DEVELOPER · DEVELOPER
Apps, machines, volumes, and Postgres clusters under their own token.
Each user connects their own account. Every call carries both identities — the agent and the person it is acting for — so the agent can never reach past what that individual can already do.
Tokens live in the vault and attach server-side at call time. The agent holds a session, not a secret, and revoking access does not mean rotating a key.
Who asked, which agent acted, which action ran, and the verdict that let it through — one audit trail across every integration, not one per vendor.
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
flyio_delete_v1_apps_by_app_nameWRITEApps delete via DELETE /v1/apps/{app_name}
flyio_delete_v1_apps_by_app_name_certificates_by_hostnameWRITEApp certificates delete via DELETE /v1/apps/{app_name}/certificates/{hostname}
flyio_delete_v1_apps_by_app_name_certificates_by_hostname_acmeWRITEApp certificates acme delete via DELETE /v1/apps/{app_name}/certificates/{hostname}/acme
flyio_delete_v1_apps_by_app_name_certificates_by_hostname_customWRITEApp certificates custom delete via DELETE /v1/apps/{app_name}/certificates/{hostname}/custom
flyio_delete_v1_apps_by_app_name_ip_assignments_by_ipWRITEApp ip assignments delete via DELETE /v1/apps/{app_name}/ip_assignments/{ip}
flyio_delete_v1_apps_by_app_name_machines_by_machine_idWRITEMachines delete via DELETE /v1/apps/{app_name}/machines/{machine_id}
flyio_delete_v1_apps_by_app_name_machines_by_machine_id_leaseWRITEMachines release lease via DELETE /v1/apps/{app_name}/machines/{machine_id}/lease
flyio_delete_v1_apps_by_app_name_machines_by_machine_id_metadata_by_keyWRITEMachines delete metadata via DELETE /v1/apps/{app_name}/machines/{machine_id}/metadata/{key}
flyio_delete_v1_apps_by_app_name_secretkeys_by_secret_nameWRITESecretkey delete via DELETE /v1/apps/{app_name}/secretkeys/{secret_name}
flyio_delete_v1_apps_by_app_name_secrets_by_secret_nameWRITESecret delete via DELETE /v1/apps/{app_name}/secrets/{secret_name}
flyio_delete_v1_apps_by_app_name_volumes_by_volume_idWRITEVolume delete via DELETE /v1/apps/{app_name}/volumes/{volume_id}
flyio_delete_v1_postgres_by_postgres_cluster_idWRITEPostgres delete via DELETE /v1/postgres/{postgres_cluster_id}
flyio_delete_v1_postgres_by_postgres_cluster_id_attachments_by_app_nameWRITEPostgres attachments delete via DELETE /v1/postgres/{postgres_cluster_id}/attachments/{app_name}
flyio_delete_v1_postgres_by_postgres_cluster_id_databases_by_database_nameWRITEPostgres databases delete via DELETE /v1/postgres/{postgres_cluster_id}/databases/{database_name}
flyio_delete_v1_postgres_by_postgres_cluster_id_databases_by_database_name_extensions_by_extension_nameWRITEPostgres extensions disable via DELETE /v1/postgres/{postgres_cluster_id}/databases/{database_name}/extensions/{extension_name}
flyio_delete_v1_postgres_by_postgres_cluster_id_users_by_usernameWRITEPostgres users delete via DELETE /v1/postgres/{postgres_cluster_id}/users/{username}
flyio_get_v1_appsREADApps list via GET /v1/apps
flyio_get_v1_apps_by_app_nameREADApps show via GET /v1/apps/{app_name}
flyio_get_v1_apps_by_app_name_certificatesREADApp certificates list via GET /v1/apps/{app_name}/certificates
