All integrations

Convex

DEVELOPER · DEVELOPER

Teams, projects, deployments, and environment variables in the account they connected.

Acts as the person, not as itself

Each user connects their own account. Every call carries both identities — the agent and the person it is acting for — so the agent can never reach past what that individual can already do.

Credentials never touch the agent

Tokens live in the vault and attach server-side at call time. The agent holds a session, not a secret, and revoking access does not mean rotating a key.

Every call on the record

Who asked, which agent acted, which action ran, and the verdict that let it through — one audit trail across every integration, not one per vendor.

What an agent can do

Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.

convex_get_deployments_by_deployment_nameREAD

Get deployment via GET /deployments/{deployment_name}. Get details about a cloud deployment. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_get_deployments_by_deployment_name_custom_domainsREAD

List custom domains via GET /deployments/{deployment_name}/custom_domains. Get all custom domains configured for a deployment. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_get_deployments_by_deployment_name_list_deploy_keysREAD

List deploy keys via GET /deployments/{deployment_name}/list_deploy_keys. Lists all deploy keys for the specified deployment. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_get_list_personal_access_tokensREAD

List personal access tokens via GET /list_personal_access_tokens. Lists all personal access tokens for the authenticated user. PERSONAL ACCESS TOKEN ONLY. Convex's own API contract lists PAT for this operation, so no OAuth application token of either scope can call it; on an OAuth connection this tool refuses by name rather than sending a request Convex would reject. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_get_projects_by_project_idREAD

Get project by ID via GET /projects/{project_id}. Get a project by its ID. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_get_projects_by_project_id_deploymentREAD

Get deployment in project by id via GET /projects/{project_id}/deployment. Get a deployment within a project by reference, default production deployment, or default dev deployment for the calling user. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_get_projects_by_project_id_list_default_environment_variablesREAD

List default environment variables via GET /projects/{project_id}/list_default_environment_variables. Lists all default environment variables for the specified project, with optional filtering by name and deployment type. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_get_projects_by_project_id_list_deploymentsREAD

List deployments via GET /projects/{project_id}/list_deployments. List deployments for a projects. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_get_projects_by_project_id_list_preview_deploy_keysREAD

List preview deploy keys via GET /projects/{project_id}/list_preview_deploy_keys. Lists all preview deploy keys for the specified project. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_get_teams_by_team_id_list_access_tokensREAD

List team access tokens via GET /teams/{team_id}/list_access_tokens. Lists the team access tokens created by the authenticated member for the given team. NOT callable on a PROJECT-scoped OAuth connection. Convex's own API contract lists OAuth Team Token, PAT, Team Token for this operation; a personal access token or a team-scoped OAuth token reaches it, and a project-scoped one is refused by name rather than sent. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_get_teams_by_team_id_list_audit_log_eventsREAD

List audit log events via GET /teams/{team_id}/list_audit_log_events. List a team's audit log events within a time range, with optional filters. PERSONAL ACCESS TOKEN ONLY. Convex's own API contract lists PAT, Team Token for this operation, so no OAuth application token of either scope can call it; on an OAuth connection this tool refuses by name rather than sending a request Convex would reject. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_get_teams_by_team_id_list_custom_rolesREAD

List custom roles via GET /teams/{team_id}/list_custom_roles. Lists all custom roles for the team with cursor-based pagination. PERSONAL ACCESS TOKEN ONLY. Convex's own API contract lists PAT, Team Token for this operation, so no OAuth application token of either scope can call it; on an OAuth connection this tool refuses by name rather than sending a request Convex would reject. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_get_teams_by_team_id_list_deployment_classesREAD

List deployment classes via GET /teams/{team_id}/list_deployment_classes. Lists the available deployment classes for a team. NOT callable on a PROJECT-scoped OAuth connection. Convex's own API contract lists OAuth Team Token, PAT, Team Token for this operation; a personal access token or a team-scoped OAuth token reaches it, and a project-scoped one is refused by name rather than sent. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_get_teams_by_team_id_list_deployment_regionsREAD

List deployment regions via GET /teams/{team_id}/list_deployment_regions. Lists the available deployment regions for a team. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_get_teams_by_team_id_list_deploymentsREAD

List deployments for team via GET /teams/{team_id}/list_deployments. Lists deployments for a team with pagination, sorting, and filtering. NOT callable on a PROJECT-scoped OAuth connection. Convex's own API contract lists OAuth Team Token, PAT, Team Token for this operation; a personal access token or a team-scoped OAuth token reaches it, and a project-scoped one is refused by name rather than sent. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_get_teams_by_team_id_list_local_deploymentsREAD

List local deployments via GET /teams/{team_id}/list_local_deployments. Lists the local deployments for a team. NOT callable on a PROJECT-scoped OAuth connection. Convex's own API contract lists OAuth Team Token, PAT, Team Token for this operation; a personal access token or a team-scoped OAuth token reaches it, and a project-scoped one is refused by name rather than sent. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_get_teams_by_team_id_list_membersREAD

