DEVELOPER · DEVELOPER
Services, deploys, databases and environment variables in their own workspace.
Each user connects their own account. Every call carries both identities — the agent and the person it is acting for — so the agent can never reach past what that individual can already do.
Tokens live in the vault and attach server-side at call time. The agent holds a session, not a secret, and revoking access does not mean rotating a key.
Who asked, which agent acted, which action ran, and the verdict that let it through — one audit trail across every integration, not one per vendor.
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
render_delete_blueprints_by_blueprintidWRITEDisconnect Blueprint via DELETE /blueprints/{blueprintId}
render_delete_cron_jobs_by_cronjobid_runsWRITECancel running cron job via DELETE /cron-jobs/{cronJobId}/runs
render_delete_dedicated_ips_by_dedicatedipidWRITEDelete dedicated IP set via DELETE /dedicated-ips/{dedicatedIpId}
render_delete_disks_by_diskidWRITEDelete disk via DELETE /disks/{diskId}
render_delete_env_groups_by_envgroupidWRITEDelete environment group via DELETE /env-groups/{envGroupId}
render_delete_env_groups_by_envgroupid_env_vars_by_envvarkeyWRITERemove environment variable via DELETE /env-groups/{envGroupId}/env-vars/{envVarKey}
render_delete_env_groups_by_envgroupid_secret_files_by_envvarkeyWRITERemove secret file via DELETE /env-groups/{envGroupId}/secret-files/{envVarKey}
render_delete_env_groups_by_envgroupid_services_by_serviceidWRITEUnlink service via DELETE /env-groups/{envGroupId}/services/{serviceId}
render_delete_environments_by_environmentidWRITEDelete environment via DELETE /environments/{environmentId}
render_delete_environments_by_environmentid_resourcesWRITERemove resources from environment via DELETE /environments/{environmentId}/resources
render_delete_key_value_by_redisidWRITEDelete Key Value instance via DELETE /key-value/{redisId}
render_delete_logs_streams_owner_by_owneridWRITEDelete log stream via DELETE /logs/streams/owner/{ownerId}
render_delete_logs_streams_resource_by_resourceidWRITEDelete log stream override via DELETE /logs/streams/resource/{resourceId}
render_delete_metrics_stream_by_owneridWRITEDelete metrics stream via DELETE /metrics-stream/{ownerId}
render_delete_owners_by_ownerid_members_by_useridWRITERemove workspace member via DELETE /owners/{ownerId}/members/{userId}
render_delete_postgres_by_postgresidWRITEDelete Postgres instance via DELETE /postgres/{postgresId}
render_delete_postgres_by_postgresid_credentials_by_usernameWRITEDelete PostgreSQL User via DELETE /postgres/{postgresId}/credentials/{username}
render_delete_projects_by_projectidWRITEDelete project via DELETE /projects/{projectId}
render_delete_redis_by_redisidWRITEDelete Redis instance via DELETE /redis/{redisId}
render_delete_registrycredentials_by_registrycredentialidWRITEDelete registry credential via DELETE /registrycredentials/{registryCredentialId}
render_delete_services_by_serviceidWRITEDelete service via DELETE /services/{serviceId}
render_delete_services_by_serviceid_autoscalingWRITEDelete autoscaling config via DELETE /services/{serviceId}/autoscaling
render_delete_services_by_serviceid_custom_domains_by_customdomainnameoridWRITEDelete custom domain via DELETE /services/{serviceId}/custom-domains/{customDomainNameOrID}
render_delete_services_by_serviceid_env_vars_by_envvarkeyWRITEDelete environment variable via DELETE /services/{serviceId}/env-vars/{envVarKey}
render_delete_services_by_serviceid_headers_by_headeridWRITEDelete header rule via DELETE /services/{serviceId}/headers/{headerId}