flyio_get_v1_apps_by_app_name_certificates_by_hostnameREADApp certificates show via GET /v1/apps/{app_name}/certificates/{hostname}
flyio_get_v1_apps_by_app_name_ip_assignmentsREADApp ip assignments list via GET /v1/apps/{app_name}/ip_assignments
flyio_get_v1_apps_by_app_name_machinesREADMachines list via GET /v1/apps/{app_name}/machines
flyio_get_v1_apps_by_app_name_machines_by_machine_idREADMachines show via GET /v1/apps/{app_name}/machines/{machine_id}
flyio_get_v1_apps_by_app_name_machines_by_machine_id_eventsREADMachines list events via GET /v1/apps/{app_name}/machines/{machine_id}/events
flyio_get_v1_apps_by_app_name_machines_by_machine_id_leaseREADMachines show lease via GET /v1/apps/{app_name}/machines/{machine_id}/lease
flyio_get_v1_apps_by_app_name_machines_by_machine_id_memoryREADMachines get memory via GET /v1/apps/{app_name}/machines/{machine_id}/memory
flyio_get_v1_apps_by_app_name_machines_by_machine_id_metadataREADMachines show metadata via GET /v1/apps/{app_name}/machines/{machine_id}/metadata
flyio_get_v1_apps_by_app_name_machines_by_machine_id_metadata_by_keyREADMachines get metadata key via GET /v1/apps/{app_name}/machines/{machine_id}/metadata/{key}
flyio_get_v1_apps_by_app_name_machines_by_machine_id_psREADMachines list processes via GET /v1/apps/{app_name}/machines/{machine_id}/ps
flyio_get_v1_apps_by_app_name_machines_by_machine_id_versionsREADMachines list versions via GET /v1/apps/{app_name}/machines/{machine_id}/versions
flyio_get_v1_apps_by_app_name_machines_by_machine_id_waitREADMachines wait via GET /v1/apps/{app_name}/machines/{machine_id}/wait
flyio_get_v1_apps_by_app_name_secretkeysREADSecretkeys list via GET /v1/apps/{app_name}/secretkeys
flyio_get_v1_apps_by_app_name_secretkeys_by_secret_nameREADSecretkey get via GET /v1/apps/{app_name}/secretkeys/{secret_name}
flyio_get_v1_apps_by_app_name_secretsREADSecrets list via GET /v1/apps/{app_name}/secrets
flyio_get_v1_apps_by_app_name_secrets_by_secret_nameREADSecret get via GET /v1/apps/{app_name}/secrets/{secret_name}
flyio_get_v1_apps_by_app_name_volumesREADVolumes list via GET /v1/apps/{app_name}/volumes
flyio_get_v1_apps_by_app_name_volumes_by_volume_idREADVolumes get by id via GET /v1/apps/{app_name}/volumes/{volume_id}
flyio_get_v1_apps_by_app_name_volumes_by_volume_id_snapshotsREADVolumes list snapshots via GET /v1/apps/{app_name}/volumes/{volume_id}/snapshots
flyio_get_v1_orgs_by_org_slug_machinesREADMachines org list via GET /v1/orgs/{org_slug}/machines
flyio_get_v1_orgs_by_org_slug_volumesREADVolumes org list via GET /v1/orgs/{org_slug}/volumes
flyio_get_v1_platform_regionsREADPlatform regions get via GET /v1/platform/regions
flyio_get_v1_postgresREADPostgres list via GET /v1/postgres
flyio_get_v1_postgres_by_postgres_cluster_idREADPostgres show via GET /v1/postgres/{postgres_cluster_id}
flyio_get_v1_postgres_by_postgres_cluster_id_backupsREADPostgres backups list via GET /v1/postgres/{postgres_cluster_id}/backups
flyio_get_v1_postgres_by_postgres_cluster_id_databasesREADPostgres databases list via GET /v1/postgres/{postgres_cluster_id}/databases
flyio_get_v1_postgres_by_postgres_cluster_id_databases_by_database_name_extensionsREADPostgres extensions list via GET /v1/postgres/{postgres_cluster_id}/databases/{database_name}/extensions
flyio_get_v1_postgres_by_postgres_cluster_id_usersREADPostgres users list via GET /v1/postgres/{postgres_cluster_id}/users