List team members via GET /teams/{team_id}/list_members. List the members of the given team. PERSONAL ACCESS TOKEN ONLY. Convex's own API contract lists PAT for this operation, so no OAuth application token of either scope can call it; on an OAuth connection this tool refuses by name rather than sending a request Convex would reject. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_get_teams_by_team_id_list_pending_invitesREAD

List pending team invitations via GET /teams/{team_id}/list_pending_invites. List the pending invitations for the given team. PERSONAL ACCESS TOKEN ONLY. Convex's own API contract lists PAT for this operation, so no OAuth application token of either scope can call it; on an OAuth connection this tool refuses by name rather than sending a request Convex would reject. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_get_teams_by_team_id_or_slug_projects_by_project_slugREAD

Get project by slug via GET /teams/{team_id_or_slug}/projects/{project_slug}. Get a project by its slug. NOT callable on a PROJECT-scoped OAuth connection. Convex's own API contract lists OAuth Team Token, PAT, Team Token for this operation; a personal access token or a team-scoped OAuth token reaches it, and a project-scoped one is refused by name rather than sent. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_get_teams_by_team_id_or_slug_projects_by_project_slug_deploymentREAD

Get deployment in project by slug via GET /teams/{team_id_or_slug}/projects/{project_slug}/deployment. Get a deployment within a project identified by team and project slug, by reference, default production deployment, or default dev deployment for the calling user. NOT callable on a PROJECT-scoped OAuth connection. Convex's own API contract lists OAuth Team Token, PAT, Team Token for this operation; a personal access token or a team-scoped OAuth token reaches it, and a project-scoped one is refused by name rather than sent. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_get_teams_by_team_id_projectsREAD

List projects via GET /teams/{team_id}/projects. List a page of projects for a team, ordered by descending project ID. Pass `limit` to set the page size and the `nextCursor` from the previous response as `cursor` to fetch the next page. NOT callable on a PROJECT-scoped OAuth connection. Convex's own API contract lists OAuth Team Token, PAT, Team Token for this operation; a personal access token or a team-scoped OAuth token reaches it, and a project-scoped one is refused by name rather than sent. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_get_token_detailsREAD

Get token details via GET /token_details. Returns the team ID for team tokens. Especially useful after receiving a team token from an OAuth flow since most endpoints require team ID. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_patch_deployments_by_deployment_nameWRITE

Update deployment via PATCH /deployments/{deployment_name}. Updates properties of an existing deployment. Only the fields provided in the request body are modified; omitted fields are left unchanged. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_patch_projects_by_project_idWRITE

Update project via PATCH /projects/{project_id}. Update a project's name and/or slug. Returns the updated project. NOT callable on a PROJECT-scoped OAuth connection. Convex's own API contract lists OAuth Team Token, PAT, Team Token for this operation; a personal access token or a team-scoped OAuth token reaches it, and a project-scoped one is refused by name rather than sent. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_post_deployments_by_deployment_name_create_custom_domainWRITE

Create custom domain via POST /deployments/{deployment_name}/create_custom_domain. Attach a custom domain to a deployment. The request body names the domain; Convex then serves the deployment from it once DNS points at Convex. The sealed OpenAPI document carries no description for this operation, so this sentence is written from its own request schema. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_post_deployments_by_deployment_name_deleteWRITE

Delete deployment via POST /deployments/{deployment_name}/delete. Delete a deployment. This will delete all data and files in the deployment, so we recommend creating and downloading a backup before calling this endpoint. This does not delete the project itself. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. DESTRUCTIVE: this removes something and Convex does not undo it. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_post_deployments_by_deployment_name_delete_custom_domainWRITE

Delete custom domain via POST /deployments/{deployment_name}/delete_custom_domain. Remove a custom domain from a deployment. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. DESTRUCTIVE: this removes something and Convex does not undo it. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_post_deployments_by_deployment_name_delete_deploy_keyWRITE

Delete deploy key via POST /deployments/{deployment_name}/delete_deploy_key. Deletes a deploy key for the specified deployment. The `id` in the request body can be the full deploy key (with prefix), encoded token, or the name of the deploy key. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. DESTRUCTIVE: this removes something and Convex does not undo it. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_post_deployments_by_deployment_name_transferWRITE

Transfer deployment via POST /deployments/{deployment_name}/transfer. Transfer a deployment from its current project to another project within the same team. For production deployments, the caller must be a project admin on both the source and destination projects. For other deployment types, any team member can transfer deployments they created, or project admins can transfer any deployment. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_post_projects_by_project_id_create_deploymentWRITE

Create deployment via POST /projects/{project_id}/create_deployment. Create a new deployment for a project. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_post_projects_by_project_id_deleteWRITE

Delete project via POST /projects/{project_id}/delete. Delete a project. Deletes all deployments in the project as well. NOT callable on a PROJECT-scoped OAuth connection. Convex's own API contract lists OAuth Team Token, PAT, Team Token for this operation; a personal access token or a team-scoped OAuth token reaches it, and a project-scoped one is refused by name rather than sent. DESTRUCTIVE: this removes something and Convex does not undo it. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_post_projects_by_project_id_delete_preview_deploy_keyWRITE

