to memberId — removes the first matching member)."
},
"memberId": {
"type": "string",
"description": "Member record UUID (from list_members)."
}
}
}Rename a project you own (the display name only: the slug, which identifies the project in URLs and API paths, never changes). Requires an ACCOUNT-scoped management token and the `config` scope. 404-equivalent error when you do not own the slug.
| Argument | Type | Description |
|---|---|---|
| name* | string | The new display name (1–100 chars). |
| slug* | string | The slug of a project you own. |
{
"type": "object",
"required": [
"slug",
"name"
],
"properties": {
"name": {
"type": "string",
"description": "The new display name (1–100 chars)."
},
"slug": {
"type": "string",
"description": "The slug of a project you own."
}
}
}Re-send the invitation email for a still-pending invite, by member ID or email (from list_members). The original accept link is reused. Already-accepted members are rejected. Owner only.
| Argument | Type | Description |
|---|---|---|
| string | Email address (alternative to memberId — targets the first matching pending invite). | |
| memberId | string | Member record UUID (from list_members). |
{
"type": "object",
"properties": {
"email": {
"type": "string",
"description": "Email address (alternative to memberId — targets the first matching pending invite)."
},
"memberId": {
"type": "string",
"description": "Member record UUID (from list_members)."
}
}
}Resume (un-cancel) a pending-cancel add-on whose paid-through cycle has not yet ended. Clears the cancellation so the add-on renews normally at the next cycle boundary. No new charge — the cycle was already paid. Stackable add-ons cannot be resumed; buy a new unit instead. Returns {addonKey, project, nextRenewalAt, resumed}. Owner-only; requires a token minted with the billing scope.
| Argument | Type | Description |
|---|---|---|
| addonKey* | string | Add-on key to resume (e.g. "log_retention", "rpm_5000"). |
{
"type": "object",
"required": [
"addonKey"
],
"properties": {
"addonKey": {
"type": "string",
"description": "Add-on key to resume (e.g. \"log_retention\", \"rpm_5000\")."
}
},
"additionalProperties": false
}Re-enqueue a DLQ entry to the main relay stream and delete it from the DLQ. A replay is billed like any relay — it charges the entry's original credit cost to the project before re-sending; if the balance is too low the entry stays in the DLQ and this returns an insufficient-credits error (top up and retry). Succeeds if the entry exists, errors if it's already gone (retried or discarded). Requires edit access.
| Argument | Type | Description |
|---|---|---|
| id* | string | Dead-letter entry id from list_dlq. |
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"description": "Dead-letter entry id from list_dlq."
}
}
}One-shot retrieval of the plaintext for a successor minted by the auto-rotation scheduler (not by rotate_api_key — that returns its own plaintext directly). Decrypts the at-rest ciphertext, returns it once, then destroys it; a second call errors. Only available while the predecessor still has an unrevealed successor.
| Argument | Type | Description |
|---|---|---|
| keyId* | string | UUID of the predecessor key whose successor to reveal. |
{
"type": "object",
"required": [
"keyId"
],
"properties": {
"keyId": {
"type": "string",
"description": "UUID of the predecessor key whose successor to reveal."
}
}
}Revoke a key immediately: it stops authenticating as soon as the change reaches the relay, with no overlap window, so callers still using it start failing. To replace a key without downtime, use rotate_api_key instead; if the key already has a successor, fetch it with reveal_rotation_successor, because rotate_api_key refuses a key that has one. Revoking a successor leaves its predecessor unable to rotate again. Owner anywhere, editor on own keys.
| Argument | Type | Description |
|---|---|---|
| keyId* | string | UUID of the key to revoke. |
{
"type": "object",
"required": [
"keyId"
],
"properties": {
"keyId": {
"type": "string",
"description": "UUID of the key to revoke."
}
}
}Revoke a PROJECT-scoped management token on a project you own, any holder's, not just your own (the account-owner kill switch for a leaked or retired integration's management token). Soft-revoke: the row stays for traceability and the management token is rejected immediately. Idempotent. Requires an ACCOUNT-scoped management token and the `config` scope.
| Argument | Type | Description |
|---|---|---|
| slug* | string | The slug of a project you own. |
| tokenId* | string | The management token UUID (from create_project_token or list_project_tokens). |
{
"type": "object",
"required": [
"slug",
"tokenId"
],
"properties": {
"slug": {
"type": "string",
"description": "The slug of a project you own."
},
"tokenId": {
"type": "string",
"description": "The management token UUID (from create_project_token or list_project_tokens)."
}
}
}Preview or apply publishing a retained line revision over what is currently published, clearing any pending schedule. Without confirmRevision this only returns the diff (the redacted change-gate preview, same shape as config_diff) between what is currently published and the target revision — it changes nothing. To apply, call again with confirmRevision set to the diff's currentRevision; if a publish landed since the preview, confirmRevision is now stale and the call is refused with error "rollback_confirmation_conflict" instead of silently overwriting the newer publish — read the fresh diff and confirm again. Applying also requires confirmUnsigned, the preview's unsignedFingerprint, so a signing secret expiring between the preview and the confirm cannot roll a target back unsigned without you having seen it named.
| Argument | Type | Description |
|---|---|---|
| lineKey* | string | |
| revision* | integer | |
| confirmRevision | integer | The currently-published revision number from the preview diff. Omit to preview only; include to apply. |
| confirmUnsigned | string | The preview diff's unsignedFingerprint. Required whenever confirmRevision is given: a target's retained signing secret expires on a clock, so this proves the confirm saw the same set of targets the preview named as coming back unsigned. A stale one is refused with "rollback_confirmation_conflict". |
Mint a linked successor for an existing key. Returns the successor plaintext exactly once — store it now. The predecessor stays valid through its overlap window so callers can swap without downtime. Owner anywhere, editor on own keys.
| Argument | Type | Description |
|---|---|---|
| keyId* | string | UUID of the key to rotate. |
{
"type": "object",
"required": [
"keyId"
],
"properties": {
"keyId": {
"type": "string",
"description": "UUID of the key to rotate."
}
}
}Schedule one non-empty line draft. Active subscribers required.
| Argument | Type | Description |
|---|---|---|
| lineKey* | string | |
| scheduledAt* | string | |
| draftRevision* | integer |
{
"type": "object",
"required": [
"lineKey",
"draftRevision",
"scheduledAt"
],
"properties": {
"lineKey": {
"type": "string"
},
"scheduledAt": {
"type": "string"
},
"draftRevision": {
"type": "integer"
}
}
}Enable or disable the auto-decaying burst window for live traffic and publish the change immediately. When enabled, brief spikes a little above your steady RPM cap are absorbed at the normal credit rate (no surcharge, no burst SKU) instead of being rejected. Sustained overage decays back to your steady cap; headroom returns once traffic cools below the cap or you add RPM. Burst usage is tracked so you can see when to upgrade. Default is off (steady cap is a hard 429). Requires edit access.
| Argument | Type | Description |
|---|---|---|
| enabled* | boolean | true to enable the burst window; false to disable. |
{
"type": "object",
"required": [
"enabled"
],
"properties": {
"enabled": {
"type": "boolean",
"description": "true to enable the burst window; false to disable."
}
}
}Turn the line's public OpenAPI docs on or off. When enabled, the line's spec is published at docs.{baseDomain}/{slug}/{lineKey} (and …/openapi.json); when disabled those URLs return 404. The `docsShared` field on each line read (list_lines) reflects the current state. Requires edit access.
| Argument | Type | Description |
|---|---|---|
| enabled* | boolean | true to publish the line's public docs; false to take them down. |
| lineKey* | string | The line key, e.g. "v1". |
| commitMode | string | Defaults to publish. Draft writes require draftRevision. |
| draftRevision | integer | Current line draft revision, required for draft writes. |
{
"type": "object",
"required": [
"lineKey",
"enabled"
],
"properties": {
"enabled": {
"type": "boolean",
"description": "true to publish the line's public docs; false to take them down."
},
"lineKey": {
"type": "string",
"description": "The line key, e.g. \"v1\"."
},
"commitMode": {
"enum": [
"draft",
"publish"
],
"type": "string",
"description": "Defaults to publish. Draft writes require draftRevision."
},
"draftRevision": {
"type": "integer",
"description": "Current line draft revision, required for draft writes."