render_delete_services_by_serviceid_routes_by_routeidWRITEDelete redirect/rewrite rule via DELETE /services/{serviceId}/routes/{routeId}
render_delete_services_by_serviceid_secret_files_by_envvarkeyWRITEDelete secret file via DELETE /services/{serviceId}/secret-files/{envVarKey}
render_delete_task_runs_by_taskrunidWRITECancel task run via DELETE /task-runs/{taskRunId}
render_delete_webhooks_by_webhookidWRITEDelete a webhook via DELETE /webhooks/{webhookId}
render_delete_workflows_by_workflowidWRITEDelete workflow via DELETE /workflows/{workflowId}
render_get_blueprintsREADList Blueprints via GET /blueprints
render_get_blueprints_by_blueprintidREADRetrieve Blueprint via GET /blueprints/{blueprintId}
render_get_blueprints_by_blueprintid_syncsREADList Blueprint syncs via GET /blueprints/{blueprintId}/syncs
render_get_dedicated_ipsREADList dedicated IPs via GET /dedicated-ips
render_get_dedicated_ips_by_dedicatedipidREADRetrieve dedicated IP set via GET /dedicated-ips/{dedicatedIpId}
render_get_disksREADList disks via GET /disks
render_get_disks_by_diskidREADRetrieve disk via GET /disks/{diskId}
render_get_disks_by_diskid_snapshotsREADList snapshots via GET /disks/{diskId}/snapshots
render_get_env_groupsREADList environment groups via GET /env-groups
render_get_env_groups_by_envgroupidREADRetrieve environment group via GET /env-groups/{envGroupId}
render_get_env_groups_by_envgroupid_env_vars_by_envvarkeyREADRetrieve environment variable (env-groups) via GET /env-groups/{envGroupId}/env-vars/{envVarKey}
render_get_env_groups_by_envgroupid_secret_files_by_envvarkeyREADRetrieve secret file (env-groups) via GET /env-groups/{envGroupId}/secret-files/{envVarKey}
render_get_environmentsREADList environments via GET /environments
render_get_environments_by_environmentidREADRetrieve environment via GET /environments/{environmentId}
render_get_events_by_eventidREADRetrieve event via GET /events/{eventId}
render_get_key_valueREADList Key Value instances via GET /key-value
render_get_key_value_by_redisidREADRetrieve Key Value instance via GET /key-value/{redisId}
render_get_key_value_by_redisid_connection_infoREADRetrieve Key Value connection info via GET /key-value/{redisId}/connection-info
render_get_logsREADList logs via GET /logs
render_get_logs_streams_owner_by_owneridREADRetrieve log stream via GET /logs/streams/owner/{ownerId}
render_get_logs_streams_resourceREADList log stream overrides via GET /logs/streams/resource
render_get_logs_streams_resource_by_resourceidREADRetrieve log stream override via GET /logs/streams/resource/{resourceId}
render_get_logs_subscribeREADSubscribe to new logs via GET /logs/subscribe
render_get_logs_valuesREADList log label values via GET /logs/values
render_get_maintenanceREADList maintenance runs via GET /maintenance
render_get_maintenance_by_maintenancerunidREADRetrieve maintenance run via GET /maintenance/{maintenanceRunID}
render_get_metrics_active_connectionsREADGet active connection count via GET /metrics/active-connections
render_get_metrics_bandwidthREADGet bandwidth usage via GET /metrics/bandwidth
render_get_metrics_bandwidth_sourcesREADGet bandwidth usage breakdown by traffic source via GET /metrics/bandwidth-sources
render_get_metrics_cpuREADGet CPU usage via GET /metrics/cpu
render_get_metrics_cpu_limitREADGet CPU limit via GET /metrics/cpu-limit
render_get_metrics_cpu_targetREADGet CPU target via GET /metrics/cpu-target
render_get_metrics_disk_capacityREADGet disk capacity via GET /metrics/disk-capacity
render_get_metrics_disk_usageREADGet disk usage via GET /metrics/disk-usage
render_get_metrics_filters_applicationREADList queryable instance values via GET /metrics/filters/application
