EchoRelay

Get the EchoRelay project this token is scoped to: id, slug, name, caller-facing API base URL, whether the token has edit access, and the request-log hot-tier retention window.

List every line in the project: returns `{lines: []}` in one call, with no paging. Each entry reports `lineKey`, `name`, `active`, `docsShared`, `publishedAt`, `endpointCount`, and its draft state (`d…

List the endpoints under one line, identified by `lineKey`; returns `{lineKey, endpoints: []}` with no paging. Each entry reports `id`, `name`, `path`, `httpMethod`, `strict`, `mock`, and `targetCount…

Get one endpoint's full document by `lineKey` and `endpointId`: `id`, `lineKey`, `name`, `url`, `httpMethod`, `strict`, `rateLimit`, `allowedIPs`, `idempotencyEnabled`, `senderSignature` (`{scheme, cr…

Get the project's published relay configuration — the exact JSON the EchoRelay Framework consumes. Includes pendingPublish with its frozen, redacted config when one is scheduled.

Preview what Save & Publish (or the pending scheduled publish, if one exists) would change: added/removed/changed lines, and within each changed line the added/removed/changed endpoints and targets, p…

List every retained revision of one line, newest first, so a target revision can be picked for rollback_config. Returns `{revisions: []}` with no paging; each entry has `revision`, `publishedAt`, `cur…

Read one line draft, its optimistic revision, preview, and schedule.

Preview one line draft without publishing it.

Publish one line draft now and clear only its schedule.

Discard every unpublished change and schedule for one line.

Discard one endpoint change from a line draft.

Schedule one non-empty line draft. Active subscribers required.

Cancel one line schedule before its two-minute lock.

Preview or apply publishing a retained line revision over what is currently published, clearing any pending schedule. Without confirmRevision this only returns the diff (the redacted change-gate previ…

Get the project's credit balances (paid + testing) and which ledger it settles on. `billingModel` is `prepaid` (metered against the credit balance) or `invoiceable` (an Enterprise account, settled on …

Enable or disable the auto-decaying burst window for live traffic and publish the change immediately. When enabled, brief spikes a little above your steady RPM cap are absorbed at the normal credit ra…

Set or clear a self-set ceiling on this project's own effective live-traffic RPM (Traffic shaping) — for when your origin can't take the throughput your plan grants. Never plan-gated: the ceiling can …

Narrow the project's outbound host allowlist — the hosts a target may point at. The current list is on get_project as `outboundHostAllowlist` (empty means any public host). This tool may only narrow i…

Create a new versioned line. A new line has no endpoints, so creating one publishes nothing and serves no traffic yet — add an endpoint, which publishes the line with it. Draft mode requires draftRevi…

Delete a line and every endpoint under it, immediately or by staging the removal in the line's draft with commitMode "draft" and draftRevision (returns `{draft}`, discardable via discard_line_draft, i…

Activate and immediately publish an inactive line so it serves traffic again. Blocked at the active-line cap — deactivate another line first. Requires edit access.

Take a line off the data plane immediately (callers get 404) without deleting it — endpoints/targets/config are preserved and it can be reactivated later. A deliberate action; live traffic is never au…

Copy a line and all its endpoints/targets/rules into a new line key — build v2 from v1. The copy is saved inactive and remains off the data plane; edit it, then activate_line when ready. Requires edit…

Turn the line's public OpenAPI docs on or off. When enabled, the line's spec is published at docs.{baseDomain}/{slug}/{lineKey} (and …/openapi.json); when disabled those URLs return 404. The `docsShar…

Create an endpoint under a line. Defaults to immediate publish; draft mode requires draftRevision. scheduledAt stages the line draft then schedules it. Requires edit access.

Generate a draft endpoint under a line from a sample inbound request and a description of the target: infers the inbound body schema from the sample, reads the target's method/URL/fields from an OpenA…

Update an endpoint immediately or by staging the change in its line draft with commitMode "draft" and draftRevision; the patch is merged field-by-field onto the endpoint's current values, so omitted k…

Delete an endpoint and its targets, immediately or by staging the removal in the line's draft with commitMode "draft" and draftRevision (returns `{draft}` instead of deleting right away). An immediate…

Return a canonical minimal-valid endpoint JSON for a fresh line. POST it verbatim to create_endpoint to land an immediately-working endpoint, then customise. It comes back with `mock: true`: it answer…

Validate an endpoint document without writing it. Returns either {ok: true, resolved: <Framework config slice>} or {ok: false, errors: {...}}. Pass endpointId to dry-run a PATCH against an existing en…

List accepted and pending members of this project, plus the owner (role "owner"), each with `id`, `email`, `name`, `role`, and whether the invite has been accepted. Returns `{members: [], count, seatC…

Invite a person by email to collaborate on this project. Returns the new invitation record; the invitee receives an email with an accept link. Enforces the seat cap for the plan tier. Owner only.