}
}
}Owner-only. Edit the project's key policy. Only fields present in the patch are touched. Editors calling this get an error — use get_key_policy to read.
| Argument | Type | Description |
|---|---|---|
| maxKeyTtlDays | integer | null | |
| defaultKeyTtlDays | integer | null | |
| editorsMayCreateNonExpiringKeys | boolean |
{
"type": "object",
"properties": {
"maxKeyTtlDays": {
"type": [
"integer",
"null"
]
},
"defaultKeyTtlDays": {
"type": [
"integer",
"null"
]
},
"editorsMayCreateNonExpiringKeys": {
"type": "boolean"
}
}
}Change a member's role between editor, viewer, and billing. Identify the member by their member ID or email (from list_members); the project owner's own role cannot be changed. Returns the updated member record. Owner only.
| Argument | Type | Description |
|---|---|---|
| role* | string | The new role. |
| string | Email address (alternative to memberId — targets the first matching member). | |
| memberId | string | Member record UUID (from list_members). |
{
"type": "object",
"required": [
"role"
],
"properties": {
"role": {
"enum": [
"editor",
"viewer",
"billing"
],
"type": "string",
"description": "The new role."
},
"email": {
"type": "string",
"description": "Email address (alternative to memberId — targets the first matching member)."
},
"memberId": {
"type": "string",
"description": "Member record UUID (from list_members)."
}
}
}Narrow the project's outbound host allowlist — the hosts a target may point at. The current list is on get_project as `outboundHostAllowlist` (empty means any public host). This tool may only narrow it: `patterns` must be a strict subset of, or equal to, the current list, compared as exact strings — submitting a wildcard that would cover an existing exact host, or clearing to empty, is refused as a widen. Widening the list is web-only, in the panel. Refused when the project already has a target (inactive lines included) outside the submitted list. Requires edit access.
| Argument | Type | Description |
|---|---|---|
| patterns* | array | The full replacement list of allowed hosts, e.g. ["api.stripe.com", "*.internal.example.com"]. Must be a subset of the current outboundHostAllowlist. |
{
"type": "object",
"required": [
"patterns"
],
"properties": {
"patterns": {
"type": "array",
"items": {
"type": "string"
},
"description": "The full replacement list of allowed hosts, e.g. [\"api.stripe.com\", \"*.internal.example.com\"]. Must be a subset of the current outboundHostAllowlist."
}
}
}Turn the project owner's overage billing on or off, for the whole account. Returns `{overageBilling}`, the setting get_billing reads back. Owner-only; requires a token minted with the billing scope.
| Argument | Type | Description |
|---|---|---|
| enabled* | boolean | True (the default) bills credits past your allowance and prepaid balance as overage; false slows the account to the free rate once its credits are gone instead, and nothing is refused. Turning it off still bills overage already used this billing cycle; turning it on bills only usage after the change. |
{
"type": "object",
"required": [
"enabled"
],
"properties": {
"enabled": {
"type": "boolean",
"description": "True (the default) bills credits past your allowance and prepaid balance as overage; false slows the account to the free rate once its credits are gone instead, and nothing is refused. Turning it off still bills overage already used this billing cycle; turning it on bills only usage after the change."
}
}
}Set or clear a self-set ceiling on this project's own effective live-traffic RPM (Traffic shaping) — for when your origin can't take the throughput your plan grants. Never plan-gated: the ceiling can only LOWER your effective RPM below your plan/add-on rate, never raise it, and never touches billing. Steady traffic is capped at the ceiling; if Burst Protect is on, its headroom is measured above the ceiling, not above the plan rate. The current value is on get_project as `rpmCeiling` (null = no ceiling). Requires edit access.
| Argument | Type | Description |
|---|---|---|
| rpmCeiling* | integer | null | A positive integer to set the ceiling, or null to clear it. |
{
"type": "object",
"required": [
"rpmCeiling"
],
"properties": {
"rpmCeiling": {
"type": [
"integer",
"null"
],
"minimum": 1,
"description": "A positive integer to set the ceiling, or null to clear it."
}
}
}Begin a new Pro or Scale subscription for the project owner. Returns `{checkoutUrl, plan}` — surface the URL to the human for approval. Errors if the owner is already on an active paid plan (use change_plan instead). Owner-only; requires a token minted with the billing scope.
| Argument | Type | Description |
|---|---|---|
| plan* | string |
{
"type": "object",
"required": [
"plan"
],
"properties": {
"plan": {
"enum": [
"pro",
"scale"
],
"type": "string"
}
}
}Begin a credit-pack top-up for the project owner. Pass the pack`s `eurCents` (from list_credit_packs). Returns `{checkoutUrl, credits, eurCents, directCharge}` or `{transactionId, credits, eurCents, directCharge:true}` on subsequent MCP purchases. Owner-only; requires a token minted with the billing scope.
| Argument | Type | Description |
|---|---|---|
| eurCents* | integer | Pack price in EUR cents, matching a pack returned by list_credit_packs. |
{
"type": "object",
"required": [
"eurCents"
],
"properties": {
"eurCents": {
"type": "integer",
"minimum": 1,
"description": "Pack price in EUR cents, matching a pack returned by list_credit_packs."
}
}
}Subscribe the project owner to a monthly add-on (RPM upgrade, team seat, extended log retention, extra file storage in +5 GB blocks, …). Charges the saved payment method immediately, then auto-renews every 30 days until `unsubscribe_addon` — or until the subscription ends, after which the already-paid cycle stays active to its own end date and stops without further charges. Requires an active Pro/Scale subscription and a saved PM. RPM upgrades (rpm_*) are per-project and apply to THIS project automatically. Returns `{addonKey, project, monthlyEurCents, transactionId, chargeStatus, activatedAt, nextRenewalAt}`. `transactionId`: The Paddle transaction id, or null while Paddle has not yet listed the charge. The purchase is recorded either way; do not retry it. `chargeStatus`: `pending` or `completed`. Owner-only; requires a token minted with the billing scope.
| Argument | Type | Description |
|---|---|---|
| addonKey* | string | Stable key from list_addons (e.g. "team_member", "rpm_2000", "log_retention", "file_storage"). |
{
"type": "object",
"required": [
"addonKey"
],
"properties": {
"addonKey": {
"type": "string",
"description": "Stable key from list_addons (e.g. \"team_member\", \"rpm_2000\", \"log_retention\", \"file_storage\")."
}
}
}Restore an archived project you own to the data plane. Restoring consumes one of your plan's active-project slots, so at the limit this returns an error telling you to archive another project or upgrade. Idempotent for an already-active project. Requires an ACCOUNT-scoped management token and the `config` scope.
| Argument | Type | Description |
|---|---|---|
| slug* | string | The slug of a project you own. |
{
"type": "object",
"required": [
"slug"
],
"properties": {
"slug": {
"type": "string",
"description": "The slug of a project you own."
}
}
}Cancel an active add-on subscription. Stops future charges; the current cycle stays active until expiry. RPM upgrades are cancelled for THIS project. Returns `{addonKey, project, cancelledAt}`. Owner-only; requires a token minted with the billing scope.
| Argument | Type | Description |
|---|---|---|
| addonKey* | string |
{
"type": "object",
"required": [
"addonKey"
],
"properties": {
"addonKey": {
"type": "string"
}
}
}Rename a credential and/or rotate its secret, publishing the change immediately so every target that uses this credential picks it up right away. Omit a secret field (or the whole `auth` object) to keep the existing value — the vault can never show a secret back to confirm it, so leaving it out means "unchanged," not "cleared." The destination host cannot be changed here: create a new credential for a new destination.
| Argument | Type | Description |
|---|---|---|
| auth | object | Same shape as create_credential. Omit to keep the existing auth entirely. |
| name | string | New name. Omit to keep the existing one. |
| credentialId* | string | UUID of the credential (from list_credentials). |
| destinationHost | string | Permanent — may only restate the credential's current host (omit it, or send back what list_credentials reported). Any other value is refused; a credential is never re-aimed, it is replaced. |
{
"type": "object",
"required": [
"credentialId"
],
"properties": {
"auth": {
"type": "object",
"description": "Same shape as create_credential. Omit to keep the existing auth entirely."
},
"name": {
"type": "string",
"description": "New name. Omit to keep the existing one."
},
"credentialId": {
"type": "string",
"description": "UUID of the credential (from list_credentials)."
},
"destinationHost": {
"type": "string",
"description": "Permanent — may only restate the credential's current host (omit it, or send back what list_credentials reported). Any other value is refused; a credential is never re-aimed, it is replaced."