flyio_get_v1_postgres_by_postgres_cluster_id_users_by_username_credentialsREADPostgres users credentials via GET /v1/postgres/{postgres_cluster_id}/users/{username}/credentials
flyio_get_v1_tokens_currentREADCurrent token show via GET /v1/tokens/current
flyio_patch_v1_apps_by_app_name_machines_by_machine_id_metadataWRITEMachines update metadata (PATCH) via PATCH /v1/apps/{app_name}/machines/{machine_id}/metadata
flyio_patch_v1_postgres_by_postgres_cluster_id_users_by_usernameWRITEPostgres users update role via PATCH /v1/postgres/{postgres_cluster_id}/users/{username}
flyio_post_v1_appsWRITEApps create via POST /v1/apps
flyio_post_v1_apps_by_app_name_certificates_acmeWRITEApp certificates acme create via POST /v1/apps/{app_name}/certificates/acme
flyio_post_v1_apps_by_app_name_certificates_by_hostname_checkWRITEApp certificates check via POST /v1/apps/{app_name}/certificates/{hostname}/check
flyio_post_v1_apps_by_app_name_certificates_customWRITEApp certificates custom create via POST /v1/apps/{app_name}/certificates/custom
flyio_post_v1_apps_by_app_name_deploy_tokenWRITEApp create deploy token via POST /v1/apps/{app_name}/deploy_token
flyio_post_v1_apps_by_app_name_ip_assignmentsWRITEApp ip assignments create via POST /v1/apps/{app_name}/ip_assignments
flyio_post_v1_apps_by_app_name_machinesWRITEMachines create via POST /v1/apps/{app_name}/machines
flyio_post_v1_apps_by_app_name_machines_by_machine_idWRITEMachines update via POST /v1/apps/{app_name}/machines/{machine_id}
flyio_post_v1_apps_by_app_name_machines_by_machine_id_cordonWRITEMachines cordon via POST /v1/apps/{app_name}/machines/{machine_id}/cordon
flyio_post_v1_apps_by_app_name_machines_by_machine_id_execWRITEMachines exec via POST /v1/apps/{app_name}/machines/{machine_id}/exec
flyio_post_v1_apps_by_app_name_machines_by_machine_id_leaseWRITEMachines create lease via POST /v1/apps/{app_name}/machines/{machine_id}/lease
flyio_post_v1_apps_by_app_name_machines_by_machine_id_memory_reclaimWRITEMachines reclaim memory via POST /v1/apps/{app_name}/machines/{machine_id}/memory/reclaim
flyio_post_v1_apps_by_app_name_machines_by_machine_id_metadata_by_keyWRITEMachines upsert metadata via POST /v1/apps/{app_name}/machines/{machine_id}/metadata/{key}
flyio_post_v1_apps_by_app_name_machines_by_machine_id_restartWRITEMachines restart via POST /v1/apps/{app_name}/machines/{machine_id}/restart
flyio_post_v1_apps_by_app_name_machines_by_machine_id_signalWRITEMachines signal via POST /v1/apps/{app_name}/machines/{machine_id}/signal
flyio_post_v1_apps_by_app_name_machines_by_machine_id_startWRITEMachines start via POST /v1/apps/{app_name}/machines/{machine_id}/start
flyio_post_v1_apps_by_app_name_machines_by_machine_id_stopWRITEMachines stop via POST /v1/apps/{app_name}/machines/{machine_id}/stop
flyio_post_v1_apps_by_app_name_machines_by_machine_id_suspendWRITEMachines suspend via POST /v1/apps/{app_name}/machines/{machine_id}/suspend
flyio_post_v1_apps_by_app_name_machines_by_machine_id_uncordonWRITEMachines uncordon via POST /v1/apps/{app_name}/machines/{machine_id}/uncordon
flyio_post_v1_apps_by_app_name_secretkeys_by_secret_nameWRITESecretkey set via POST /v1/apps/{app_name}/secretkeys/{secret_name}