Remove a member (accepted or pending) from this project by memberId or email, matching the first record found; returns `{message, email}`. This deletes the membership record outright with no undo, so …

Change a member's role between editor, viewer, and billing. Identify the member by their member ID or email (from list_members); the project owner's own role cannot be changed. Returns the updated mem…

Re-send the invitation email for a still-pending invite, by member ID or email (from list_members). The original accept link is reused. Already-accepted members are rejected. Owner only.

List the project's inbound API keys as metadata only — the secret plaintext is never returned, only `id`, `name`, `mode`, `prefix`, `createdAt`, `createdBy`, `lastUsedAt`, `expiresAt`, `revokedAt`, `s…

Mint an inbound relay (data-plane) API key for callers to send traffic to this project. Its `er_live_` or `er_test_` secret authenticates relay requests; it cannot call management MCP or REST. Returns…

Mint a linked successor for an existing key. Returns the successor plaintext exactly once — store it now. The predecessor stays valid through its overlap window so callers can swap without downtime. O…

One-shot retrieval of the plaintext for a successor minted by the auto-rotation scheduler (not by rotate_api_key — that returns its own plaintext directly). Decrypts the at-rest ciphertext, returns it…

Revoke a key immediately: it stops authenticating as soon as the change reaches the relay, with no overlap window, so callers still using it start failing. To replace a key without downtime, use rotat…

Return the project's key policy: `defaultKeyTtlDays` (what create_api_key uses when `ttlDays` is omitted), plus `maxKeyTtlDays` and `editorsMayCreateNonExpiringKeys`, the limits create_api_key enforce…

Owner-only. Edit the project's key policy. Only fields present in the patch are touched. Editors calling this get an error — use get_key_policy to read.

List the project's saved credentials — reusable target-auth secrets that can be referenced from any number of targets instead of entering auth inline per target. `auth` is redacted (secret fields neve…

Save a new reusable credential, sealed with the project's encryption key at write time. Neither this call nor any later read ever returns the secret back — reference it from a target by id (see create…

Rename a credential and/or rotate its secret, publishing the change immediately so every target that uses this credential picks it up right away. Omit a secret field (or the whole `auth` object) to ke…

Delete a saved credential. Blocked (not a permission or not-found error — a validation error) while any target still references it; repoint or remove those targets first.

List inbound API requests the relay has processed for this project, newest first. Hot-tier window is the project's requestLogRetentionDays (see get_project). Optional filters narrow the result. Return…

Get one inbound request envelope + every per-target delivery attempt made on the way out (success / permanent_failure / retry_scheduled / dlq). The request and each attempt carry configVersion, the pu…

Get every target this request fanned out to, each with its delivery receipt or the reason it has none. A still-moving delivery (queued/retrying) answers from the live tracking copy, a terminal one (de…

Aggregate request metrics for this project over a time window — volume, error rate and p50/p95/p99 latency, bucketed for charting. By default the series cover inbound requests; pass `targetId` to slic…

List entries currently in this project's dead-letter queue, newest first. One inbound request fans out per-target, so a single request may produce several DLQ entries, one per target that didn't accep…

Get DLQ entries by entry id (`{ms}-{seq}`, as returned by list_dlq's `id`) or by `requestId`. `requestId` is the durable handle — stable across a retry, unlike `id`, which changes every time an entry …

Re-enqueue a DLQ entry to the main relay stream and delete it from the DLQ. A replay is billed like any relay — it charges the entry's original credit cost to the project before re-sending; if the bal…

Permanently delete a DLQ entry without retrying it: the delivery is never re-sent and the entry cannot be restored. Use retry_dlq_entry instead when the delivery should still reach its target. The inb…

List the available subscription plans (Free, Pro, Scale) with monthly EUR price, credit allowance, per-project RPM cap, and how many active projects the plan includes. Read-only.