}
}
}Update an endpoint immediately or by staging the change in its line draft with commitMode "draft" and draftRevision; the patch is merged field-by-field onto the endpoint's current values, so omitted keys keep their values. Targets are matched by the `id` get_endpoint returned; without one, by the same `name` and `targetUrl` (when only one stored target has that pair); without either, a patch to the target in the same position matches it, as long as the list keeps its length, the patch doesn't change both its `name` and `targetUrl`, and a changed `targetUrl` stays on the same host. A matched target keeps its stored secrets (auth and signingSecret) when they are omitted or redacted; an unmatched target is new, must carry its secrets, and a redacted `***` on it is rejected. An immediate update treats a target that exists only in the line draft as unmatched. Draft mode returns `{draft}`; an immediate update returns `{endpoint, scheduledAt}` with the endpoint's full updated document. Errors on a missing `lineKey`/`endpointId`, an unknown line or endpoint, a patch that fails validation (including a rejected target mapping or an outbound-allowlist violation), or a stale draftRevision. Requires edit access.
| Argument | Type | Description |
|---|---|---|
| patch* | object | Partial endpoint document — same shape as create_endpoint, every field optional. |
| lineKey* | string | The line key. |
| commitMode | string | Defaults to publish. Draft writes require draftRevision. |
| endpointId* | string | The endpoint UUID. |
{
"type": "object",
"required": [
"name",
"auth"
],
"properties": {
"auth": {
"type": "object",
"required": [
"type"
],
"properties": {
"key": {
"type": "string",
"description": "apiKeyHeader / apiKeyQuery / publicPrivateKey."
},
"type": {
"enum": [
"bearer",
"basic",
"apiKeyHeader",
"apiKeyQuery",
"publicPrivateKey",
"oauthClientCredentials",
"signingSecret"
],
"type": "string"
},
"scope": {
"type": "string",
"description": "oauthClientCredentials only, optional. Space-separated scopes."
},
"token": {
"type": "string",
"description": "bearer only."
},
"secret": {
"type": "string",
"description": "publicPrivateKey or signingSecret."
},
"audience": {
"type": "string",
"description": "oauthClientCredentials only, optional."
},
"clientId": {
"type": "string",
"description": "oauthClientCredentials only."
},
"password": {
"type": "string",
"description": "basic only."
},
"tokenUrl": {
"type": "string",
"description": "oauthClientCredentials only. An https URL; the only place the client secret is ever sent. Permanent after create — an update may only restate it."
},
"username": {
"type": "string",
"description": "basic only."
},
"paramName": {
"type": "string",
"description": "apiKeyQuery only, e.g. \"api_key\"."
},
"clientAuth": {
"enum": [
"basic",
"post"
],
"type": "string",
"description": "oauthClientCredentials only. \"basic\" (default) sends the client credentials in an Authorization header, \"post\" in the request body."
},
"headerName": {
"type": "string",
"description": "apiKeyHeader only, e.g. \"X-Api-Key\"."
},
"clientSecret": {
"type": "string",
"description": "oauthClientCredentials only. Omit on update to keep the stored value."
}
},
"description": "The credential's auth shape."
},
"name": {
"type": "string",
"description": "Human-readable label, up to 120 characters."
},
"destinationHost": {
"type": "string",
"description": "The only host this credential may be sent to, e.g. \"api.stripe.com\", or a single-label wildcard, e.g. \"*.stripe.com\" (matches api.stripe.com, not stripe.com and not a.b.stripe.com). Host only — no scheme, port or path. Internationalised hosts must be given in punycode (\"xn--…\"). Permanent: attaching this credential to a target on any other host is refused, and it cannot be changed later — a different destination means a new credential, which means entering the secret again."
}
}
}{
"type": "object",
"required": [
"lineKey",
"endpoint"
],
"properties": {
"sample": {
"type": [
"object",
"array",
"string",
"number",
"boolean",
"null"
],
"description": "Optional: a request payload, shaped as one a caller would actually send, passed as JSON rather than as a string containing JSON. Every target carrying an outgoingMapping is evaluated against it and the verdict is attached to that target as outgoingMappingEvaluation."
},
"lineKey": {
"type": "string",
"description": "The line key."
},
"endpoint": {
"type": "object",
"properties": {
"url": {
"type": "string",
"pattern": "^/[A-Za-z0-9/_\\-{}]*$",
"description": "Path under the line, e.g. \"/webhook\". Must start with \"/\" and contain only [A-Za-z0-9/_-{}]."
},
"mock": {
"type": "boolean",
"description": "When true, callers receive mockResponse without fan-out to targets. Targets are saved but not invoked."
},
"name": {
"type": "string",
"minLength": 1,
"description": "Human-readable label for the endpoint."
},
"strict": {
"type": "boolean",
"description": "When true, validation rejects any attribute not declared in attributes[]. Default false."
},
"targets": {
"type": "array",
"items": {
"type": "object",
"required": [
"name",
"targetUrl",
"auth",
"deliveryMode"
],
"properties": {
"id": {
"type": "string",
"description": "Returned on reads. Send it back unchanged to update that target and keep its stored secrets. Targets are matched by id; without one, by the same name and targetUrl; without either, a patch to the target in the same position keeps its secrets, as long as the list keeps its length, the patch does not change both its name and targetUrl, and a changed targetUrl stays on the same host. Any other target is new and must carry its own secrets."
},
"auth": {
"type": "object",
"required": [
"type"
],
"properties": {
"key": {
"type": "string",
"description": "Required when type=apiKeyHeader or type=apiKeyQuery or type=publicPrivateKey."
},
"type": {
"enum": [
"none",
"bearer",
"basic",
"apiKeyHeader",
"apiKeyQuery",
"publicPrivateKey",
"oauthClientCredentials"
],
"type": "string"
},
"scope": {
"type": "string",
"description": "Optional, type=oauthClientCredentials. Space-separated scopes."
},
"token": {
"type": "string",
"description": "Required when type=bearer."
},
"secret": {
"type": "string",
"description": "Required when type=publicPrivateKey."
},
"audience": {
"type": "string",
"description": "Optional, type=oauthClientCredentials."
},
"clientId": {
"type": "string",
"description": "Required when type=oauthClientCredentials."
},
"password": {
"type": "string",
"description": "Required when type=basic."
},
"tokenUrl": {
"type": "string",
"description": "Required when type=oauthClientCredentials. An https URL."
},
"username": {
"type": "string",
"description": "Required when type=basic."
},
"paramName": {
"type": "string",
"description": "Required when type=apiKeyQuery."
},
"clientAuth": {
"enum": [
"basic",
"post"
],
"type": "string",
"description": "type=oauthClientCredentials only. How client credentials are sent to the token URL: basic (Authorization header, default) or post (request body)."
},
"headerName": {
"type": "string",
"description": "Required when type=apiKeyHeader."
},
"clientSecret": {
"type": "string",
"description": "Required when type=oauthClientCredentials. Never returned on reads."
}
},
"description": "Outbound auth applied to the request. On reads, secrets are redacted to \"***\" — round-trip the sentinel to keep the stored secret. Ignored when credentialVaultEntryId is set.",
"additionalProperties": false
},
"name": {
"type": "string",
"description": "Display name for the target."
},
"mapping": {
"type": "array",
"items": {
"type": "object",
"required": [
"sourceIn",
"sourceName",
"targetIn",
"targetName"
],
"properties": {
"sourceIn": {
"enum": [
"body",
"query",
"header",
"path"
],
"type": "string"
},
"targetIn": {
"enum": [
"body",
"query",
"header"
],
"type": "string"
},
"template": {
"type": "string",
"description": "Optional templated value (e.g. \"Bearer {value}\")."
},
"sourceName": {
"type": "string",
"description": "Inbound field name to read."
},
"targetName": {
"type": "string",
"description": "Outbound field name to write."
}
},
"additionalProperties": false
},
"description": "Optional transformer rules. Each rule moves or renames a field from the inbound request to the outbound one."
},
"targetUrl": {
"type": "string",
"format": "uri",
"description": "Outbound URL. Cannot point back to this project (the Framework rejects relay loops)."
},
"callbackURL": {
"type": "string",
"format": "uri",
"description": "Pushed once this target's delivery reaches a terminal status — see get_receipts' callbackState. Must be https. Meaningful for async targets only — refused on sync/stream. Cannot point back into this project (the same relay-loop rule as targetUrl) and must be inside the project's outbound host allowlist when one is set. Unset = the customer polls the receipt instead."