render_get_metrics_filters_httpREADList queryable status codes and host values via GET /metrics/filters/http
render_get_metrics_filters_pathREADList queryable paths via GET /metrics/filters/path
render_get_metrics_http_latencyREADGet HTTP latency via GET /metrics/http-latency
render_get_metrics_http_requestsREADGet HTTP request count via GET /metrics/http-requests
render_get_metrics_instance_countREADGet instance count via GET /metrics/instance-count
render_get_metrics_memoryREADGet memory usage via GET /metrics/memory
render_get_metrics_memory_limitREADGet memory limit via GET /metrics/memory-limit
render_get_metrics_memory_targetREADGet memory target via GET /metrics/memory-target
render_get_metrics_replication_lagREADGet replica lag via GET /metrics/replication-lag
render_get_metrics_stream_by_owneridREADRetrieve metrics stream via GET /metrics-stream/{ownerId}
render_get_metrics_task_runs_completedREADGet task runs completed count via GET /metrics/task-runs-completed
render_get_metrics_task_runs_queuedREADGet task runs queued count via GET /metrics/task-runs-queued
render_get_notification_settings_overridesREADList notification overrides via GET /notification-settings/overrides
render_get_notification_settings_overrides_services_by_serviceidREADRetrieve notification override via GET /notification-settings/overrides/services/{serviceId}
render_get_notification_settings_owners_by_owneridREADRetrieve notification settings via GET /notification-settings/owners/{ownerId}
render_get_organizations_by_orgid_audit_logsREADList organization audit logs via GET /organizations/{orgId}/audit-logs
render_get_ownersREADList workspaces via GET /owners
render_get_owners_by_owneridREADRetrieve workspace via GET /owners/{ownerId}
render_get_owners_by_ownerid_audit_logsREADList workspace audit logs via GET /owners/{ownerId}/audit-logs
render_get_owners_by_ownerid_membersREADList workspace members via GET /owners/{ownerId}/members
render_get_postgresREADList Postgres instances via GET /postgres
render_get_postgres_by_postgresidREADRetrieve Postgres instance via GET /postgres/{postgresId}
render_get_postgres_by_postgresid_connection_infoREADRetrieve Postgres connection info via GET /postgres/{postgresId}/connection-info
render_get_postgres_by_postgresid_credentialsREADList PostgreSQL Users via GET /postgres/{postgresId}/credentials
render_get_postgres_by_postgresid_exportREADList Postgres exports via GET /postgres/{postgresId}/export
render_get_postgres_by_postgresid_query_processesREADList live queries via GET /postgres/{postgresId}/query/processes
render_get_postgres_by_postgresid_query_sizesREADList database, table, and index sizes via GET /postgres/{postgresId}/query/sizes
render_get_postgres_by_postgresid_query_table_scansREADList table scans via GET /postgres/{postgresId}/query/table-scans
render_get_postgres_by_postgresid_query_top_queriesREADList top queries via GET /postgres/{postgresId}/query/top-queries
render_get_postgres_by_postgresid_recoveryREADRetrieve point-in-time recovery status via GET /postgres/{postgresId}/recovery
render_get_projectsREADList projects via GET /projects
render_get_projects_by_projectidREADRetrieve Project via GET /projects/{projectId}
render_get_redisREADList Redis instances via GET /redis
render_get_redis_by_redisidREADRetrieve Redis instance via GET /redis/{redisId}
render_get_redis_by_redisid_connection_infoREADRetrieve Redis connection info via GET /redis/{redisId}/connection-info
render_get_registrycredentialsREADList registry credentials via GET /registrycredentials
