EchoRelay

Activate and immediately publish an inactive line so it serves traffic again. Blocked at the active-line cap — deactivate another line first. Requires edit access.

Archive a project you own. Reversible: the project + slug persist and credits are kept, but the data plane drops the tenant (callers get 404). Idempotent. Fails with an error if the project has archive protection enabled — that is a support-only unlock, not something this call can override. Requires an ACCOUNT-scoped token and the `config` scope.

Cancel one line schedule before its two-minute lock.

Schedule the project owner's subscription for cancellation at the end of the current billing period. Returns `{kind: 'scheduled', newPlan: 'free', effectiveAt}`. Add-ons keep renewing while the plan is active; after it ends they stop renewing and each already-paid add-on cycle stays active until its own end date (use unsubscribe_addon to stop one sooner). Owner-only; requires a token minted with the billing scope.

Switch the project owner between Pro and Scale, or cancel the subscription (effectively dropping to Free at period end). Returns `{kind, newPlan, effectiveAt, applied}` — `applied=true` means Paddle was charged immediately, otherwise the change is queued for the current period end. Use preview_plan_change first to see the dollar impact. Owner-only; requires a token minted with the billing scope.

Preview what Save & Publish (or the pending scheduled publish, if one exists) would change: added/removed/changed lines, and within each changed line the added/removed/changed endpoints and targets, plus any project-level setting change. Outbound auth secrets are redacted the same as get_config.

Mint an inbound relay (data-plane) API key for callers to send traffic to this project. Its `er_live_` or `er_test_` secret authenticates relay requests; it cannot call management MCP or REST. Returns the plaintext exactly once — store it now, it cannot be retrieved later. Editor + owner; subject to the project key policy (see get_key_policy).

Save a new reusable credential, sealed with the project's encryption key at write time. Neither this call nor any later read ever returns the secret back — reference it from a target by id (see create_endpoint/update_endpoint's target.credentialVaultEntryId) instead of copying the secret around. `auth.type` selects which fields apply: bearer→token, basic→username+password, apiKeyHeader→headerName+key, apiKeyQuery→paramName+key, publicPrivateKey→secret+key. `destinationHost` is required and permanent: the credential is only ever sent to that host, over https, and no later call can re-aim it.

Create an endpoint under a line. Defaults to immediate publish; draft mode requires draftRevision. scheduledAt stages the line draft then schedules it. Requires edit access.

Create a new versioned line. Defaults to immediate publish; draft mode requires draftRevision 0. Requires edit access.

Create a new project on your account so an agent can bootstrap from a fresh account. The slug is derived from the name and validated server-side (format, reserved words, uniqueness). Each plan includes a fixed number of active projects (free tiers one; paid plans more — see list_subscription_plans); at the limit this errors — if an existing project can host this integration, skip create_project and call create_project_token against it instead of adding another. Requires an ACCOUNT-scoped token and the `config` scope. Returns the created project ({id, slug, name, apiBaseUrl, archived}); call create_project_token next to mint a token for it.

Mint a PROJECT-scoped management token (`er_mcp_`) for MCP and REST; it cannot authenticate relay traffic. Use it after create_project to configure a fresh project, or for any project you already own. Attenuated by design: the scopes must be a subset of THIS token's own grant (`read` is always included), expiry is mandatory (1–90 days, default 30, never "never"), and the minted token — being project-scoped — can never mint tokens itself. `spend` is human-granted only: no token, of any scope, can mint one carrying it — mint a spend-scoped key from the project's panel instead. Requires an ACCOUNT-scoped token and the `config` scope. Returns the plaintext exactly once; only its hash is stored.

Take a line off the data plane immediately (callers get 404) without deleting it — endpoints/targets/config are preserved and it can be reactivated later. A deliberate action; live traffic is never auto-disabled. Requires edit access.

Return a canonical minimal-valid endpoint JSON for a fresh line. POST it verbatim to create_endpoint to land an immediately-working mock endpoint, then customise. Read-only.

Delete a saved credential. Blocked (not a permission or not-found error — a validation error) while any target still references it; repoint or remove those targets first.

Delete an endpoint and its targets, publishing the removal immediately. Requires edit access.