},
"retryPolicy": {
"type": [
"object",
"null"
],
"properties": {
"retryOn": {
"type": "array",
"items": {
"type": "integer",
"maximum": 599,
"minimum": 100
},
"description": "HTTP status codes that trigger a retry. Default [429, 500, 502, 503, 504]."
},
"maxAttempts": {
"type": "integer",
"maximum": 14,
"minimum": 1,
"description": "Total delivery attempts, counting the first. 1 fails fast: one try, then the dead-letter queue. Higher values keep retrying with a widening gap between tries — at the default backoffMultiplier, roughly under a minute at 4, a few minutes at 7, about an hour at 10, a few hours at 14. Anything still undelivered lands in the dead-letter queue. Defaults to 14."
},
"backoffMultiplier": {
"type": "number",
"maximum": 5,
"minimum": 1,
"description": "How sharply the gap between tries widens. Higher spends the same attempts over a longer stretch. Defaults to 2.0."
}
},
"description": "Async retry policy. Ignored unless deliveryMode=async. Leave it unset (null) and the platform default applies, which behaves the same as maxAttempts at its maximum. get_endpoint reports which is in effect: this object when set, null when the platform default applies.",
"additionalProperties": false
},
"syncTimeout": {
"type": "integer",
"maximum": 90,
"minimum": 1,
"description": "Seconds the caller waits for a sync target. Ignored unless deliveryMode=sync."
},
"deliveryMode": {
"enum": [
"async",
"sync",
"stream"
],
"type": "string",
"description": "async = queued + retried (default); sync = caller waits up to syncTimeout for the target response; stream = SSE pass-through (max 1 per endpoint)."
},
"transformers": {
"type": "array",
"items": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"enum": [
"mergeFields",
"renameField",
"removeField",
"addField",
"mapValue",
"binaryToUrl"
],
"type": "string",
"description": "mergeFields: from+to(+separator). renameField: from+to. removeField: field. addField: to+value. mapValue: field+mapping. binaryToUrl: ttlSeconds?+maxSizeMB? (both clamped server-side — omit for the server default)."
},
"params": {
"type": [
"object",
"null"
],
"properties": {
"to": {
"type": "string",
"description": "Destination field — mergeFields / renameField / addField."
},
"from": {
"type": "array",
"items": {
"type": "string"
},
"description": "mergeFields (all sources) / renameField (first element is the source)."
},
"field": {
"type": "string",
"description": "Target field — removeField / mapValue."
},
"value": {
"type": "string",
"description": "Constant value to set — addField."
},
"mapping": {
"type": "object",
"description": "Value lookup table — mapValue.",
"additionalProperties": {
"type": "string"
}
},
"maxSizeMB": {
"type": "integer",
"minimum": 1,
"description": "Max upload size in MB — binaryToUrl."
},
"separator": {
"type": "string",
"description": "Join separator — mergeFields (default \" \")."
},
"ttlSeconds": {
"type": "integer",
"minimum": 1,
"description": "Temp file lifetime in seconds — binaryToUrl."
}
},
"description": "Only the keys the chosen type reads are accepted; see the type description above.",
"additionalProperties": false
}
},
"additionalProperties": false
},
"description": "Request transformation pipeline applied to this target before delivery. Empty array = no transformation."
},
"answerMapping": {
"type": [
"object",
"null"
],
"description": "Reshapes this target's answer into what the caller receives — a tree of typed nodes conforming to the same published grammar as outgoingMapping. Refused on a stream target (deliveryMode=stream) — a stream's response is proxied straight through and never reshaped. null = no reshaping, the answer reaches the caller verbatim; paths, types and cycles are checked server-side."
},
"signingSecret": {
"type": [
"string",
"null"
],
"description": "Signs the body delivered to this target — separate from auth above, which authenticates OUTBOUND to the target. Shape: \"whsec_\" followed by base64 of 32 random bytes. Omit to leave unchanged; set to null to disable signing; set to your own whsec_-shaped value to use it verbatim (rejected otherwise, including an empty string — you hold this secret, so only you can supply it). On reads, a configured secret is redacted to \"***\" — round-trip that sentinel to keep the stored secret."
},
"answerVariants": {
"type": [
"object",
"null"
],
"description": "The conditional form of answerMapping, for a target whose answers do not all share one shape: one mapping per reply instead of one for every reply. Requires \"distinguishBy\" naming the single thing that tells them apart ({\"source\":\"status\"}, {\"source\":\"header\",\"name\":…} or {\"source\":\"bodyField\",\"path\":…}), \"variants\" as an object keyed by the value it matches — an exact status like \"429\", a class like \"4XX\", or \"default\" — each holding a tree in the same grammar as answerMapping — or, where the caller should be answered with a status of your own, an object {\"mapping\": <tree>, \"replyStatus\": 402} — and \"onNoMatch\", which has no default and must be either \"passthrough\" (hand the vendor's answer back untouched) or \"fail\" (answer 422 naming the value that matched nothing). A replyStatus is what the caller sees and never what the delivery is measured or charged as; it must be a status that can carry a body (200–599, excluding 204, 205 and redirects), and setting one drops the vendor's own response headers, which describe the answer it replaced. A variant keyed on a status that carries no body (204, 205, 304) is reachable only when it sets one. Mutually exclusive with answerMapping on this target, and refused on a stream target for the same reason answerMapping is. A variant whose tree does not compile is refused when the line is published, not silently dropped. null = no reshaping."
},
"outgoingMapping": {
"type": [
"object",
"null"
],
"description": "Reshapes the request into what this target expects — a tree of typed nodes conforming to the published grammar at \"https://schemas.echorelay.dev/transform/mapping/v1.json\" (its own $schema key must name that value). Mutually exclusive with mapping and transformers on this target, and with the endpoint's own transformers — the write is rejected if both are set. null = no reshaping (today's behaviour, and the only value this schema itself can validate; paths, types and cycles are checked server-side)."
},
"credentialVaultEntryId": {
"type": "string",
"description": "References a saved credential (see list_credentials/create_credential) instead of inline auth — the auth field above is ignored when this is set. Must belong to the same project. The credential is bound to a destination when it is created: targetUrl must be https and its host must match that credential's destinationHost, or the write is rejected."
}
},
"additionalProperties": false
},
"description": "Outbound destinations. Required unless mock=true. Each entry becomes one queue fan-out."
},
"rateLimit": {
"type": [
"object",
"null"
],
"required": [
"requests",
"windowSeconds"
],
"properties": {
"requests": {
"type": "integer",
"minimum": 1,
"description": "Requests allowed per window."
},
"windowSeconds": {
"type": "integer",
"minimum": 1,
"description": "Window size in seconds."
}
},
"description": "Per-endpoint rate limit. Set to null to remove. Both fields required together.",
"additionalProperties": false
},
"allowedIPs": {
"type": "array",
"items": {
"type": "string"
},
"description": "Inbound IP allowlist, in CIDR notation (e.g. \"203.0.113.0/24\", \"::1/128\"). Empty array = allow all."
},
"attributes": {
"type": "array",
"items": {
"type": "object",
"required": [
"name",
"in",
"attributeType"
],
"properties": {
"id": {
"type": "string",
"format": "uuid",
"description": "Stable attribute id. Optional on create; generated when omitted."
},
"in": {
"enum": [
"body",
"query",
"header",
"path"
],
"type": "string",
"description": "Where the attribute is read from on the inbound request."
},
"name": {
"type": "string",
"description": "Attribute field name (matches the inbound payload key)."
},
"params": {
"type": "object",
"description": "Validator parameters. Recognised keys: min, max (range/stringLength/arrayLength), values (oneOf/arraySubset/arrayIntersect), numbers (numberOneOf), type (typeValidator/arrayType).",
"additionalProperties": true
},
"schema": {
"type": [
"object",
"null"
],
"required": [
"type"
],
"properties": {
"type": {
"enum": [
"string",
"int",
"double",
"bool",
"array",
"object"
],
"type": "string"
},
"items": {
"type": "object",
"description": "For type=array: the element schema (same form)."
},
"maxItems": {
"type": "integer",
"minimum": 0
},
"minItems": {
"type": "integer",
"minimum": 0
},
"required": {
"type": "array",
"items": {
"type": "string"
},
"description": "For type=object: property names that must be present."
},
"properties": {
"type": "object",
"description": "For type=object: map of property name → schema (same form)."
},
"additionalProperties": {
"type": "boolean",
"description": "For type=object: when false, reject members not in properties."
