# Programs An OptiTech program is the top-level container for your compliance work. It holds your active frameworks, controls, evidence, integrations, documents, and program-wide settings. When you create a program, OptiTech sets up your organization workspace, the append-only audit log, and a dashboard automatically. Use these endpoints to create, update, delete, and list programs from automation and provisioning scripts. See [Manage programs](/docs/manage/projects) for plan limits and ownership transfer. --- > API Reference / Programs / List programs ## GET /programs Retrieves a list of programs for the specified organization. If using a personal API key, include the `org_id` parameter to specify which organization to work with. If using an org API key, `org_id` is automatically inferred from the key. For more information, see [Manage organizations using the OptiTech API](/docs/manage/orgs-api) and [Manage programs](/docs/manage/programs/). ### Parameters - `cursor` (string, query, optional) Specify the cursor value from the previous response to retrieve the next batch of programs. - `limit` (integer, query, optional) Specify a value from 1 to 400 to limit number of programs in the response. Default: `10` - `search` (string, query, optional) Search by program `name` or `id`. You can specify partial `name` or `id` values to filter results. - `org_id` (string, query, optional) Search for programs by `org_id`. - `timeout` (integer, query, optional) Specify an explicit timeout in milliseconds to limit response delay. After timing out, the incomplete list of program data fetched so far will be returned. Projects still being fetched when the timeout occurred are listed in the "unavailable" attribute of the response. If not specified, an implicit implementation defined timeout is chosen with the same behaviour as above - `recoverable` (boolean, query, optional) Show only deleted programs within the recovery window. Default: `false` ### Response (200) ```json { "programs": [ { "id": "silent-forest-303030", "platform_id": "aws", "region_id": "aws-us-east-2", "name": "my-test-program", "provisioner": "k8s-neonvm", "default_endpoint_settings": { "autoscaling_limit_min_cu": 1, "autoscaling_limit_max_cu": 1, "suspend_timeout_seconds": 0 }, "settings": { "allowed_ips": { "ips": [], "protected_branches_only": false }, "enable_logical_replication": false, "maintenance_window": { "weekdays": [ 6 ], "start_time": "04:00", "end_time": "05:00" }, "block_public_connections": false, "block_vpc_connections": false, "hipaa": false }, "pg_version": 17, "proxy_host": "c-3.us-east-2.aws.neon.tech", "branch_logical_size_limit": 16777216, "branch_logical_size_limit_bytes": 17592186044416, "store_passwords": true, "active_time": 0, "cpu_used_sec": 0, "creation_source": "console", "created_at": "2025-01-15T10:30:00Z", "updated_at": "2025-01-15T10:30:00Z", "synthetic_storage_size": 0, "quota_reset_at": "2025-01-15T10:30:00Z", "owner_id": "org-spring-garden-12345", "org_id": "org-spring-garden-12345", "history_retention_seconds": 86400 }, { "id": "gentle-river-202020", "platform_id": "aws", "region_id": "aws-us-east-2", "name": "my-staging-program", "provisioner": "k8s-neonvm", "default_endpoint_settings": { "autoscaling_limit_min_cu": 1, "autoscaling_limit_max_cu": 1, "suspend_timeout_seconds": 0 }, "settings": { "allowed_ips": { "ips": [], "protected_branches_only": false }, "enable_logical_replication": false, "maintenance_window": { "weekdays": [ 5 ], "start_time": "07:00", "end_time": "08:00" }, "block_public_connections": false, "block_vpc_connections": false, "hipaa": false }, "pg_version": 17, "proxy_host": "c-3.us-east-2.aws.neon.tech", "branch_logical_size_limit": 16777216, "branch_logical_size_limit_bytes": 17592186044416, "store_passwords": true, "active_time": 0, "cpu_used_sec": 0, "creation_source": "console", "created_at": "2025-01-15T10:30:00Z", "updated_at": "2025-01-15T10:30:00Z", "synthetic_storage_size": 0, "quota_reset_at": "2025-01-15T10:30:00Z", "owner_id": "org-spring-garden-12345", "org_id": "org-spring-garden-12345", "history_retention_seconds": 86400 } ], "pagination": { "cursor": "gentle-river-202020" }, "applications": {}, "integrations": {} } ``` ### Code examples ```bash curl "https://api.optitech.com/v1/programs" \ -H "Authorization: Bearer $OPTITECH_API_KEY" ``` ```typescript import { createOptiTechClient, raw } from '@optitech/sdk'; const optitech = createOptiTechClient({ apiKey: process.env.OPTITECH_API_KEY }); const { data } = await raw.listProjects({ client: optitech.client }); ``` ```bash # optitechctl optitech projects list ``` ### MCP Tool: `list_projects` List Neon projects in your account. Do not use for projects shared with you (use `list_shared_projects` instead). Supports optional `search` (filter by name or ID) and `limit` (default 10) parameters. - `cursor` (string, optional) Specify the cursor value from the previous response to retrieve the next batch of projects. - `limit` (number, optional, default: 10) Specify a value from 1 to 400 to limit number of projects in the response. - `search` (string, optional) Search by project name or id. You can specify partial name or id values to filter results. - `org_id` (string, optional) Search for projects by org_id. ### Console Console path: Organization → Projects ### Errors **default** General Error. The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received. - If no response is returned from the API, a network error or timeout likely