Delete a line and every endpoint under it, publishing the removal immediately. Requires edit access.

Permanently delete a DLQ entry without retrying. Requires edit access.

Discard one endpoint change from a line draft.

Discard every unpublished change and schedule for one line.

Schedule a tier downgrade for a non-stackable add-on (RPM tier). The current tier stays active until `nextRenewalAt`; at that point the lower tier is charged and activated. No mid-cycle charge. Use list_addons to find available keys. Returns {addonKey, targetAddonKey, project, effectiveAt}. Owner-only; requires a token minted with the billing scope.

Validate an endpoint document without writing it. Returns either {ok: true, resolved: <Framework config slice>} or {ok: false, errors: {...}}. Pass endpointId to dry-run a PATCH against an existing endpoint; omit it to dry-run a create. No DB write, no queue entry, no billing.

Copy a line and all its endpoints/targets/rules into a new line key — build v2 from v1. The copy is saved inactive and remains off the data plane; edit it, then activate_line when ready. Requires edit access.

Get the project's credit balances (paid + testing) and which ledger it settles on. `billingModel` is `prepaid` (metered against the credit balance) or `invoiceable` (an Enterprise account, settled on the contract — its credit fields read empty/zero by design, not because it is out of credits). A zero balance is not on its own a reason to stop: live traffic is never refused for an empty balance, and a free-tier project is exempt from live credit billing entirely. Only the testing pool refuses when exhausted (402 `testing_credits_exhausted`). Read this before concluding from any other field that a project cannot send.

Get the project's published relay configuration — the exact JSON the EchoRelay Framework consumes. Includes pendingPublish with its frozen, redacted config when one is scheduled.

Get DLQ entries by Redis stream id (`{ms}-{seq}`, as returned by list_dlq's `id`) or by `requestId`. `requestId` is the durable handle — stable across a retry, unlike `id`, which changes every time an entry is replayed and later dead-letters again — and returns every fanned-out target's entry for that inbound request (one request can fan out to N targets, and several may dead-letter); `id` returns at most one. Each entry includes configVersion (the published config that authorised the delivery; 0 means unstamped). Errors if nothing matches this project — purged, retried, or discarded entries age out the same as any other.

Get the full JSON of one endpoint, including its targets, auth keys and attributes.

Returns the project's key policy: defaultKeyTtlDays, maxKeyTtlDays, editorsMayCreateNonExpiringKeys.

Read one line draft, its optimistic revision, preview, and schedule.

Aggregate request metrics for this project over a time window — volume, error rate and p50/p95/p99 latency, bucketed for charting. By default the series cover inbound requests; pass `targetId` to slice over one outbound target's per-attempt rows instead (answers "which target is degraded?"); pass `endpointId` to slice over inbound rows for a single endpoint (answers "is this endpoint receiving traffic / erroring?"). Pass at most one of targetId / endpointId. Free plans see "hour" and "day"; "week" and "month" require an active paid subscription on the project owner and are silently downgraded to "day" otherwise (the response includes `planGated: true` when that happens). Returns `{window, requestedWindow, planGated, scope, targetId?, endpointId?, bucketSeconds, buckets[], volume[], errors[], totalVolume, totalErrors, errorRate}` plus latency series whose keys depend on scope: an inbound read (project-wide, or `endpointId`) carries `relayP50[]/relayP95[]/relayP99[]` for our own time and `targetP50[]/targetP95[]/targetP99[]` for the destination's, never blended; a `targetId` read carries `p50[]/p95[]/p99[]` for that target's attempts — series arrays are dense (one point per bucket, zero-filled when no traffic).

Get the EchoRelay project this token is scoped to: id, slug, name, caller-facing API base URL, whether the token has edit access, and the request-log hot-tier retention window.

Get one inbound request envelope + every per-target attempt the Consumer made on the way out (success / permanent_failure / retry_scheduled / dlq). The request and each attempt carry configVersion, the published config that authorised them; 0 means unstamped. Scoped to this project; returns null if no matching row in the hot tier (the project's requestLogRetentionDays window — see get_project).

Get the project owner's current subscription: plan, active flag, period start/end, cancel-at-period-end flag, external Paddle subscription id, and whether a payment method is on file at the provider. Owner-only; requires a token minted with the billing scope.