}
},
"description": "Optional precise JSON shape, enforced recursively alongside validators[]. scalar: {type}. array: {type:\"array\", items:<schema>, minItems?, maxItems?}. object: {type:\"object\", properties:{name:<schema>}, required?:[...], additionalProperties?:bool}. type must match attributeType.",
"additionalProperties": true
},
"logging": {
"enum": [
"loggable",
"obscured",
"nonLoggable"
],
"type": "string",
"description": "How the value appears in the request log. obscured = masked; nonLoggable = stripped entirely."
},
"required": {
"type": "boolean",
"description": "When true, requests missing this attribute are rejected."
},
"forwarding": {
"enum": [
"blocked",
"forwardInPlace"
],
"type": "string",
"description": "Only meaningful for in=query or in=path. blocked (default): validated, never sent to the target. forwardInPlace: sent to the target in the same location — a query attribute as a query parameter, a path attribute as a path segment. A path attribute forwards only when its name is its own zero-based segment position (\"0\" for the first segment after the endpoint URL, \"1\" for the next, …) — path segments are matched positionally, not by name. To carry a value into the body or a header instead, leave this blocked and add a field mapping on the target sourced from this attribute."
},
"validators": {
"type": "array",
"items": {
"enum": [
"email",
"phone",
"int",
"double",
"bool",
"string",
"array",
"dictionary",
"range",
"oneOf",
"type",
"nil",
"not",
"empty",
"arrayType",
"arrayLength",
"arraySubset",
"arrayIntersect",
"intString",
"doubleString",
"boolString",
"numberString",
"numberOneOf",
"stringLength",
"stringEmpty",
"stringJson",
"dictionaryString"
],
"type": "string"
},
"description": "Validator names to run, in order. See params for any bounds/values they need."
},
"description": {
"type": "string",
"description": "Shown in the auto-generated OpenAPI doc."
},
"defaultValue": {
"description": "Used when the attribute is absent and required=false. Any scalar."
},
"attributeType": {
"enum": [
"string",
"int",
"double",
"bool",
"array",
"object"
],
"type": "string",
"description": "Expected value type."
}
},
"additionalProperties": false
},
"description": "Request validators. One entry per attribute; the Framework rejects callers whose payload fails the configured rules. Empty array = no validation."
},
"httpMethod": {
"enum": [
"GET",
"POST",
"PUT",
"PATCH",
"DELETE",
"HEAD",
"OPTIONS"
],
"type": "string",
"description": "HTTP method callers must use. GET endpoints cannot declare a body attribute (see attributes[].in)."
},
"mockResponse": {
"type": [
"object",
"null"
],
"properties": {
"body": {
"type": "string",
"description": "Literal response body."
},
"statusCode": {
"type": "integer",
"maximum": 599,
"minimum": 100
},
"contentType": {
"type": "string",
"description": "e.g. \"application/json\"."
}
},
"description": "Response returned in mock mode. Required when mock=true.",
"additionalProperties": false
},
"transformers": {
"type": [
"array",
"null"
],
"items": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"enum": [
"mergeFields",
"renameField",
"removeField",
"addField",
"mapValue",
"binaryToUrl"
],
"type": "string",
"description": "mergeFields: from+to(+separator). renameField: from+to. removeField: field. addField: to+value. mapValue: field+mapping. binaryToUrl: ttlSeconds?+maxSizeMB? (both clamped server-side — omit for the server default)."
},
"params": {
"type": [
"object",
"null"
],
"properties": {
"to": {
"type": "string",
"description": "Destination field — mergeFields / renameField / addField."
},
"from": {
"type": "array",
"items": {
"type": "string"
},
"description": "mergeFields (all sources) / renameField (first element is the source)."
},
"field": {
"type": "string",
"description": "Target field — removeField / mapValue."
},
"value": {
"type": "string",
"description": "Constant value to set — addField."
},
"mapping": {
"type": "object",
"description": "Value lookup table — mapValue.",
"additionalProperties": {
"type": "string"
}
},
"maxSizeMB": {
"type": "integer",
"minimum": 1,
"description": "Max upload size in MB — binaryToUrl."
},
"separator": {
"type": "string",
"description": "Join separator — mergeFields (default \" \")."
},
"ttlSeconds": {
"type": "integer",
"minimum": 1,
"description": "Temp file lifetime in seconds — binaryToUrl."
}
},
"description": "Only the keys the chosen type reads are accepted; see the type description above.",
"additionalProperties": false
}
},
"additionalProperties": false
},
"description": "Endpoint-level request transformation pipeline, applied before any target-level transformers. Set to null to remove the override and inherit the line default (if the line has one); set to an empty array to explicitly apply no transformation even when the line has a default. Omit on update_endpoint to leave the existing value unchanged."
},
"senderSignature": {
"type": [
"object",
"null"
],
"required": [
"scheme",
"credentialId"
],
"properties": {
"custom": {
"type": "object",
"required": [
"header",
"algorithm",
"encoding"
],
"properties": {
"header": {
"type": "string",
"description": "Request header carrying the signature, for example X-Shopify-Hmac-Sha256. 1 to 64 bytes of header-name characters (a-z, 0-9 and !#$%&'*+-.^_`|~, case-insensitive). Not authorization, cookie, host, content-length, transfer-encoding, connection or x-api-key."
},
"prefix": {
"type": "string",
"description": "Text in front of the signature in the header, for example v0=. At most 32 bytes. Default empty."
},
"message": {
"type": "string",
"description": "What is signed. At most 256 bytes. Placeholders: {body} (exactly once) and {timestamp} (at most once); any other { is invalid. Default {body}."
},
"encoding": {
"enum": [
"hex",
"base64"
],
"type": "string",
"description": "How the signature is written in the header."
},
"algorithm": {
"enum": [
"sha256",
"sha512",
"sha1"
],
"type": "string",
"description": "HMAC hash algorithm."
},
"secretEncoding": {
"enum": [
"utf8",
"base64"
],
"type": "string",
"description": "How the stored secret is read as the HMAC key. Default utf8."
},
"timestampHeader": {
"type": [
"string",
"null"
],
"description": "Header carrying the timestamp. Required when message contains {timestamp}, otherwise null or omitted. Same name rules as header."
}
},
"description": "Required when scheme is custom-hmac, refused for the other schemes. Describes how the sender signs.",
"additionalProperties": false
},
"scheme": {
"enum": [
"github",
"stripe",
"standard-webhooks",
"custom-hmac"
],
"type": "string",
"description": "How the sender signs: github, stripe, standard-webhooks, or custom-hmac (then `custom` is required)."
},
"credentialId": {
"type": "string",
"description": "UUID of the signingSecret credential holding the sender's secret."
}
},
"description": "Verify the sender's signature. When set, the endpoint accepts only requests signed by the sender (for example GitHub or Stripe) and no longer needs your API key. `credentialId` is a credential of type signingSecret (create_credential). Set to null to turn verification off. Omit on update_endpoint to leave it unchanged.",
"additionalProperties": false
},
"idempotencyEnabled": {
"type": "boolean",
"description": "When true, the Framework deduplicates on the caller's Idempotency-Key header. Default true."
}
},
"description": "Endpoint document (for create dry-run) or PATCH body (when endpointId is supplied).",
"additionalProperties": false
},
"endpointId": {
"type": "string",
"description": "Optional: dry-run a PATCH against this endpoint UUID."
},
"answerSample": {
"type": [
"object",
"array",
"string",
"number",
"boolean",
"null"
],
"description": "Optional: an answer payload, shaped as one a target would actually return. Drives answerMapping the same way, as answerMappingEvaluation. It cannot be inferred from sample — the two travel in opposite directions."
}
}
}| integer |
| The line's current draft revision (0 for a line with no draft yet) — see get_line_draft. |
| targetDocument | string | The target's OpenAPI 3.x document (YAML or JSON). Mutually exclusive with targetSample; must describe exactly one operation. |
| targetFilename | string | Filename hint for targetDocument, to decide YAML vs JSON. Defaults to "target.json". |
| targetHttpMethod | string | HTTP method for the target when using targetSample. Defaults to POST. |
{
"type": "object",
"required": [
"lineKey",
"sample",
"deliveryMode",
"draftRevision"
],
"properties": {
"sample": {
"type": "object",
"description": "A sample inbound request body, shaped as one a real caller would send — one JSON field per key."
},
"lineKey": {
"type": "string",
"description": "The line key to draft the generated endpoint under."