List the prepaid credit packs available to purchase, returned as a bare array of `{credits, eurCents, usdCents, plnGrosze, welcomeEligible}` objects — not wrapped in an envelope, and not paginated (th…

List the optional add-on subscriptions (RPM upgrades, extra team seats, extended log retention, extra file-delivery storage in +5 GB blocks, …). Each entry is monthly, renews every 30 days until cance…

Get the project owner's current subscription: plan, active flag, period start/end, cancel-at-period-end flag, external Paddle subscription id, and whether a payment method is on file at the provider. …

Preview what would happen if change_plan were called with this plan: the immediate-charge amount (cents), the next-invoice amount, the effective date, and the kind (`applied` for in-cycle upgrade, `sc…

Begin a new Pro or Scale subscription for the project owner. Returns `{checkoutUrl, plan}` — surface the URL to the human for approval. Errors if the owner is already on an active paid plan (use chang…

Switch the project owner between Pro and Scale, or cancel the subscription (effectively dropping to Free at period end). Returns `{kind, newPlan, effectiveAt, applied}` — `applied=true` means Paddle w…

Schedule the project owner's subscription for cancellation at the end of the current billing period. Returns `{kind: 'scheduled', newPlan: 'free', effectiveAt}`. Add-ons keep renewing while the plan i…

Turn the project owner's overage billing on or off, for the whole account. Returns `{overageBilling}`, the setting get_billing reads back. Owner-only; requires a token minted with the billing scope.

Begin a credit-pack top-up for the project owner. Pass the pack`s `eurCents` (from list_credit_packs). Returns `{checkoutUrl, credits, eurCents, directCharge}` or `{transactionId, credits, eurCents, d…

Subscribe the project owner to a monthly add-on (RPM upgrade, team seat, extended log retention, extra file storage in +5 GB blocks, …). Charges the saved payment method immediately, then auto-renews …

Cancel an active add-on subscription. Stops future charges; the current cycle stays active until expiry. RPM upgrades are cancelled for THIS project. Returns `{addonKey, project, cancelledAt}`. Owner-…

Resume (un-cancel) a pending-cancel add-on whose paid-through cycle has not yet ended. Clears the cancellation so the add-on renews normally at the next cycle boundary. No new charge — the cycle was a…

Schedule a tier downgrade for a non-stackable add-on (RPM tier). The current tier stays active until `nextRenewalAt`; at that point the lower tier is charged and activated. No mid-cycle charge. Use li…

List the project owner`s currently-active add-ons. Returns `[{addonKey, project, monthlyEurCents, activatedAt, nextRenewalAt, consecutiveFailures}, ...]`. RPM upgrades are per-project; `project` is th…

List project audit-log entries, newest first. Captures who changed what — lines, endpoints, targets, API keys. Outbound-target `auth.token` / `auth.password` are redacted in the diff per the same poli…

List the projects on your account (archived included), each with `id`, `slug`, `name`, `apiBaseUrl` and `archived`, plus `accountEmail` — the account this token authenticates as. Requires an ACCOUNT-s…

Create a new project on your account so an agent can bootstrap from a fresh account. The slug is derived from the name and validated server-side (format, reserved words, uniqueness). Each plan include…

Rename a project you own (the display name only: the slug, which identifies the project in URLs and API paths, never changes). Requires an ACCOUNT-scoped management token and the `config` scope. 404-e…

Archive a project you own. Reversible: the project + slug persist and credits are kept, but the data plane drops the tenant (callers get 404). Idempotent. Fails with an error if the project has archiv…

Turn on archive protection for a project you own: archive_project (on every surface: panel, REST, and this tool) then refuses until it is lifted. Idempotent. Permanent from here: there is no tool or A…

Restore an archived project you own to the data plane. Restoring consumes one of your plan's active-project slots, so at the limit this returns an error telling you to archive another project or upgra…

Mint a PROJECT-scoped management token (`er_mcp_`) for MCP and REST; it cannot authenticate relay traffic. Use it after create_project to configure a fresh project, or for any project you already own.…

List the management tokens scoped to a project you own (any holder): id, label, scopes, createdAt, lastUsedAt, expiresAt, revokedAt: never the secret (only its hash is stored). Requires an ACCOUNT-sco…

Revoke a PROJECT-scoped management token on a project you own, any holder's, not just your own (the account-owner kill switch for a leaked or retired integration's management token). Soft-revoke: the …