render_get_registrycredentials_by_registrycredentialidREADRetrieve registry credential via GET /registrycredentials/{registryCredentialId}
render_get_servicesREADList services via GET /services
render_get_services_by_serviceidREADRetrieve service via GET /services/{serviceId}
render_get_services_by_serviceid_custom_domainsREADList custom domains via GET /services/{serviceId}/custom-domains
render_get_services_by_serviceid_custom_domains_by_customdomainnameoridREADRetrieve custom domain via GET /services/{serviceId}/custom-domains/{customDomainNameOrID}
render_get_services_by_serviceid_deploysREADList deploys via GET /services/{serviceId}/deploys
render_get_services_by_serviceid_deploys_by_deployidREADRetrieve deploy via GET /services/{serviceId}/deploys/{deployId}
render_get_services_by_serviceid_env_varsREADList environment variables via GET /services/{serviceId}/env-vars
render_get_services_by_serviceid_env_vars_by_envvarkeyREADRetrieve environment variable (services) via GET /services/{serviceId}/env-vars/{envVarKey}
render_get_services_by_serviceid_eventsREADList events via GET /services/{serviceId}/events
render_get_services_by_serviceid_headersREADList header rules via GET /services/{serviceId}/headers
render_get_services_by_serviceid_instancesREADList instances via GET /services/{serviceId}/instances
render_get_services_by_serviceid_jobsREADList jobs via GET /services/{serviceId}/jobs
render_get_services_by_serviceid_jobs_by_jobidREADRetrieve job via GET /services/{serviceId}/jobs/{jobId}
render_get_services_by_serviceid_outbound_ipsREADRetrieve service outbound IPs via GET /services/{serviceId}/outbound-ips
render_get_services_by_serviceid_routesREADList redirect/rewrite rules via GET /services/{serviceId}/routes
render_get_services_by_serviceid_secret_filesREADList secret files via GET /services/{serviceId}/secret-files
render_get_services_by_serviceid_secret_files_by_envvarkeyREADRetrieve secret file (services) via GET /services/{serviceId}/secret-files/{envVarKey}
render_get_task_runsREADList task runs via GET /task-runs
render_get_task_runs_by_taskrunidREADRetrieve task run via GET /task-runs/{taskRunId}
render_get_tasksREADList tasks via GET /tasks
render_get_tasks_by_taskidREADRetrieve task via GET /tasks/{taskId}
render_get_usersREADGet the authenticated user via GET /users
render_get_webhooksREADList webhooks via GET /webhooks
render_get_webhooks_by_webhookidREADRetrieve a webhook via GET /webhooks/{webhookId}
render_get_webhooks_by_webhookid_eventsREADList webhook events via GET /webhooks/{webhookId}/events
render_get_workflowsREADList workflows via GET /workflows
render_get_workflows_by_workflowidREADRetrieve workflow via GET /workflows/{workflowId}
render_get_workflowversionsREADList workflow versions via GET /workflowversions
render_get_workflowversions_by_workflowversionidREADRetrieve workflow version via GET /workflowversions/{workflowVersionId}
render_patch_blueprints_by_blueprintidWRITEUpdate Blueprint via PATCH /blueprints/{blueprintId}
render_patch_dedicated_ips_by_dedicatedipidWRITEUpdate dedicated IP set via PATCH /dedicated-ips/{dedicatedIpId}
render_patch_disks_by_diskidWRITEUpdate disk via PATCH /disks/{diskId}
render_patch_env_groups_by_envgroupidWRITEUpdate environment group via PATCH /env-groups/{envGroupId}
render_patch_environments_by_environmentidWRITEUpdate environment via PATCH /environments/{environmentId}
render_patch_key_value_by_redisidWRITEUpdate Key Value instance via PATCH /key-value/{redisId}
render_patch_maintenance_by_maintenancerunidWRITEUpdate maintenance run via PATCH /maintenance/{maintenanceRunID}