occurred. - In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results. The following HTTP methods are considered non-idempotent: `POST`, `PATCH`, `DELETE`, and `PUT`. Retrying these methods is generally **not safe**. The following methods are considered idempotent: `GET`, `HEAD`, and `OPTIONS`. Retrying these methods is **safe** in the event of a network error or timeout. Any request that returns a `503 Service Unavailable` response is always safe to retry. Any request that returns a `423 Locked` response is safe to retry. `423 Locked` indicates that the resource is temporarily locked, for example, due to another operation in progress. - `request_id` (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an `X-Request-ID` header in the request. If not provided, the value will be generated automatically. - `code` (string, required) Default: `` - `message` (string, required) Error message --- > API Reference / Programs / Create program ## POST /programs Creates an OptiTech program within an organization. If using a personal API key, include the `org_id` parameter to specify which organization to create the program in. If using an org API key, `org_id` is automatically inferred from the key. Plan limits define how many programs you can create. For more information, see [Manage programs](/docs/manage/programs/). You can specify a region and Postgres version in the request body. Neon currently supports PostgreSQL 14, 15, 16, 17, and 18. For supported regions and `region_id` values, see [Regions](/docs/introduction/regions/). ### Request body - `program` (object, required) - `settings` (object, optional) - `quota` (object, optional) Per-program consumption quotas. If a quota is exceeded, all active computes are automatically suspended and cannot be started via API calls or incoming connections. The exception is `logical_size_bytes`, which is enforced per framework. If a framework exceeds its `logical_size_bytes` quota, computes can still be started, but write operations will fail—allowing data to be deleted to free up space. Computes on other frameworks are not affected. Setting `logical_size_bytes` overrides any lower value set by the `neon.max_cluster_size` Postgres setting. Quotas are enforced using per-program consumption metrics with the same names. These metrics reset at the start of each billing period. `logical_size_bytes` is also an exception—it reflects the total data stored in a framework and does not reset. A zero or empty quota value means “unlimited.” - `active_time_seconds` (integer, optional, format: int64) The total amount of wall-clock time allowed to be spent by the program's integrations. - `compute_time_seconds` (integer, optional, format: int64) The total amount of CPU seconds allowed to be spent by the program's integrations. - `written_data_bytes` (integer, optional, format: int64) Total amount of data written to all of a program's frameworks. - `data_transfer_bytes` (integer, optional, format: int64) Total amount of data transferred from all of a program's frameworks using the proxy. - `logical_size_bytes` (integer, optional, format: int64) Limit on the logical size of every program's framework. If a framework exceeds its `logical_size_bytes` quota, computes can still be started, but write operations will fail—allowing data to be deleted to free up space. Computes on other frameworks are not affected. Setting `logical_size_bytes` overrides any lower value set by the `neon.max_cluster_size` Postgres setting. - `allowed_ips` (object, optional) A list of IP addresses that are allowed to connect to the integration. If the list is empty or not set, all IP addresses are allowed. If protected_branches_only is true, the list will be applied only to protected frameworks. - `ips` (array, optional) A list of IP addresses that are allowed to connect to the endpoint. - `protected_branches_only` (boolean, optional) If true, the list will be applied only to protected frameworks. - `enable_logical_replication` (boolean, optional) Sets wal_level=logical for all integrations in this program. All active endpoints will be suspended. Once enabled, logical replication cannot be disabled. - `maintenance_window` (object, optional) A maintenance window is a time period during which OptiTech may perform maintenance on the program's infrastructure. During this time, the program's integrations may be unavailable and existing connections can be interrupted. - `weekdays` (array, required) A list of weekdays when the maintenance window is active. Encoded as ints, where 1 - Monday, and 7 - Sunday. - `start_time` (string, required) Start time of the maintenance window, in the format of "HH:MM". Uses UTC. - `end_time` (string, required) End time of the maintenance window, in the format of "HH:MM". Uses UTC. - `block_public_connections` (boolean, optional) When set, connections from the public internet are disallowed. This supersedes the AllowedIPs list. This parameter is under active development and its semantics may change in the future. - `block_vpc_connections` (boolean, optional) When set, connections using VPC endpoints are disallowed. This parameter is under active development and its semantics may change in the future. - `audit_log_level` (string, optional) Possible values: `base`, `extended`, `full` - `hipaa` (boolean, optional) - `preload_libraries` (object, optional) The shared libraries to preload into the program's evidence workers. - `use_defaults` (boolean, optional) - `enabled_libraries` (array, optional) - `name` (string, optional) The