Convex
DEVELOPER · DEVELOPER
Teams, projects, deployments, and environment variables in the account they connected.
Acts as the person, not as itself
Each user connects their own account. Every call carries both identities — the agent and the person it is acting for — so the agent can never reach past what that individual can already do.
Credentials never touch the agent
Tokens live in the vault and attach server-side at call time. The agent holds a session, not a secret, and revoking access does not mean rotating a key.
Every call on the record
Who asked, which agent acted, which action ran, and the verdict that let it through — one audit trail across every integration, not one per vendor.
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
convex_get_deployments_by_deployment_nameREADGet deployment via GET /deployments/{deployment_name}. Get details about a cloud deployment. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_get_deployments_by_deployment_name_custom_domainsREADList custom domains via GET /deployments/{deployment_name}/custom_domains. Get all custom domains configured for a deployment. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_get_deployments_by_deployment_name_list_deploy_keysREADList deploy keys via GET /deployments/{deployment_name}/list_deploy_keys. Lists all deploy keys for the specified deployment. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_get_list_personal_access_tokensREADList personal access tokens via GET /list_personal_access_tokens. Lists all personal access tokens for the authenticated user. PERSONAL ACCESS TOKEN ONLY. Convex's own API contract lists PAT for this operation, so no OAuth application token of either scope can call it; on an OAuth connection this tool refuses by name rather than sending a request Convex would reject. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_get_projects_by_project_idREADGet project by ID via GET /projects/{project_id}. Get a project by its ID. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_get_projects_by_project_id_deploymentREADGet deployment in project by id via GET /projects/{project_id}/deployment. Get a deployment within a project by reference, default production deployment, or default dev deployment for the calling user. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_get_projects_by_project_id_list_default_environment_variablesREADList default environment variables via GET /projects/{project_id}/list_default_environment_variables. Lists all default environment variables for the specified project, with optional filtering by name and deployment type. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_get_projects_by_project_id_list_deploymentsREADList deployments via GET /projects/{project_id}/list_deployments. List deployments for a projects. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_get_projects_by_project_id_list_preview_deploy_keysREADList preview deploy keys via GET /projects/{project_id}/list_preview_deploy_keys. Lists all preview deploy keys for the specified project. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_get_teams_by_team_id_list_access_tokensREADList team access tokens via GET /teams/{team_id}/list_access_tokens. Lists the team access tokens created by the authenticated member for the given team. NOT callable on a PROJECT-scoped OAuth connection. Convex's own API contract lists OAuth Team Token, PAT, Team Token for this operation; a personal access token or a team-scoped OAuth token reaches it, and a project-scoped one is refused by name rather than sent. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_get_teams_by_team_id_list_audit_log_eventsREADList audit log events via GET /teams/{team_id}/list_audit_log_events. List a team's audit log events within a time range, with optional filters. PERSONAL ACCESS TOKEN ONLY. Convex's own API contract lists PAT, Team Token for this operation, so no OAuth application token of either scope can call it; on an OAuth connection this tool refuses by name rather than sending a request Convex would reject. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_get_teams_by_team_id_list_custom_rolesREADList custom roles via GET /teams/{team_id}/list_custom_roles. Lists all custom roles for the team with cursor-based pagination. PERSONAL ACCESS TOKEN ONLY. Convex's own API contract lists PAT, Team Token for this operation, so no OAuth application token of either scope can call it; on an OAuth connection this tool refuses by name rather than sending a request Convex would reject. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_get_teams_by_team_id_list_deployment_classesREADList deployment classes via GET /teams/{team_id}/list_deployment_classes. Lists the available deployment classes for a team. NOT callable on a PROJECT-scoped OAuth connection. Convex's own API contract lists OAuth Team Token, PAT, Team Token for this operation; a personal access token or a team-scoped OAuth token reaches it, and a project-scoped one is refused by name rather than sent. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_get_teams_by_team_id_list_deployment_regionsREADList deployment regions via GET /teams/{team_id}/list_deployment_regions. Lists the available deployment regions for a team. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_get_teams_by_team_id_list_deploymentsREADList deployments for team via GET /teams/{team_id}/list_deployments. Lists deployments for a team with pagination, sorting, and filtering. NOT callable on a PROJECT-scoped OAuth connection. Convex's own API contract lists OAuth Team Token, PAT, Team Token for this operation; a personal access token or a team-scoped OAuth token reaches it, and a project-scoped one is refused by name rather than sent. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_get_teams_by_team_id_list_local_deploymentsREADList local deployments via GET /teams/{team_id}/list_local_deployments. Lists the local deployments for a team. NOT callable on a PROJECT-scoped OAuth connection. Convex's own API contract lists OAuth Team Token, PAT, Team Token for this operation; a personal access token or a team-scoped OAuth token reaches it, and a project-scoped one is refused by name rather than sent. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_get_teams_by_team_id_list_membersREADList team members via GET /teams/{team_id}/list_members. List the members of the given team. PERSONAL ACCESS TOKEN ONLY. Convex's own API contract lists PAT for this operation, so no OAuth application token of either scope can call it; on an OAuth connection this tool refuses by name rather than sending a request Convex would reject. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_get_teams_by_team_id_list_pending_invitesREADList pending team invitations via GET /teams/{team_id}/list_pending_invites. List the pending invitations for the given team. PERSONAL ACCESS TOKEN ONLY. Convex's own API contract lists PAT for this operation, so no OAuth application token of either scope can call it; on an OAuth connection this tool refuses by name rather than sending a request Convex would reject. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_get_teams_by_team_id_or_slug_projects_by_project_slugREADGet project by slug via GET /teams/{team_id_or_slug}/projects/{project_slug}. Get a project by its slug. NOT callable on a PROJECT-scoped OAuth connection. Convex's own API contract lists OAuth Team Token, PAT, Team Token for this operation; a personal access token or a team-scoped OAuth token reaches it, and a project-scoped one is refused by name rather than sent. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_get_teams_by_team_id_or_slug_projects_by_project_slug_deploymentREADGet deployment in project by slug via GET /teams/{team_id_or_slug}/projects/{project_slug}/deployment. Get a deployment within a project identified by team and project slug, by reference, default production deployment, or default dev deployment for the calling user. NOT callable on a PROJECT-scoped OAuth connection. Convex's own API contract lists OAuth Team Token, PAT, Team Token for this operation; a personal access token or a team-scoped OAuth token reaches it, and a project-scoped one is refused by name rather than sent. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_get_teams_by_team_id_projectsREADList projects via GET /teams/{team_id}/projects. List a page of projects for a team, ordered by descending project ID. Pass `limit` to set the page size and the `nextCursor` from the previous response as `cursor` to fetch the next page. NOT callable on a PROJECT-scoped OAuth connection. Convex's own API contract lists OAuth Team Token, PAT, Team Token for this operation; a personal access token or a team-scoped OAuth token reaches it, and a project-scoped one is refused by name rather than sent. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_get_token_detailsREADGet token details via GET /token_details. Returns the team ID for team tokens. Especially useful after receiving a team token from an OAuth flow since most endpoints require team ID. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_patch_deployments_by_deployment_nameWRITEUpdate deployment via PATCH /deployments/{deployment_name}. Updates properties of an existing deployment. Only the fields provided in the request body are modified; omitted fields are left unchanged. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_patch_projects_by_project_idWRITEUpdate project via PATCH /projects/{project_id}. Update a project's name and/or slug. Returns the updated project. NOT callable on a PROJECT-scoped OAuth connection. Convex's own API contract lists OAuth Team Token, PAT, Team Token for this operation; a personal access token or a team-scoped OAuth token reaches it, and a project-scoped one is refused by name rather than sent. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_post_deployments_by_deployment_name_create_custom_domainWRITECreate custom domain via POST /deployments/{deployment_name}/create_custom_domain. Attach a custom domain to a deployment. The request body names the domain; Convex then serves the deployment from it once DNS points at Convex. The sealed OpenAPI document carries no description for this operation, so this sentence is written from its own request schema. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_post_deployments_by_deployment_name_deleteWRITEDelete deployment via POST /deployments/{deployment_name}/delete. Delete a deployment. This will delete all data and files in the deployment, so we recommend creating and downloading a backup before calling this endpoint. This does not delete the project itself. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. DESTRUCTIVE: this removes something and Convex does not undo it. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_post_deployments_by_deployment_name_delete_custom_domainWRITEDelete custom domain via POST /deployments/{deployment_name}/delete_custom_domain. Remove a custom domain from a deployment. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. DESTRUCTIVE: this removes something and Convex does not undo it. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_post_deployments_by_deployment_name_delete_deploy_keyWRITEDelete deploy key via POST /deployments/{deployment_name}/delete_deploy_key. Deletes a deploy key for the specified deployment. The `id` in the request body can be the full deploy key (with prefix), encoded token, or the name of the deploy key. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. DESTRUCTIVE: this removes something and Convex does not undo it. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_post_deployments_by_deployment_name_transferWRITETransfer deployment via POST /deployments/{deployment_name}/transfer. Transfer a deployment from its current project to another project within the same team. For production deployments, the caller must be a project admin on both the source and destination projects. For other deployment types, any team member can transfer deployments they created, or project admins can transfer any deployment. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_post_projects_by_project_id_create_deploymentWRITECreate deployment via POST /projects/{project_id}/create_deployment. Create a new deployment for a project. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_post_projects_by_project_id_deleteWRITEDelete project via POST /projects/{project_id}/delete. Delete a project. Deletes all deployments in the project as well. NOT callable on a PROJECT-scoped OAuth connection. Convex's own API contract lists OAuth Team Token, PAT, Team Token for this operation; a personal access token or a team-scoped OAuth token reaches it, and a project-scoped one is refused by name rather than sent. DESTRUCTIVE: this removes something and Convex does not undo it. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_post_projects_by_project_id_delete_preview_deploy_keyWRITEDelete preview deploy key via POST /projects/{project_id}/delete_preview_deploy_key. Deletes a preview deploy key for the specified project. The `id` in the request body can be the full preview deploy key (with prefix), encoded token, or the name of the preview deploy key. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. DESTRUCTIVE: this removes something and Convex does not undo it. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_post_projects_by_project_id_update_default_environment_variablesWRITEUpdate default environment variables via POST /projects/{project_id}/update_default_environment_variables. Creates, updates, or deletes default environment variables for the specified project. When `value` is a string, the variable is upserted. When `value` is null, the variable is deleted. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. DESTRUCTIVE: this removes something and Convex does not undo it. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_post_teams_by_team_id_cancel_team_member_inviteWRITECancel a pending team invitation via POST /teams/{team_id}/cancel_team_member_invite. Cancel a pending invitation to join the team, addressed by the invited email address. The person is not removed -- they were never a member; the outstanding invite stops working. The sealed OpenAPI document carries no description for this operation, so this sentence is written from its own request schema. PERSONAL ACCESS TOKEN ONLY. Convex's own API contract lists PAT for this operation, so no OAuth application token of either scope can call it; on an OAuth connection this tool refuses by name rather than sending a request Convex would reject. DESTRUCTIVE: this removes something and Convex does not undo it. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_post_teams_by_team_id_create_custom_roleWRITECreate a custom role via POST /teams/{team_id}/create_custom_role. Creates a new custom role for the team with the specified name, description, and permission statements. PERSONAL ACCESS TOKEN ONLY. Convex's own API contract lists PAT, Team Token for this operation, so no OAuth application token of either scope can call it; on an OAuth connection this tool refuses by name rather than sending a request Convex would reject. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_post_teams_by_team_id_create_projectWRITECreate project via POST /teams/{team_id}/create_project. Create a new project on a team, optionally provisioning a dev or prod deployment. NOT callable on a PROJECT-scoped OAuth connection. Convex's own API contract lists OAuth Team Token, PAT, Team Token for this operation; a personal access token or a team-scoped OAuth token reaches it, and a project-scoped one is refused by name rather than sent. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_post_teams_by_team_id_delete_custom_roleWRITEDelete a custom role via POST /teams/{team_id}/delete_custom_role. Deletes a custom role from the team. Fails with `CustomRoleInUse` if the role is still attached to any team members; reassign those members (e.g. via `update_team_member_role`) before retrying. PERSONAL ACCESS TOKEN ONLY. Convex's own API contract lists PAT, Team Token for this operation, so no OAuth application token of either scope can call it; on an OAuth connection this tool refuses by name rather than sending a request Convex would reject. DESTRUCTIVE: this removes something and Convex does not undo it. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_post_teams_by_team_id_invite_team_memberWRITEInvite a team member via POST /teams/{team_id}/invite_team_member. Invite a member to the given team by email. `role` is required and must be one of `admin`, `developer`, or `custom`. Pass `custom` together with a non-empty `customRoles` list to invite a member into a custom role; for `admin` and `developer`, `customRoles` must be omitted. PERSONAL ACCESS TOKEN ONLY. Convex's own API contract lists PAT for this operation, so no OAuth application token of either scope can call it; on an OAuth connection this tool refuses by name rather than sending a request Convex would reject. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_post_teams_by_team_id_update_custom_roleWRITEUpdate a custom role via POST /teams/{team_id}/update_custom_role. Updates an existing custom role's name, description, and permission statements. PERSONAL ACCESS TOKEN ONLY. Convex's own API contract lists PAT, Team Token for this operation, so no OAuth application token of either scope can call it; on an OAuth connection this tool refuses by name rather than sending a request Convex would reject. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_post_teams_by_team_id_update_team_member_roleWRITEUpdate a team member's role via POST /teams/{team_id}/update_team_member_role. Sets either the member's built-in `role` (admin/developer) or their `customRoles`. The two fields are mutually exclusive: setting `role` clears `customRoles`, and setting `customRoles` (must be non-empty) puts the member in the `custom` role. PERSONAL ACCESS TOKEN ONLY. Convex's own API contract lists PAT for this operation, so no OAuth application token of either scope can call it; on an OAuth connection this tool refuses by name rather than sending a request Convex would reject. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
convex_post_teams_create_teamWRITECreate a team via POST /teams/create_team. This endpoint is not publicly accessible. It is reserved for specific integrations that have been granted permission to create teams on behalf of users. To request access, contact platforms@convex.dev. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.
Often connected alongside
Put Convex behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.