render_patch_notification_settings_overrides_services_by_serviceidWRITEUpdate notification override via PATCH /notification-settings/overrides/services/{serviceId}
render_patch_notification_settings_owners_by_owneridWRITEUpdate notification settings via PATCH /notification-settings/owners/{ownerId}
render_patch_owners_by_ownerid_members_by_useridWRITEUpdate workspace member role via PATCH /owners/{ownerId}/members/{userId}
render_patch_postgres_by_postgresidWRITEUpdate Postgres instance via PATCH /postgres/{postgresId}
render_patch_projects_by_projectidWRITEUpdate project via PATCH /projects/{projectId}
render_patch_redis_by_redisidWRITEUpdate Redis instance via PATCH /redis/{redisId}
render_patch_registrycredentials_by_registrycredentialidWRITEUpdate registry credential via PATCH /registrycredentials/{registryCredentialId}
render_patch_services_by_serviceidWRITEUpdate service via PATCH /services/{serviceId}
render_patch_services_by_serviceid_routes_by_routeidWRITEUpdate redirect/rewrite rule priority via PATCH /services/{serviceId}/routes/{routeId}
render_patch_webhooks_by_webhookidWRITEUpdate a webhook via PATCH /webhooks/{webhookId}
render_patch_workflows_by_workflowidWRITEUpdate workflow via PATCH /workflows/{workflowId}
render_post_cron_jobs_by_cronjobid_runsWRITETrigger cron job run via POST /cron-jobs/{cronJobId}/runs
render_post_dedicated_ipsWRITECreate dedicated IP set via POST /dedicated-ips
render_post_disksWRITEAdd disk via POST /disks
render_post_disks_by_diskid_snapshots_restoreWRITERestore snapshot via POST /disks/{diskId}/snapshots/restore
render_post_env_groupsWRITECreate environment group via POST /env-groups
render_post_env_groups_by_envgroupid_services_by_serviceidWRITELink service via POST /env-groups/{envGroupId}/services/{serviceId}
render_post_environmentsWRITECreate environment via POST /environments
render_post_environments_by_environmentid_resourcesWRITEAdd resources to environment via POST /environments/{environmentId}/resources
render_post_key_valueWRITECreate Key Value instance via POST /key-value
render_post_key_value_by_redisid_resumeWRITEResume Key Value instance via POST /key-value/{redisId}/resume
render_post_key_value_by_redisid_suspendWRITESuspend Key Value instance via POST /key-value/{redisId}/suspend
render_post_maintenance_by_maintenancerunid_triggerWRITETrigger maintenance run via POST /maintenance/{maintenanceRunID}/trigger
render_post_postgresWRITECreate Postgres instance via POST /postgres
render_post_postgres_by_postgresid_credentialsWRITECreate PostgreSQL User via POST /postgres/{postgresId}/credentials
render_post_postgres_by_postgresid_exportWRITECreate Postgres export via POST /postgres/{postgresId}/export
render_post_postgres_by_postgresid_failoverWRITEFailover Postgres instance via POST /postgres/{postgresId}/failover
render_post_postgres_by_postgresid_recoveryWRITETrigger point-in-time recovery via POST /postgres/{postgresId}/recovery
render_post_postgres_by_postgresid_restartWRITERestart Postgres instance via POST /postgres/{postgresId}/restart
render_post_postgres_by_postgresid_resumeWRITEResume Postgres instance via POST /postgres/{postgresId}/resume
render_post_postgres_by_postgresid_suspendWRITESuspend Postgres instance via POST /postgres/{postgresId}/suspend
render_post_projectsWRITECreate project via POST /projects
render_post_redisWRITECreate Redis instance via POST /redis
render_post_redis_by_redisid_resumeWRITEResume Redis instance via POST /redis/{redisId}/resume
render_post_redis_by_redisid_suspendWRITESuspend Redis instance via POST /redis/{redisId}/suspend
render_post_registrycredentialsWRITECreate registry credential via POST /registrycredentials