},
"targetUrl": {
"type": "string",
"description": "The target URL. Required when targetSample is used; ignored when targetDocument is used (its servers[] entry wins)."
},
"deliveryMode": {
"enum": [
"async",
"sync",
"stream"
],
"type": "string",
"description": "The caller contract this endpoint offers: async acceptance with later outcomes, one sync reply, or a stream."
},
"targetSample": {
"type": "object",
"description": "A raw sample of the target's own request body, used instead of targetDocument when there is no spec to read. Requires targetUrl."
},
"draftRevision": {
"type": "integer",
"description": "The line's current draft revision (0 for a line with no draft yet) — see get_line_draft."
},
"targetDocument": {
"type": "string",
"description": "The target's OpenAPI 3.x document (YAML or JSON). Mutually exclusive with targetSample; must describe exactly one operation."
},
"targetFilename": {
"type": "string",
"description": "Filename hint for targetDocument, to decide YAML vs JSON. Defaults to \"target.json\"."
},
"targetHttpMethod": {
"type": "string",
"description": "HTTP method for the target when using targetSample. Defaults to POST."
}
}
}{
"type": "object",
"properties": {
"window": {
"enum": [
"hour",
"day",
"week",
"month"
],
"type": "string",
"description": "Time horizon. Defaults to \"day\". \"week\"/\"month\" require a paid plan; otherwise the server returns \"day\" with planGated=true."
},
"targetId": {
"type": "string",
"description": "Optional outbound target UUID (from get_endpoint targets). When set, the series aggregate the per-attempt rows for that target instead of the project-wide inbound rows."
},
"endpointId": {
"type": "string",
"description": "Optional endpoint UUID (from list_endpoints / get_endpoint). When set, the series aggregate inbound request rows for that endpoint only. Mutually exclusive with targetId."
}
}
}{
"type": "object",
"properties": {
"limit": {
"type": "integer",
"maximum": 200,
"minimum": 1,
"description": "Page size. Default 50."
},
"since": {
"type": "integer",
"description": "Lower bound on createdAt (unix ms). Inclusive."
},
"until": {
"type": "integer",
"description": "Upper bound on createdAt (unix ms). Inclusive."
},
"action": {
"type": "string",
"description": "Exact action match, e.g. \"endpoint.updated\", \"target.created\", \"key.revoked\"."
},
"offset": {
"type": "integer",
"minimum": 0,
"description": "Page offset. Default 0."
},
"entityId": {
"type": "string",
"description": "Exact entity id (UUID or stream id depending on entityType)."
},
"entityType": {
"type": "string",
"description": "Exact entity type, e.g. \"endpoint\", \"target\", \"line\", \"key\"."
}
}
}| string |
| Narrow to requests that produced at least one per-target attempt with this outcome. Use "dlq" to find requests with at least one target that ended up dead-lettered. |
{
"type": "object",
"properties": {
"path": {
"type": "string",
"description": "Substring of the request path (e.g. \"/webhook\"). LIKE-matched."
},
"limit": {
"type": "integer",
"maximum": 200,
"minimum": 1,
"description": "Page size. Default 50."
},
"since": {
"type": "integer",
"description": "Lower bound on ts (unix ms). Inclusive."
},
"until": {
"type": "integer",
"description": "Upper bound on ts (unix ms). Inclusive."
},
"method": {
"type": "string",
"description": "HTTP method (POST, GET, …). Case-insensitive."
},
"offset": {
"type": "integer",
"minimum": 0,
"description": "Page offset. Default 0."
},
"status": {
"type": "integer",
"description": "Exact HTTP status code (e.g. 404)."
},
"targetOutcome": {
"enum": [
"success",
"permanent_failure",
"retry_scheduled",
"dlq"
],
"type": "string",
"description": "Narrow to requests that produced at least one per-target attempt with this outcome. Use \"dlq\" to find requests with at least one target that ended up dead-lettered."
}
}
}{
"type": "object",
"required": [
"lineKey",
"revision"
],
"properties": {
"lineKey": {
"type": "string"
},
"revision": {
"type": "integer",
"minimum": 1
},
"confirmRevision": {
"type": "integer",
"minimum": 1,
"description": "The currently-published revision number from the preview diff. Omit to preview only; include to apply."
},
"confirmUnsigned": {
"type": "string",
"description": "The preview diff's unsignedFingerprint. Required whenever confirmRevision is given: a target's retained signing secret expires on a clock, so this proves the confirm saw the same set of targets the preview named as coming back unsigned. A stale one is refused with \"rollback_confirmation_conflict\"."
}
}
}| scheduledAt | string | Compatibility alias: stage this update then schedule its line. |
| draftRevision | integer | Current line draft revision, required for draft writes. |
{
"type": "object",
"required": [
"lineKey",
"endpointId",
"patch"
],
"properties": {
"patch": {
"type": "object",
"properties": {
"url": {
"type": "string",
"pattern": "^/[A-Za-z0-9/_\\-{}]*$",
"description": "Path under the line, e.g. \"/webhook\". Must start with \"/\" and contain only [A-Za-z0-9/_-{}]."
},
"mock": {
"type": "boolean",
"description": "When true, callers receive mockResponse without fan-out to targets. Targets are saved but not invoked."
},
"name": {
"type": "string",
"minLength": 1,
"description": "Human-readable label for the endpoint."
},
"strict": {
"type": "boolean",
"description": "When true, validation rejects any attribute not declared in attributes[]. Default false."
},
"targets": {
"type": "array",
"items": {
"type": "object",
"required": [
"name",
"targetUrl",
"auth",
"deliveryMode"
],
"properties": {
"id": {
"type": "string",
"description": "Returned on reads. Send it back unchanged to update that target and keep its stored secrets. Targets are matched by id; without one, by the same name and targetUrl; without either, a patch to the target in the same position keeps its secrets, as long as the list keeps its length, the patch does not change both its name and targetUrl, and a changed targetUrl stays on the same host. Any other target is new and must carry its own secrets."
},
"auth": {
"type": "object",
"required": [
"type"
],
"properties": {
"key": {
"type": "string",
"description": "Required when type=apiKeyHeader or type=apiKeyQuery or type=publicPrivateKey."
},
"type": {
"enum": [
"none",
"bearer",
"basic",
"apiKeyHeader",
"apiKeyQuery",
"publicPrivateKey",
"oauthClientCredentials"
],
"type": "string"
},
"scope": {
"type": "string",
"description": "Optional, type=oauthClientCredentials. Space-separated scopes."
},
"token": {
"type": "string",
"description": "Required when type=bearer."
},
"secret": {
"type": "string",
"description": "Required when type=publicPrivateKey."
},
"audience": {
"type": "string",
"description": "Optional, type=oauthClientCredentials."
},
"clientId": {
"type": "string",
"description": "Required when type=oauthClientCredentials."
},
"password": {
"type": "string",
"description": "Required when type=basic."
},
"tokenUrl": {
"type": "string",
"description": "Required when type=oauthClientCredentials. An https URL."
},
"username": {
"type": "string",
"description": "Required when type=basic."
},
"paramName": {
"type": "string",
"description": "Required when type=apiKeyQuery."
},
"clientAuth": {
"enum": [
"basic",
"post"
],
"type": "string",
"description": "type=oauthClientCredentials only. How client credentials are sent to the token URL: basic (Authorization header, default) or post (request body)."
},
"headerName": {
"type": "string",
"description": "Required when type=apiKeyHeader."
},
"clientSecret": {
"type": "string",
"description": "Required when type=oauthClientCredentials. Never returned on reads."
}
},
"description": "Outbound auth applied to the request. On reads, secrets are redacted to \"***\" — round-trip the sentinel to keep the stored secret. Ignored when credentialVaultEntryId is set.",
"additionalProperties": false
},
"name": {
"type": "string",
"description": "Display name for the target."
},
"mapping": {
"type": "array",
"items": {
"type": "object",
"required": [
"sourceIn",
"sourceName",
"targetIn",
"targetName"
],
"properties": {
"sourceIn": {
"enum": [
"body",
"query",
"header",
"path"
],
"type": "string"
},
"targetIn": {
"enum": [
"body",
"query",
"header"
],
"type": "string"
},
"template": {
"type": "string",
"description": "Optional templated value (e.g. \"Bearer {value}\")."
},
"sourceName": {
"type": "string",
"description": "Inbound field name to read."
},
"targetName": {
"type": "string",
"description": "Outbound field name to write."