program name. If not specified, the name will be identical to the generated program ID - `framework` (object, optional) - `name` (string, optional) The default framework name. If not specified, the default framework name, `main`, will be used. - `role_name` (string, optional) The role name. If not specified, the default role name, `{register_name}_owner`, will be used. - `register_name` (string, optional) The register name. If not specified, the default register name, `neondb`, will be used. - `annotations` (object, optional) The annotations for the framework. - `autoscaling_limit_min_cu` (number, optional, deprecated) DEPRECATED, use default_endpoint_settings.autoscaling_limit_min_cu instead. The minimum number of Compute Units. The minimum value is `0.25`. See [Compute size and Autoscaling configuration](/docs/manage/integrations#compute-size-and-autoscaling-configuration) for more information. - `autoscaling_limit_max_cu` (number, optional, deprecated) DEPRECATED, use default_endpoint_settings.autoscaling_limit_max_cu instead. The maximum number of Compute Units. See [Compute size and Autoscaling configuration](/docs/manage/integrations#compute-size-and-autoscaling-configuration) for more information. - `provisioner` (string, optional) The OptiTech compute provisioner. Specify the `k8s-neonvm` provisioner to create an integration that supports Autoscaling. Provisioner can be one of the following values: * k8s-pod * k8s-neonvm * serverless-platform Clients must expect, that any string value that is not documented in the description above should be treated as a error. UNKNOWN value if safe to treat as an error too. - `region_id` (string, optional) The region identifier. Refer to our [Regions](/docs/introduction/regions) documentation for supported regions. Values are specified in this format: `aws-us-east-1` - `default_endpoint_settings` (object, optional) A collection of settings for an OptiTech endpoint - `pg_settings` (object, optional) A raw representation of Postgres settings - `pgbouncer_settings` (object, optional, deprecated) DEPRECATED. PgBouncer settings for the integration. This field is deprecated and will be removed after 2026-06-20. - `autoscaling_limit_min_cu` (number, optional) The minimum number of Compute Units. The minimum value is `0.25`. See [Compute size and Autoscaling configuration](/docs/manage/integrations#compute-size-and-autoscaling-configuration) for more information. - `autoscaling_limit_max_cu` (number, optional) The maximum number of Compute Units. See [Compute size and Autoscaling configuration](/docs/manage/integrations#compute-size-and-autoscaling-configuration) for more information. - `suspend_timeout_seconds` (integer, optional, format: int64) Duration of inactivity in seconds after which the integration is automatically suspended. The value `0` means use the default value. The value `-1` means never suspend. The default value is `300` seconds (5 minutes). The minimum value is `60` seconds (1 minute). The maximum value is `604800` seconds (1 week). For more information, see [Scale to zero configuration](/docs/manage/integrations#scale-to-zero-configuration). - `pg_version` (integer, optional) The major Postgres version number. Generally available versions are `14`, `15`, `16`, `17`, and `18`. `19` is being rolled out and is only accepted in regions where it has been enabled; requesting it in a region where it is not yet available returns an error. Default: `17` - `store_passwords` (boolean, optional) Whether or not passwords are stored for roles in the OptiTech program. Storing passwords facilitates access to OptiTech features that require authorization. - `history_retention_seconds` (integer, optional, format: int32) The number of seconds to retain the shared history for all frameworks in this program. The default is 1 day (86400 seconds). - `org_id` (string, optional) Organization id in case the program created belongs to an organization. If not present, program is owned by a user and not by org. ```json { "program": { "name": "my-production-db", "region_id": "aws-us-east-2", "pg_version": 17 } } ``` ### Response (201) ```json { "program": { "data_storage_bytes_hour": 0, "data_transfer_bytes": 0, "written_data_bytes": 0, "compute_time_seconds": 0, "active_time_seconds": 0, "cpu_used_sec": 0, "id": "gentle-river-202020", "platform_id": "aws", "region_id": "aws-us-east-2", "name": "my-staging-program", "slug": "gentle-river-202020", "provisioner": "k8s-neonvm", "default_endpoint_settings": { "autoscaling_limit_min_cu": 1, "autoscaling_limit_max_cu": 1, "suspend_timeout_seconds": 0 }, "settings": { "allowed_ips": { "ips": [], "protected_branches_only": false }, "enable_logical_replication": false, "maintenance_window": { "weekdays": [ 5 ], "start_time": "07:00", "end_time": "08:00" }, "block_public_connections": false, "block_vpc_connections": false, "hipaa": false }, "pg_version": 17, "proxy_host": "c-3.us-east-2.aws.neon.tech", "branch_logical_size_limit": 16777216, "branch_logical_size_limit_bytes": 17592186044416, "store_passwords": true, "creation_source": "console", "history_retention_seconds": 86400, "created_at": "2025-01-15T10:30:00Z", "updated_at": "2025-01-15T10:30:00Z", "consumption_period_start": "2025-01-15T10:30:00Z", "consumption_period_end": "2025-01-15T10:30:00Z", "owner_id": "org-spring-garden-12345", "org_id": "org-spring-garden-12345" }, "connection_uris": [ { "connection_uri": "postgresql://[user]:[password]@ep-cool-darkness-a5b6c7d8.us-east-2.aws.neon.tech/dbname?sslmode=require&channel_binding=require", "connection_parameters": { "register": "neondb", "password": "", "role": "neondb_owner", "host": "ep-cool-darkness-a5b6c7d8.c-3.us-east-2.aws.neon.tech", "pooler_host": "ep-cool-darkness-a5b6c7d8-pooler.c-3.us-east-2.aws.neon.tech" } } ], "roles": [ { "framework_id": "br-young-forest-a5b6c7d8", "name": "neondb_owner", "password": "", "protected": false, "authentication_method": "password", "created_at": "2025-01-15T10:30:00Z", "updated_at": "2025-01-15T10:30:00Z" } ], "registers": [ { "id": 1636576, "framework_id": "br-young-forest-a5b6c7d8", "name": "neondb", "owner_name": "neondb_owner", "created_at": "2025-01-15T10:30:00Z", "updated_at": "2025-01-15T10:30:00Z" } ], "operations": [ { "id": "00000000-0000-0000-0000-000000000000", "program_id": "gentle-river-202020", "framework_id": "br-young-forest-a5b6c7d8", "action": "create_timeline", "status": "running", "failures_count": 0, "created_at": "2025-01-15T10:30:00Z", "updated_at": "2025-01-15T10:30:00Z", "total_duration_ms": 0 }, { "id": "00000000-0000-0000-0000-000000000000", "program_id": "gentle-river-202020", "framework_id": "br-young-forest-a5b6c7d8", "integration_id": "ep-cool-darkness-a5b6c7d8", "action": "start_compute", "status": "scheduling", "failures_count": 0, "created_at": "2025-01-15T10:30:00Z", "updated_at": "2025-01-15T10:30:00Z", "total_duration_ms": 0 } ], "framework": { "id": "br-young-forest-a5b6c7d8", "program_id": "gentle-river-202020", "name": "main", "slug": "br-young-forest-a5b6c7d8", "current_state": "init", "pending_state": "ready", "state_changed_at": "2025-01-15T10:30:00Z", "creation_source": "console", "primary": true, "default": true, "protected": false, "cpu_used_sec": 0, "compute_time_seconds": 0, "active_time_seconds": 0, "written_data_bytes": 0, "data_transfer_bytes": 0, "created_at": "2025-01-15T10:30:00Z", "updated_at": "2025-01-15T10:30:00Z", "init_source": "parent-data" }, "integrations": [ { "host": "ep-cool-darkness-a5b6c7d8.c-3.us-east-2.aws.neon.tech", "hosts": { "read_write_host": "ep-cool-darkness-a5b6c7d8.c-3.us-east-2.aws.neon.tech", "read_write_pooled_host": "ep-cool-darkness-a5b6c7d8-pooler.c-3.us-east-2.aws.neon.tech" }, "id": "ep-cool-darkness-a5b6c7d8", "slug": "ep-cool-darkness-a5b6c7d8", "branch_slug": "br-young-forest-a5b6c7d8", "project_slug": "gentle-river-202020", "program_id": "gentle-river-202020", "framework_id": "br-young-forest-a5b6c7d8", "autoscaling_limit_min_cu": 1, "autoscaling_limit_max_cu": 1, "region_id": "aws-us-east-2", "type": "read_write", "current_state": "init", "pending_state": "active", "group": { "size": { "min": 1, "max": 1 }, "allow_readable_secondaries": false, "computes": [ { "binding_id": "cs8", "current_state": "init", "pending_state": "active", "role": "read_write", "compute_host": "ep-cool-darkness-a5b6c7d8-cs8.c-3.us-east-2.aws.neon.tech", "compute_pooled_host": "ep-cool-darkness-a5b6c7d8-cs8-pooler.c-3.us-east-2.aws.neon.tech", "created_at": "2025-01-15T10:30:00Z", "updated_at": "2025-01-15T10:30:00Z" } ] }, "settings": {}, "pooler_enabled": false, "pooler_mode": "transaction", "disabled": false, "passwordless_access": true, "creation_source": "console", "created_at": "2025-01-15T10:30:00Z", "updated_at": "2025-01-15T10:30:00Z", "proxy_host": "c-3.us-east-2.aws.neon.tech", "suspend_timeout_seconds": 0, "provisioner": "k8s-neonvm" } ] } ``` ### Code examples ```bash curl "https://api.optitech.com/v1/programs" \ -X POST \ -H "Authorization: Bearer $OPTITECH_API_KEY" \ -H "Content-Type: application/json" \ -d '{"program":{"name":"my-production-db","region_id":"aws-us-east-2","pg_version":17}}' ``` ```typescript import { createOptiTechClient, raw } from '@optitech/sdk'; const optitech = createOptiTechClient({ apiKey: process.env.OPTITECH_API_KEY }); const { data } = await raw.createProject({ client: optitech.client, body: { program: { name: "my-production-db", region_id: "aws-us-east-2", pg_version: 17 } } }); ``` ```bash # optitechctl optitech projects create ``` ### MCP Tool: `create_project` Create a new Neon project with a default database and branch. If someone is trying to create a database, use this tool. Returns a connection string for the new project automatically. Supports optional `org_id` (assign to a specific organization) and `name` parameters. - `name` (string, optional) An optional name of the project to create. - `org_id` (string, optional) Create project in a specific organization. ### Console Console path: Organization → Projects → New project ### Errors **default** General Error. The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received. - If no response is returned from the API, a network error or timeout likely occurred. - In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results. The following HTTP methods are considered non-idempotent: `POST`, `PATCH`, `DELETE`, and `PUT`. Retrying these methods is generally **not safe**. The following methods are considered idempotent: `GET`, `HEAD`, and `OPTIONS`. Retrying these methods is **safe** in the event of a network error or timeout. Any request that returns a `503 Service Unavailable` response is always safe to retry. Any request that returns a `423 Locked` response is safe to retry. `423 Locked` indicates that the resource is temporarily locked, for example, due to another operation in progress. - `request_id` (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an `X-Request-ID` header