render_post_servicesWRITECreate service via POST /services
render_post_services_by_serviceid_cache_purgeWRITEPurge Web Service Cache via POST /services/{serviceId}/cache/purge
render_post_services_by_serviceid_custom_domainsWRITEAdd custom domain via POST /services/{serviceId}/custom-domains
render_post_services_by_serviceid_custom_domains_by_customdomainnameorid_verifyWRITEVerify DNS configuration via POST /services/{serviceId}/custom-domains/{customDomainNameOrID}/verify
render_post_services_by_serviceid_deploysWRITETrigger deploy via POST /services/{serviceId}/deploys
render_post_services_by_serviceid_deploys_by_deployid_cancelWRITECancel deploy via POST /services/{serviceId}/deploys/{deployId}/cancel
render_post_services_by_serviceid_headersWRITEAdd header rule via POST /services/{serviceId}/headers
render_post_services_by_serviceid_jobsWRITECreate job via POST /services/{serviceId}/jobs
render_post_services_by_serviceid_jobs_by_jobid_cancelWRITECancel running job via POST /services/{serviceId}/jobs/{jobId}/cancel
render_post_services_by_serviceid_previewWRITECreate service preview (image-backed) via POST /services/{serviceId}/preview
render_post_services_by_serviceid_restartWRITERestart service via POST /services/{serviceId}/restart
render_post_services_by_serviceid_resumeWRITEResume service via POST /services/{serviceId}/resume
render_post_services_by_serviceid_rollbackWRITERoll back deploy via POST /services/{serviceId}/rollback
render_post_services_by_serviceid_routesWRITEAdd redirect/rewrite rules via POST /services/{serviceId}/routes
render_post_services_by_serviceid_scaleWRITEScale instance count via POST /services/{serviceId}/scale
render_post_services_by_serviceid_suspendWRITESuspend service via POST /services/{serviceId}/suspend
render_post_task_runsWRITERun task via POST /task-runs
render_post_webhooksWRITECreate a webhook via POST /webhooks
render_post_workflowsWRITECreate a workflow via POST /workflows
render_post_workflowversionsWRITEDeploy a workflow version via POST /workflowversions
render_put_env_groups_by_envgroupid_env_vars_by_envvarkeyWRITEAdd or update environment variable (env-groups) via PUT /env-groups/{envGroupId}/env-vars/{envVarKey}
render_put_env_groups_by_envgroupid_secret_files_by_envvarkeyWRITEAdd or update secret file (env-groups) via PUT /env-groups/{envGroupId}/secret-files/{envVarKey}
render_put_logs_streams_owner_by_owneridWRITEUpdate log stream via PUT /logs/streams/owner/{ownerId}
render_put_logs_streams_resource_by_resourceidWRITEUpdate log stream override via PUT /logs/streams/resource/{resourceId}
render_put_metrics_stream_by_owneridWRITECreate or update metrics stream via PUT /metrics-stream/{ownerId}
render_put_services_by_serviceid_autoscalingWRITEUpdate autoscaling config via PUT /services/{serviceId}/autoscaling
render_put_services_by_serviceid_env_varsWRITEUpdate environment variables via PUT /services/{serviceId}/env-vars
render_put_services_by_serviceid_env_vars_by_envvarkeyWRITEAdd or update environment variable (services) via PUT /services/{serviceId}/env-vars/{envVarKey}
render_put_services_by_serviceid_headersWRITEReplace header rules via PUT /services/{serviceId}/headers
render_put_services_by_serviceid_routesWRITEUpdate redirect/rewrite rules via PUT /services/{serviceId}/routes
render_put_services_by_serviceid_secret_filesWRITEUpdate secret files via PUT /services/{serviceId}/secret-files
render_put_services_by_serviceid_secret_files_by_envvarkeyWRITEAdd or update secret file (services) via PUT /services/{serviceId}/secret-files/{envVarKey}
Put Render behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.