}
},
"additionalProperties": false
},
"description": "Optional transformer rules. Each rule moves or renames a field from the inbound request to the outbound one."
},
"targetUrl": {
"type": "string",
"format": "uri",
"description": "Outbound URL. Cannot point back to this project (the Framework rejects relay loops)."
},
"callbackURL": {
"type": "string",
"format": "uri",
"description": "Pushed once this target's delivery reaches a terminal status — see get_receipts' callbackState. Must be https. Meaningful for async targets only — refused on sync/stream. Cannot point back into this project (the same relay-loop rule as targetUrl) and must be inside the project's outbound host allowlist when one is set. Unset = the customer polls the receipt instead."
},
"retryPolicy": {
"type": [
"object",
"null"
],
"properties": {
"retryOn": {
"type": "array",
"items": {
"type": "integer",
"maximum": 599,
"minimum": 100
},
"description": "HTTP status codes that trigger a retry. Default [429, 500, 502, 503, 504]."
},
"maxAttempts": {
"type": "integer",
"maximum": 14,
"minimum": 1,
"description": "Total delivery attempts, counting the first. 1 fails fast: one try, then the dead-letter queue. Higher values keep retrying with a widening gap between tries — at the default backoffMultiplier, roughly under a minute at 4, a few minutes at 7, about an hour at 10, a few hours at 14. Anything still undelivered lands in the dead-letter queue. Defaults to 14."
},
"backoffMultiplier": {
"type": "number",
"maximum": 5,
"minimum": 1,
"description": "How sharply the gap between tries widens. Higher spends the same attempts over a longer stretch. Defaults to 2.0."
}
},
"description": "Async retry policy. Ignored unless deliveryMode=async. Leave it unset (null) and the platform default applies, which behaves the same as maxAttempts at its maximum. get_endpoint reports which is in effect: this object when set, null when the platform default applies.",
"additionalProperties": false
},
"syncTimeout": {
"type": "integer",
"maximum": 90,
"minimum": 1,
"description": "Seconds the caller waits for a sync target. Ignored unless deliveryMode=sync."
},
"deliveryMode": {
"enum": [
"async",
"sync",
"stream"
],
"type": "string",
"description": "async = queued + retried (default); sync = caller waits up to syncTimeout for the target response; stream = SSE pass-through (max 1 per endpoint)."
},
"transformers": {
"type": "array",
"items": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"enum": [
"mergeFields",
"renameField",
"removeField",
"addField",
"mapValue",
"binaryToUrl"
],
"type": "string",
"description": "mergeFields: from+to(+separator). renameField: from+to. removeField: field. addField: to+value. mapValue: field+mapping. binaryToUrl: ttlSeconds?+maxSizeMB? (both clamped server-side — omit for the server default)."
},
"params": {
"type": [
"object",
"null"
],
"properties": {
"to": {
"type": "string",
"description": "Destination field — mergeFields / renameField / addField."
},
"from": {
"type": "array",
"items": {
"type": "string"
},
"description": "mergeFields (all sources) / renameField (first element is the source)."
},
"field": {
"type": "string",
"description": "Target field — removeField / mapValue."
},
"value": {
"type": "string",
"description": "Constant value to set — addField."
},
"mapping": {
"type": "object",
"description": "Value lookup table — mapValue.",
"additionalProperties": {
"type": "string"
}
},
"maxSizeMB": {
"type": "integer",
"minimum": 1,
"description": "Max upload size in MB — binaryToUrl."
},
"separator": {
"type": "string",
"description": "Join separator — mergeFields (default \" \")."
},
"ttlSeconds": {
"type": "integer",
"minimum": 1,
"description": "Temp file lifetime in seconds — binaryToUrl."
}
},
"description": "Only the keys the chosen type reads are accepted; see the type description above.",
"additionalProperties": false
}
},
"additionalProperties": false
},
"description": "Request transformation pipeline applied to this target before delivery. Empty array = no transformation."
},
"answerMapping": {
"type": [
"object",
"null"
],
"description": "Reshapes this target's answer into what the caller receives — a tree of typed nodes conforming to the same published grammar as outgoingMapping. Refused on a stream target (deliveryMode=stream) — a stream's response is proxied straight through and never reshaped. null = no reshaping, the answer reaches the caller verbatim; paths, types and cycles are checked server-side."
},
"signingSecret": {
"type": [
"string",
"null"
],
"description": "Signs the body delivered to this target — separate from auth above, which authenticates OUTBOUND to the target. Shape: \"whsec_\" followed by base64 of 32 random bytes. Omit to leave unchanged; set to null to disable signing; set to your own whsec_-shaped value to use it verbatim (rejected otherwise, including an empty string — you hold this secret, so only you can supply it). On reads, a configured secret is redacted to \"***\" — round-trip that sentinel to keep the stored secret."
},
"answerVariants": {
"type": [
"object",
"null"
],
"description": "The conditional form of answerMapping, for a target whose answers do not all share one shape: one mapping per reply instead of one for every reply. Requires \"distinguishBy\" naming the single thing that tells them apart ({\"source\":\"status\"}, {\"source\":\"header\",\"name\":…} or {\"source\":\"bodyField\",\"path\":…}), \"variants\" as an object keyed by the value it matches — an exact status like \"429\", a class like \"4XX\", or \"default\" — each holding a tree in the same grammar as answerMapping — or, where the caller should be answered with a status of your own, an object {\"mapping\": <tree>, \"replyStatus\": 402} — and \"onNoMatch\", which has no default and must be either \"passthrough\" (hand the vendor's answer back untouched) or \"fail\" (answer 422 naming the value that matched nothing). A replyStatus is what the caller sees and never what the delivery is measured or charged as; it must be a status that can carry a body (200–599, excluding 204, 205 and redirects), and setting one drops the vendor's own response headers, which describe the answer it replaced. A variant keyed on a status that carries no body (204, 205, 304) is reachable only when it sets one. Mutually exclusive with answerMapping on this target, and refused on a stream target for the same reason answerMapping is. A variant whose tree does not compile is refused when the line is published, not silently dropped. null = no reshaping."
},
"outgoingMapping": {
"type": [
"object",
"null"
],
"description": "Reshapes the request into what this target expects — a tree of typed nodes conforming to the published grammar at \"https://schemas.echorelay.dev/transform/mapping/v1.json\" (its own $schema key must name that value). Mutually exclusive with mapping and transformers on this target, and with the endpoint's own transformers — the write is rejected if both are set. null = no reshaping (today's behaviour, and the only value this schema itself can validate; paths, types and cycles are checked server-side)."
},
"credentialVaultEntryId": {
"type": "string",
"description": "References a saved credential (see list_credentials/create_credential) instead of inline auth — the auth field above is ignored when this is set. Must belong to the same project. The credential is bound to a destination when it is created: targetUrl must be https and its host must match that credential's destinationHost, or the write is rejected."
}
},
"additionalProperties": false
},
"description": "Outbound destinations. Required unless mock=true. Each entry becomes one queue fan-out."
},
"rateLimit": {
"type": [
"object",
"null"
],
"required": [
"requests",
"windowSeconds"
],
"properties": {
"requests": {
"type": "integer",
"minimum": 1,
"description": "Requests allowed per window."
},
"windowSeconds": {
"type": "integer",
"minimum": 1,
"description": "Window size in seconds."
}
},
"description": "Per-endpoint rate limit. Set to null to remove. Both fields required together.",
"additionalProperties": false
},
"allowedIPs": {
"type": "array",
"items": {
"type": "string"
},
"description": "Inbound IP allowlist, in CIDR notation (e.g. \"203.0.113.0/24\", \"::1/128\"). Empty array = allow all."
},
"attributes": {
"type": "array",
"items": {
"type": "object",
"required": [
"name",
"in",
"attributeType"
],
"properties": {
"id": {
"type": "string",
"format": "uuid",
"description": "Stable attribute id. Optional on create; generated when omitted."
},
"in": {
"enum": [
"body",
"query",
"header",
"path"
],
"type": "string",
"description": "Where the attribute is read from on the inbound request."
},
"name": {
"type": "string",
"description": "Attribute field name (matches the inbound payload key)."
},
"params": {
"type": "object",
"description": "Validator parameters. Recognised keys: min, max (range/stringLength/arrayLength), values (oneOf/arraySubset/arrayIntersect), numbers (numberOneOf), type (typeValidator/arrayType).",
"additionalProperties": true
},
"schema": {
"type": [
"object",
"null"
],
"required": [
"type"
],
"properties": {
"type": {
"enum": [
"string",
"int",
"double",
"bool",
"array",
"object"
],
"type": "string"
},
"items": {
"type": "object",
"description": "For type=array: the element schema (same form)."