Delete preview deploy key via POST /projects/{project_id}/delete_preview_deploy_key. Deletes a preview deploy key for the specified project. The `id` in the request body can be the full preview deploy key (with prefix), encoded token, or the name of the preview deploy key. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. DESTRUCTIVE: this removes something and Convex does not undo it. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_post_projects_by_project_id_update_default_environment_variablesWRITE

Update default environment variables via POST /projects/{project_id}/update_default_environment_variables. Creates, updates, or deletes default environment variables for the specified project. When `value` is a string, the variable is upserted. When `value` is null, the variable is deleted. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. DESTRUCTIVE: this removes something and Convex does not undo it. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_post_teams_by_team_id_cancel_team_member_inviteWRITE

Cancel a pending team invitation via POST /teams/{team_id}/cancel_team_member_invite. Cancel a pending invitation to join the team, addressed by the invited email address. The person is not removed -- they were never a member; the outstanding invite stops working. The sealed OpenAPI document carries no description for this operation, so this sentence is written from its own request schema. PERSONAL ACCESS TOKEN ONLY. Convex's own API contract lists PAT for this operation, so no OAuth application token of either scope can call it; on an OAuth connection this tool refuses by name rather than sending a request Convex would reject. DESTRUCTIVE: this removes something and Convex does not undo it. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_post_teams_by_team_id_create_custom_roleWRITE

Create a custom role via POST /teams/{team_id}/create_custom_role. Creates a new custom role for the team with the specified name, description, and permission statements. PERSONAL ACCESS TOKEN ONLY. Convex's own API contract lists PAT, Team Token for this operation, so no OAuth application token of either scope can call it; on an OAuth connection this tool refuses by name rather than sending a request Convex would reject. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_post_teams_by_team_id_create_projectWRITE

Create project via POST /teams/{team_id}/create_project. Create a new project on a team, optionally provisioning a dev or prod deployment. NOT callable on a PROJECT-scoped OAuth connection. Convex's own API contract lists OAuth Team Token, PAT, Team Token for this operation; a personal access token or a team-scoped OAuth token reaches it, and a project-scoped one is refused by name rather than sent. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_post_teams_by_team_id_delete_custom_roleWRITE

Delete a custom role via POST /teams/{team_id}/delete_custom_role. Deletes a custom role from the team. Fails with `CustomRoleInUse` if the role is still attached to any team members; reassign those members (e.g. via `update_team_member_role`) before retrying. PERSONAL ACCESS TOKEN ONLY. Convex's own API contract lists PAT, Team Token for this operation, so no OAuth application token of either scope can call it; on an OAuth connection this tool refuses by name rather than sending a request Convex would reject. DESTRUCTIVE: this removes something and Convex does not undo it. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_post_teams_by_team_id_invite_team_memberWRITE

Invite a team member via POST /teams/{team_id}/invite_team_member. Invite a member to the given team by email. `role` is required and must be one of `admin`, `developer`, or `custom`. Pass `custom` together with a non-empty `customRoles` list to invite a member into a custom role; for `admin` and `developer`, `customRoles` must be omitted. PERSONAL ACCESS TOKEN ONLY. Convex's own API contract lists PAT for this operation, so no OAuth application token of either scope can call it; on an OAuth connection this tool refuses by name rather than sending a request Convex would reject. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_post_teams_by_team_id_update_custom_roleWRITE

Update a custom role via POST /teams/{team_id}/update_custom_role. Updates an existing custom role's name, description, and permission statements. PERSONAL ACCESS TOKEN ONLY. Convex's own API contract lists PAT, Team Token for this operation, so no OAuth application token of either scope can call it; on an OAuth connection this tool refuses by name rather than sending a request Convex would reject. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_post_teams_by_team_id_update_team_member_roleWRITE

Update a team member's role via POST /teams/{team_id}/update_team_member_role. Sets either the member's built-in `role` (admin/developer) or their `customRoles`. The two fields are mutually exclusive: setting `role` clears `customRoles`, and setting `customRoles` (must be non-empty) puts the member in the `custom` role. PERSONAL ACCESS TOKEN ONLY. Convex's own API contract lists PAT for this operation, so no OAuth application token of either scope can call it; on an OAuth connection this tool refuses by name rather than sending a request Convex would reject. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api
convex_post_teams_create_teamWRITE

Create a team via POST /teams/create_team. This endpoint is not publicly accessible. It is reserved for specific integrations that have been granted permission to create teams on behalf of users. To request access, contact platforms@convex.dev. Callable on any Convex connection: a personal access token, or an OAuth application token of either scope. Convex publishes no rate-limit figure for this API and none has been measured, so treat a 429 as a budget rather than a credential problem.

api

Put Convex behind one governed endpoint.

Same permissions, same audit trail, whatever else you connect next.