Invite a person by email to collaborate on this project. Returns the new invitation record; the invitee receives an email with an accept link. Enforces the seat cap for the plan tier. Owner only.

List the project owner`s currently-active add-ons. Returns `[{addonKey, project, monthlyEurCents, activatedAt, nextRenewalAt, consecutiveFailures}, ...]`. RPM upgrades are per-project; `project` is the slug they apply to (null for account-wide add-ons). Owner-only; requires a token minted with the billing scope.

List the optional add-on subscriptions (RPM upgrades, extra team seats, extended log retention, extra file-delivery storage in +5 GB blocks, …). Each entry is monthly, renews every 30 days until cancelled, and carries `scope` (per_account or per_project). Read-only.

List the project's inbound API keys (metadata only — the secret plaintext is never returned).

List project audit-log entries, newest first. Captures who changed what — lines, endpoints, targets, API keys. Outbound-target `auth.token` / `auth.password` are redacted in the diff per the same policy used for endpoint reads. Retention is the `auditRetentionDays` advertised on get_project (default 365 days); rows older than that are purged by the cleanup job. Returns `{total, limit, offset, retentionDays, rows[]}` where each row has `id`, `createdAt`, `actor` (email or null), `action`, `entityType`, `entityId`, `entityLabel`, `diff`.

List retained revisions for one line so a prior revision can be selected for rollback.

List the project's saved credentials — reusable target-auth secrets that can be referenced from any number of targets instead of entering auth inline per target. `auth` is redacted (secret fields never returned, even encrypted — see create_credential for why).

List the prepaid credit packs the project owner can purchase. Read-only. Identify a pack to start_topup by its `eurCents`.

List entries currently in this project's dead-letter queue, newest first. One inbound request fans out per-target, so a single failed request may produce several DLQ entries with different `targetId`s. Returns `{total, limit, offset, rows[], evictedCount}` where each row has `id` (Redis stream id), `requestId`, `targetId`, `configVersion` (the published config that authorised the delivery; 0 means unstamped), `failureReason`, `failedAttempts`, `failedAt`, `payload` (the original Consumer queue entry JSON); `evictedCount` is the lifetime count of entries the queue's capacity cap discarded before they could be triaged. DLQ entries — including the original request body and headers — are kept for up to 30 days from the failure time or until cleared, then purged automatically (or discarded early past capacity — see `evictedCount`); they are never written to a database. get_request still answers what happened to a purged/evicted/discarded entry's inbound request for the project's requestLogRetentionDays window, independent of whether the DLQ row itself still exists. `requestId` is the durable handle across a retry: an entry's own `id` changes every time it is replayed and later dead-letters again, so get_dlq_entry accepts a `requestId` lookup as well as `id`.

List the endpoints under one line of the project.

List the project's versioned API lines (e.g. v1, v2), each with its endpoint count.

List accepted and pending members of this project. Shows name/email, role, and whether the invite has been accepted. Owner only.

List the API tokens scoped to a project you own (any holder): id, label, scopes, createdAt, lastUsedAt, expiresAt, revokedAt — never the secret (only its hash is stored). Requires an ACCOUNT-scoped token and the `read` scope.

List the projects on your account (archived included), each with `id`, `slug`, `name`, `apiBaseUrl` and `archived`. Requires an ACCOUNT-scoped token (one minted with no project) and the `read` scope. A project-scoped token cannot call this — use it on its own project's tools instead.

List inbound API requests the relay has processed for this project, newest first. Hot-tier window is the project's requestLogRetentionDays (see get_project). Optional filters narrow the result. Returns {total, limit, offset, rows[]} where each row has ts (unix ms), requestId, method, path, status, durationMs, targets, creditsDeducted, authType, errorMessage, bytesSent, configVersion (the published config that authorised the request; 0 means unstamped), and closeReason (for a streaming request: complete / abortedOrError / byteCap / noValue; empty for non-stream requests).

List the available subscription plans (Free, Pro, Scale) with monthly EUR price, credit allowance, per-project RPM cap, and how many active projects the plan includes. Read-only.

Preview one line draft without publishing it.