},
"maxItems": {
"type": "integer",
"minimum": 0
},
"minItems": {
"type": "integer",
"minimum": 0
},
"required": {
"type": "array",
"items": {
"type": "string"
},
"description": "For type=object: property names that must be present."
},
"properties": {
"type": "object",
"description": "For type=object: map of property name → schema (same form)."
},
"additionalProperties": {
"type": "boolean",
"description": "For type=object: when false, reject members not in properties."
}
},
"description": "Optional precise JSON shape, enforced recursively alongside validators[]. scalar: {type}. array: {type:\"array\", items:<schema>, minItems?, maxItems?}. object: {type:\"object\", properties:{name:<schema>}, required?:[...], additionalProperties?:bool}. type must match attributeType.",
"additionalProperties": true
},
"logging": {
"enum": [
"loggable",
"obscured",
"nonLoggable"
],
"type": "string",
"description": "How the value appears in the request log. obscured = masked; nonLoggable = stripped entirely."
},
"required": {
"type": "boolean",
"description": "When true, requests missing this attribute are rejected."
},
"forwarding": {
"enum": [
"blocked",
"forwardInPlace"
],
"type": "string",
"description": "Only meaningful for in=query or in=path. blocked (default): validated, never sent to the target. forwardInPlace: sent to the target in the same location — a query attribute as a query parameter, a path attribute as a path segment. A path attribute forwards only when its name is its own zero-based segment position (\"0\" for the first segment after the endpoint URL, \"1\" for the next, …) — path segments are matched positionally, not by name. To carry a value into the body or a header instead, leave this blocked and add a field mapping on the target sourced from this attribute."
},
"validators": {
"type": "array",
"items": {
"enum": [
"email",
"phone",
"int",
"double",
"bool",
"string",
"array",
"dictionary",
"range",
"oneOf",
"type",
"nil",
"not",
"empty",
"arrayType",
"arrayLength",
"arraySubset",
"arrayIntersect",
"intString",
"doubleString",
"boolString",
"numberString",
"numberOneOf",
"stringLength",
"stringEmpty",
"stringJson",
"dictionaryString"
],
"type": "string"
},
"description": "Validator names to run, in order. See params for any bounds/values they need."
},
"description": {
"type": "string",
"description": "Shown in the auto-generated OpenAPI doc."
},
"defaultValue": {
"description": "Used when the attribute is absent and required=false. Any scalar."
},
"attributeType": {
"enum": [
"string",
"int",
"double",
"bool",
"array",
"object"
],
"type": "string",
"description": "Expected value type."
}
},
"additionalProperties": false
},
"description": "Request validators. One entry per attribute; the Framework rejects callers whose payload fails the configured rules. Empty array = no validation."
},
"httpMethod": {
"enum": [
"GET",
"POST",
"PUT",
"PATCH",
"DELETE",
"HEAD",
"OPTIONS"
],
"type": "string",
"description": "HTTP method callers must use. GET endpoints cannot declare a body attribute (see attributes[].in)."
},
"mockResponse": {
"type": [
"object",
"null"
],
"properties": {
"body": {
"type": "string",
"description": "Literal response body."
},
"statusCode": {
"type": "integer",
"maximum": 599,
"minimum": 100
},
"contentType": {
"type": "string",
"description": "e.g. \"application/json\"."
}
},
"description": "Response returned in mock mode. Required when mock=true.",
"additionalProperties": false
},
"transformers": {
"type": [
"array",
"null"
],
"items": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"enum": [
"mergeFields",
"renameField",
"removeField",
"addField",
"mapValue",
"binaryToUrl"
],
"type": "string",
"description": "mergeFields: from+to(+separator). renameField: from+to. removeField: field. addField: to+value. mapValue: field+mapping. binaryToUrl: ttlSeconds?+maxSizeMB? (both clamped server-side — omit for the server default)."
},
"params": {
"type": [
"object",
"null"
],
"properties": {
"to": {
"type": "string",
"description": "Destination field — mergeFields / renameField / addField."
},
"from": {
"type": "array",
"items": {
"type": "string"
},
"description": "mergeFields (all sources) / renameField (first element is the source)."
},
"field": {
"type": "string",
"description": "Target field — removeField / mapValue."
},
"value": {
"type": "string",
"description": "Constant value to set — addField."
},
"mapping": {
"type": "object",
"description": "Value lookup table — mapValue.",
"additionalProperties": {
"type": "string"
}
},
"maxSizeMB": {
"type": "integer",
"minimum": 1,
"description": "Max upload size in MB — binaryToUrl."
},
"separator": {
"type": "string",
"description": "Join separator — mergeFields (default \" \")."
},
"ttlSeconds": {
"type": "integer",
"minimum": 1,
"description": "Temp file lifetime in seconds — binaryToUrl."
}
},
"description": "Only the keys the chosen type reads are accepted; see the type description above.",
"additionalProperties": false
}
},
"additionalProperties": false
},
"description": "Endpoint-level request transformation pipeline, applied before any target-level transformers. Set to null to remove the override and inherit the line default (if the line has one); set to an empty array to explicitly apply no transformation even when the line has a default. Omit on update_endpoint to leave the existing value unchanged."
},
"senderSignature": {
"type": [
"object",
"null"
],
"required": [
"scheme",
"credentialId"
],
"properties": {
"custom": {
"type": "object",
"required": [
"header",
"algorithm",
"encoding"
],
"properties": {
"header": {
"type": "string",
"description": "Request header carrying the signature, for example X-Shopify-Hmac-Sha256. 1 to 64 bytes of header-name characters (a-z, 0-9 and !#$%&'*+-.^_`|~, case-insensitive). Not authorization, cookie, host, content-length, transfer-encoding, connection or x-api-key."
},
"prefix": {
"type": "string",
"description": "Text in front of the signature in the header, for example v0=. At most 32 bytes. Default empty."
},
"message": {
"type": "string",
"description": "What is signed. At most 256 bytes. Placeholders: {body} (exactly once) and {timestamp} (at most once); any other { is invalid. Default {body}."
},
"encoding": {
"enum": [
"hex",
"base64"
],
"type": "string",
"description": "How the signature is written in the header."
},
"algorithm": {
"enum": [
"sha256",
"sha512",
"sha1"
],
"type": "string",
"description": "HMAC hash algorithm."
},
"secretEncoding": {
"enum": [
"utf8",
"base64"
],
"type": "string",
"description": "How the stored secret is read as the HMAC key. Default utf8."
},
"timestampHeader": {
"type": [
"string",
"null"
],
"description": "Header carrying the timestamp. Required when message contains {timestamp}, otherwise null or omitted. Same name rules as header."
}
},
"description": "Required when scheme is custom-hmac, refused for the other schemes. Describes how the sender signs.",
"additionalProperties": false
},
"scheme": {
"enum": [
"github",
"stripe",
"standard-webhooks",
"custom-hmac"
],
"type": "string",
"description": "How the sender signs: github, stripe, standard-webhooks, or custom-hmac (then `custom` is required)."
},
"credentialId": {
"type": "string",
"description": "UUID of the signingSecret credential holding the sender's secret."
}
},
"description": "Verify the sender's signature. When set, the endpoint accepts only requests signed by the sender (for example GitHub or Stripe) and no longer needs your API key. `credentialId` is a credential of type signingSecret (create_credential). Set to null to turn verification off. Omit on update_endpoint to leave it unchanged.",
"additionalProperties": false
},
"idempotencyEnabled": {
"type": "boolean",
"description": "When true, the Framework deduplicates on the caller's Idempotency-Key header. Default true."
}
},
"description": "Partial endpoint document — same shape as create_endpoint, every field optional.",
"additionalProperties": false
},
"lineKey": {
"type": "string",
"description": "The line key."
},
"commitMode": {
"enum": [
"draft",
"publish"
],
"type": "string",
"description": "Defaults to publish. Draft writes require draftRevision."
},
"endpointId": {
"type": "string",
"description": "The endpoint UUID."
},
"scheduledAt": {
"type": "string",
"description": "Compatibility alias: stage this update then schedule its line."
},
"draftRevision": {
"type": "integer",
"description": "Current line draft revision, required for draft writes."
}
}
}