flyio_post_v1_apps_by_app_name_secretkeys_by_secret_name_decryptWRITESecretkey decrypt via POST /v1/apps/{app_name}/secretkeys/{secret_name}/decrypt
flyio_post_v1_apps_by_app_name_secretkeys_by_secret_name_encryptWRITESecretkey encrypt via POST /v1/apps/{app_name}/secretkeys/{secret_name}/encrypt
flyio_post_v1_apps_by_app_name_secretkeys_by_secret_name_generateWRITESecretkey generate via POST /v1/apps/{app_name}/secretkeys/{secret_name}/generate
flyio_post_v1_apps_by_app_name_secretkeys_by_secret_name_signWRITESecretkey sign via POST /v1/apps/{app_name}/secretkeys/{secret_name}/sign
flyio_post_v1_apps_by_app_name_secretkeys_by_secret_name_verifyWRITESecretkey verify via POST /v1/apps/{app_name}/secretkeys/{secret_name}/verify
flyio_post_v1_apps_by_app_name_secretsWRITESecrets update via POST /v1/apps/{app_name}/secrets
flyio_post_v1_apps_by_app_name_secrets_by_secret_nameWRITESecret create via POST /v1/apps/{app_name}/secrets/{secret_name}
flyio_post_v1_apps_by_app_name_volumesWRITEVolumes create via POST /v1/apps/{app_name}/volumes
flyio_post_v1_apps_by_app_name_volumes_by_volume_id_snapshotsWRITECreate volume snapshot via POST /v1/apps/{app_name}/volumes/{volume_id}/snapshots
flyio_post_v1_platform_placementsWRITEPlatform placements post via POST /v1/platform/placements
flyio_post_v1_postgresWRITEPostgres create via POST /v1/postgres
flyio_post_v1_postgres_by_postgres_cluster_id_attachmentsWRITEPostgres attachments create via POST /v1/postgres/{postgres_cluster_id}/attachments
flyio_post_v1_postgres_by_postgres_cluster_id_backupsWRITEPostgres backups create via POST /v1/postgres/{postgres_cluster_id}/backups
flyio_post_v1_postgres_by_postgres_cluster_id_databasesWRITEPostgres databases create via POST /v1/postgres/{postgres_cluster_id}/databases
flyio_post_v1_postgres_by_postgres_cluster_id_databases_by_database_name_extensionsWRITEPostgres extensions enable via POST /v1/postgres/{postgres_cluster_id}/databases/{database_name}/extensions
flyio_post_v1_postgres_by_postgres_cluster_id_forkWRITEPostgres fork via POST /v1/postgres/{postgres_cluster_id}/fork
flyio_post_v1_postgres_by_postgres_cluster_id_restoreWRITEPostgres restore via POST /v1/postgres/{postgres_cluster_id}/restore
flyio_post_v1_postgres_by_postgres_cluster_id_usersWRITEPostgres users create via POST /v1/postgres/{postgres_cluster_id}/users
flyio_post_v1_postgres_by_postgres_cluster_id_users_by_username_rotate_passwordWRITEPostgres users rotate password via POST /v1/postgres/{postgres_cluster_id}/users/{username}/rotate_password
flyio_post_v1_tokens_kmsWRITETokens request kms via POST /v1/tokens/kms
flyio_post_v1_tokens_oidcWRITETokens request oidc via POST /v1/tokens/oidc
flyio_put_v1_apps_by_app_name_machines_by_machine_id_memoryWRITEMachines set memory limit via PUT /v1/apps/{app_name}/machines/{machine_id}/memory
flyio_put_v1_apps_by_app_name_machines_by_machine_id_metadataWRITEMachines update metadata (PUT) via PUT /v1/apps/{app_name}/machines/{machine_id}/metadata
flyio_put_v1_apps_by_app_name_volumes_by_volume_idWRITEVolumes update via PUT /v1/apps/{app_name}/volumes/{volume_id}
flyio_put_v1_apps_by_app_name_volumes_by_volume_id_extendWRITEVolumes extend via PUT /v1/apps/{app_name}/volumes/{volume_id}/extend
Put Fly.io behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.