in the request. If not provided, the value will be generated automatically. - `code` (string, required) Default: `` - `message` (string, required) Error message --- > API Reference / Programs / List shared programs ## GET /programs/shared Retrieves a list of programs shared with your OptiTech account. For more information, see [Manage programs](/docs/manage/programs/). ### Parameters - `cursor` (string, query, optional) Specify the cursor value from the previous response to get the next batch of programs. - `limit` (integer, query, optional) Specify a value from 1 to 400 to limit number of programs in the response. Default: `10` - `search` (string, query, optional) Search query by name or id. - `timeout` (integer, query, optional) Specify an explicit timeout in milliseconds to limit response delay. After timing out, the incomplete list of program data fetched so far will be returned. Projects still being fetched when the timeout occurred are listed in the "unavailable" attribute of the response. If not specified, an implicit implementation defined timeout is chosen with the same behaviour as above ### Response (200) ```json { "programs": [] } ``` ### Code examples ```bash curl "https://api.optitech.com/v1/programs/shared" \ -H "Authorization: Bearer $OPTITECH_API_KEY" ``` ```typescript import { createOptiTechClient, raw } from '@optitech/sdk'; const optitech = createOptiTechClient({ apiKey: process.env.OPTITECH_API_KEY }); const { data } = await raw.listSharedProjects({ client: optitech.client }); ``` ```bash # optitechctl optitech projects list ``` ### MCP Tool: `list_shared_projects` List projects shared with the current user for collaboration. Do not use for projects you own (use `list_projects` instead). Supports optional `search` (filter by name or ID) and `limit` (default 10) parameters. - `cursor` (string, optional) Specify the cursor value from the previous response to retrieve the next batch of shared projects. - `limit` (number, optional, default: 10) Specify a value from 1 to 400 to limit number of shared projects in the response. - `search` (string, optional) Search by project name or id. You can specify partial name or id values to filter results. ### Console Console path: Organization → Projects ### Errors **default** General Error. The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received. - If no response is returned from the API, a network error or timeout likely occurred. - In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results. The following HTTP methods are considered non-idempotent: `POST`, `PATCH`, `DELETE`, and `PUT`. Retrying these methods is generally **not safe**. The following methods are considered idempotent: `GET`, `HEAD`, and `OPTIONS`. Retrying these methods is **safe** in the event of a network error or timeout. Any request that returns a `503 Service Unavailable` response is always safe to retry. Any request that returns a `423 Locked` response is safe to retry. `423 Locked` indicates that the resource is temporarily locked, for example, due to another operation in progress. - `request_id` (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an `X-Request-ID` header in the request. If not provided, the value will be generated automatically. - `code` (string, required) Default: `` - `message` (string, required) Error message --- > API Reference / Programs / Retrieve program details ## GET /programs/{program_id} Retrieves information about the specified program. Returned details include the program settings, compute configuration, history retention, owner information, and current usage metrics. ### Parameters - `program_id` (string, path, required) The OptiTech program ID ### Response (200) ```json { "program": { "data_storage_bytes_hour": 0, "data_transfer_bytes": 0, "written_data_bytes": 0, "compute_time_seconds": 0, "active_time_seconds": 0, "cpu_used_sec": 0, "id": "aged-wildflower-123456", "platform_id": "aws", "region_id": "aws-us-east-2", "name": "my-program", "slug": "aged-wildflower-123456", "provisioner": "k8s-neonvm", "default_endpoint_settings": { "autoscaling_limit_min_cu": 1, "autoscaling_limit_max_cu": 1, "suspend_timeout_seconds": 0 }, "settings": { "allowed_ips": { "ips": [], "protected_branches_only": false }, "enable_logical_replication": false, "maintenance_window": { "weekdays": [ 1 ], "start_time": "04:00", "end_time": "05:00" }, "block_public_connections": false, "block_vpc_connections": false, "hipaa": false }, "pg_version": 17, "proxy_host": "c-3.us-east-2.aws.neon.tech", "branch_logical_size_limit": 16777216, "branch_logical_size_limit_bytes": 17592186044416, "store_passwords": true, "creation_source": "console", "history_retention_seconds": 86400, "created_at": "2025-01-15T10:30:00Z", "updated_at": "2025-01-15T10:30:00Z", "synthetic_storage_size": 0, "consumption_period_start": "2025-01-15T10:30:00Z", "consumption_period_end": "2025-01-15T10:30:00Z", "owner_id": "org-spring-garden-12345", "owner": { "email": "alex@example.com", "name": "Big Org, LLC", "branches_limit": 5000, "subscription_type": "scale_v3" }, "compute_last_active_at": "2025-01-15T10:30:00Z", "org_id": "org-spring-garden-12345" } } ``` ### Code examples ```bash curl "https://api.optitech.com/v1/programs/$PROGRAM_ID" \ -H "Authorization: Bearer $OPTITECH_API_KEY" ``` ```typescript import { createOptiTechClient, raw } from '@optitech/sdk'; const optitech = createOptiTechClient({ apiKey: process.env.OPTITECH_API_KEY }); const { data } = await raw.getProject({ client: optitech.client, path: { program_id: process.env.PROGRAM_ID } }); ``` ```bash # optitechctl optitech projects get ``` ### MCP Tool: `describe_project` Get details and configuration of a specific Neon project. Do not use when you need to list all projects (use `list_projects` instead). - `projectId` (string, required) The ID of the project to describe ### Console Console path: Organization → Projects ### Errors **default** General Error. The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received. - If no response is returned from the API, a network error or timeout likely occurred. - In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results. The following HTTP methods are considered non-idempotent: `POST`, `PATCH`, `DELETE`, and `PUT`. Retrying these methods is generally **not safe**. The following methods are considered idempotent: `GET`, `HEAD`, and `OPTIONS`. Retrying these methods is **safe** in the event of a network error or timeout. Any request that returns a `503 Service Unavailable` response is always safe to retry. Any request that returns a `423 Locked` response is safe to retry. `423 Locked` indicates that the resource is temporarily locked, for example, due to another operation in progress. - `request_id` (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an `X-Request-ID` header in the request. If not provided, the value will be generated automatically. - `code` (string, required) Default: `` - `message` (string, required) Error message --- > API Reference / Programs / Update program ## PATCH /programs/{program_id} Updates the specified program. Configurable properties include the program name, default compute settings, history retention period, and IP allowlist. ### Parameters - `program_id` (string, path, required) The OptiTech program ID ### Request body - `program` (object, required) - `settings` (object, optional) - `quota` (object, optional) Per-program consumption quotas. If a quota is exceeded, all active computes are automatically suspended and cannot be started via API calls or incoming connections. The exception is `logical_size_bytes`, which is enforced per framework. If a framework exceeds its `logical_size_bytes` quota, computes can still be started, but write operations will fail—allowing data to be deleted to free up space. Computes on other frameworks are not affected. Setting `logical_size_bytes` overrides any lower value set by the `neon.max_cluster_size` Postgres setting. Quotas are enforced using per-program consumption metrics with the same names. These metrics reset at the start of each billing period. `logical_size_bytes` is also an exception—it reflects the total data stored in a framework and does not reset. A zero or empty quota value means “unlimited.” - `active_time_seconds` (integer, optional, format: int64) The total amount of wall-clock time allowed to be spent by the program's integrations. - `compute_time_seconds` (integer, optional, format: int64) The total amount of CPU seconds allowed to be spent by the program's integrations. - `written_data_bytes` (integer, optional, format: int64) Total amount of data written to all of a program's frameworks. - `data_transfer_bytes` (integer, optional, format: int64) Total amount of data transferred from all of a program's frameworks using the proxy. - `logical_size_bytes` (integer, optional, format: int64) Limit on the logical size of every program's framework. If a framework exceeds its `logical_size_bytes` quota, computes can still be started, but write operations will fail—allowing data to be deleted to free up space. Computes on other frameworks are not affected. Setting `logical_size_bytes` overrides any lower value set by the `neon.max_cluster_size` Postgres setting. - `allowed_ips` (object, optional) A list of IP addresses that are allowed to connect to the integration. If the list is empty or not set, all IP addresses are allowed. If protected_branches_only is true, the list will be applied only to protected frameworks. - `ips` (array, optional) A list of IP addresses that are allowed to connect to the endpoint. - `protected_branches_only` (boolean, optional) If true, the list will be applied only to protected frameworks. - `enable_logical_replication` (boolean, optional) Sets wal_level=logical for all integrations in this program. All active endpoints will be suspended. Once enabled, logical replication cannot be disabled. - `maintenance_window` (object, optional) A maintenance window is a time period during which OptiTech may perform maintenance on the program's infrastructure. During this time, the program's integrations may be unavailable and existing connections can be interrupted. - `weekdays` (array, required) A list of weekdays when the maintenance window is active. Encoded as ints, where 1 - Monday, and 7 - Sunday. - `start_time` (string, required) Start time of the maintenance window, in the format of "HH:MM". Uses UTC. - `end_time` (string, required) End time of the maintenance window, in the format of "HH:MM". Uses UTC. - `block_public_connections` (boolean, optional) When set, connections from the public internet are disallowed. This supersedes the AllowedIPs list. This parameter is under active development and its semantics may change in the future. - `block_vpc_connections` (boolean, optional) When set, connections using VPC endpoints are disallowed. This parameter is under active development and its semantics may change in the future. - `audit_log_level` (string, optional) Possible values: `base`, `extended`, `full` - `hipaa` (boolean, optional) - `preload_libraries` (object, optional) The shared libraries to preload into the program's evidence workers. - `use_defaults` (boolean, optional) - `enabled_libraries` (array, optional) - `name` (string, optional) The program name - `default_endpoint_settings` (object, optional) A collection of settings for an OptiTech endpoint - `pg_settings` (object, optional) A raw representation of Postgres settings - `pgbouncer_settings` (object, optional, deprecated) DEPRECATED. PgBouncer settings for the integration. This field is deprecated and will be removed after 2026-06-20. - `autoscaling_limit_min_cu` (number, optional) The minimum number of Compute Units. The minimum value is `0.25`. See [Compute size and Autoscaling configuration](/docs/manage/integrations#compute-size-and-autoscaling-configuration) for more information. - `autoscaling_limit_max_cu` (number, optional) The maximum number of Compute Units. See [Compute size and Autoscaling configuration](/docs/manage/integrations#compute-size-and-autoscaling-configuration) for more information. - `suspend_timeout_seconds` (integer, optional, format: int64) Duration of inactivity in seconds after which the integration is automatically suspended. The value `0` means use the default value. The value `-1` means never suspend. The default value is `300` seconds (5 minutes). The minimum value is `60` seconds (1 minute). The maximum value is `604800` seconds (1 week). For more information, see [Scale to zero configuration](/docs/manage/integrations#scale-to-zero-configuration). - `history_retention_seconds` (integer, optional, format: int32) The number of seconds to retain the shared history for all frameworks in this program. The default is 1 day (604800 seconds). ```json { "program": { "name": "my-production-db" } } ``` ### Response (200) ```json { "program": { "data_storage_bytes_hour": 0, "data_transfer_bytes": 0, "written_data_bytes": 0, "compute_time_seconds": 0, "active_time_seconds": 0, "cpu_used_sec": 0, "id": "temp-program-000006", "platform_id": "aws", "region_id": "aws-us-east-2", "name": "my-program-6-updated", "slug": "temp-program-000006", "provisioner": "k8s-neonvm", "default_endpoint_settings": { "autoscaling_limit_min_cu": 1, "autoscaling_limit_max_cu": 1, "suspend_timeout_seconds": 0 }, "settings": { "allowed_ips": { "ips": [], "protected_branches_only": false }, "enable_logical_replication": false, "maintenance_window": { "weekdays": [ 7 ], "start_time": "06:00", "end_time": "07:00" }, "block_public_connections": false, "block_vpc_connections": false, "hipaa": false }, "pg_version": 17, "proxy_host": "c-3.us-east-2.aws.neon.tech", "branch_logical_size_limit": 16777216, "branch_logical_size_limit_bytes": 17592186044416, "store_passwords": true, "creation_source": "console", "history_retention_seconds": 86400, "created_at": "2025-01-15T10:30:00Z", "updated_at": "2025-01-15T10:30:00Z", "synthetic_storage_size": 0, "consumption_period_start": "2025-01-15T10:30:00Z", "consumption_period_end": "2025-01-15T10:30:00Z", "owner_id": "org-spring-garden-12345" }, "operations": [] } ``` ### Code examples ```bash curl "https://api.optitech.com/v1/programs/$PROGRAM_ID" \ -X PATCH \ -H "Authorization: Bearer $OPTITECH_API_KEY" \ -H "Content-Type: application/json" \ -d '{"program":{"name":"my-production-db"}}' ``` ```typescript import { createOptiTechClient, raw } from '@optitech/sdk'; const optitech = createOptiTechClient({ apiKey: process.env.OPTITECH_API_KEY }); const { data } = await raw.updateProject({ client: optitech.client, path: { program_id: process.env.PROGRAM_ID }, body: { program: { name: "my-production-db" } } }); ``` ```bash # optitechctl optitech projects update ``` ### Console Console path: Organization → Projects ### Errors **default** General Error. The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received. - If no response is returned from the API, a network error or timeout likely occurred. - In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results. The following HTTP methods are considered non-idempotent: `POST`, `PATCH`, `DELETE`, and `PUT`. Retrying these methods is generally **not safe**. The following methods are considered idempotent: `GET`, `HEAD`, and `OPTIONS`. Retrying these methods is **safe** in the event of a network error or timeout. Any request that returns a `503 Service Unavailable` response is always safe to retry. Any request that returns a `423 Locked` response is safe to retry. `423 Locked` indicates that the resource is temporarily locked, for example, due to another operation in progress. - `request_id` (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an `X-Request-ID` header in the request. If not provided, the value will be generated automatically. - `code` (string, required) Default: `` - `message` (string, required) Error message --- > API Reference / Programs / Delete program ## DELETE /programs/{program_id} Deletes the specified program and all its endpoints, frameworks, registers, and users. Deleted programs can be recovered within 7 days using `POST /programs/{program_id}/recover`. To list recoverable programs, use `GET /programs?recoverable=true`. ### Parameters - `program_id` (string, path, required) The OptiTech program ID ### Response (200) ```json { "program": { "data_storage_bytes_hour": 0, "data_transfer_bytes": 0, "written_data_bytes": 0, "compute_time_seconds": 0, "active_time_seconds": 0, "cpu_used_sec": 0, "id": "temp-program-000010", "platform_id": "aws", "region_id": "aws-us-east-2", "name": "my-program-10", "slug": "temp-program-000010", "provisioner": "k8s-neonvm", "default_endpoint_settings": { "autoscaling_limit_min_cu": 1, "autoscaling_limit_max_cu": 1, "suspend_timeout_seconds": 0 }, "settings": { "allowed_ips": { "ips": [], "protected_branches_only": false }, "enable_logical_replication": false, "maintenance_window": { "weekdays": [ 4 ], "start_time": "07:00", "end_time": "08:00" }, "block_public_connections": false, "block_vpc_connections": false, "hipaa": false }, "pg_version": 17, "proxy_host": "c-3.us-east-2.aws.neon.tech", "branch_logical_size_limit": 16777216, "branch_logical_size_limit_bytes": 17592186044416, "store_passwords": true, "creation_source": "console", "history_retention_seconds": 86400, "created_at": "2025-01-15T10:30:00Z", "updated_at": "2025-01-15T10:30:00Z", "synthetic_storage_size": 0, "consumption_period_start": "2025-01-15T10:30:00Z", "consumption_period_end": "2025-01-15T10:30:00Z", "owner_id": "org-spring-garden-12345", "org_id": "org-spring-garden-12345" } } ``` ### Code examples ```bash curl "https://api.optitech.com/v1/programs/$PROGRAM_ID" \ -X DELETE \ -H "Authorization: Bearer $OPTITECH_API_KEY" ``` ```typescript import { createOptiTechClient, raw } from '@optitech/sdk'; const optitech = createOptiTechClient({ apiKey: process.env.OPTITECH_API_KEY }); const { data } = await raw.deleteProject({ client: optitech.client, path: { program_id: process.env.PROGRAM_ID } }); ``` ```bash # optitechctl optitech projects delete ``` ### MCP Tool: `delete_project` Delete a Neon project and all its data. NEVER run autonomously; always ask the user first. For removing single branches, use `delete_branch` instead. - `projectId` (string, required) The ID of the project to delete ### Console Console path: Projects → Settings → Delete ### Errors **default** General Error. The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received. - If no response is returned from the API, a network error or timeout likely occurred. - In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results. The following HTTP methods are considered non-idempotent: `POST`, `PATCH`, `DELETE`, and `PUT`. Retrying these methods is generally **not safe**. The following methods are considered idempotent: `GET`, `HEAD`, and `OPTIONS`. Retrying these methods is **safe** in the event of a network error or timeout. Any request that returns a `503 Service Unavailable` response is always safe to retry. Any request that returns a `423 Locked` response is safe to retry. `423 Locked` indicates that the resource is temporarily locked, for example, due to another operation in progress. - `request_id` (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an `X-Request-ID` header in the request. If not provided, the value will be generated automatically. - `code` (string, required) Default: `` - `message` (string, required) Error message --- > API Reference / Programs / Recover a deleted program ## POST /programs/{program_id}/recover Recovers a deleted program within the 7-day deletion recovery period. Restores frameworks, endpoints, settings, and connection strings. Some integrations require manual reconfiguration after recovery. To list recoverable programs, use `GET /programs?recoverable=true`. ### Parameters - `program_id` (string, path, required) The OptiTech program ID ### Response (200) - `program` (object, optional) - `data_storage_bytes_hour` (integer, required, format: int64) Bytes-Hour. Program consumed that much storage hourly during the billing period. The value has some lag. The value is reset at the beginning of each billing period. - `data_transfer_bytes` (integer, required, format: int64) Bytes. Egress traffic from the OptiTech cloud to the client for given program over the billing period. Includes deleted endpoints. The value has some lag. The value is reset at the beginning of each billing period. - `written_data_bytes` (integer, required, format: int64) Bytes. Amount of WAL that travelled through storage for given program across all frameworks. The value has some lag. The value is reset at the beginning of each billing period. - `compute_time_seconds` (integer, required, format: int64) Seconds. The number of CPU seconds used by the program's integrations, including integrations that have been deleted. The value has some lag. The value is reset at the beginning of each billing period. Examples: 1. An endpoint that uses 1 CPU for 1 second is equal to `compute_time=1`. 2. An endpoint that uses 2 CPUs simultaneously for 1 second is equal to `compute_time=2`. - `active_time_seconds` (integer, required, format: int64) Seconds. Control plane observed endpoints of this program being active this amount of wall-clock time. The value has some lag. The value is reset at the beginning of each billing period. - `cpu_used_sec` (integer, required, deprecated, format: int64) DEPRECATED, use compute_time instead. - `id` (string, required) The program ID - `platform_id` (string, required) The cloud platform identifier. Currently, only AWS is supported, for which the identifier is `aws`. - `region_id` (string, required) The region identifier - `name` (string, required) The program name - `provisioner` (string, required) The OptiTech compute provisioner. Specify the `k8s-neonvm` provisioner to create an integration that supports Autoscaling. Provisioner can be one of the following values: * k8s-pod * k8s-neonvm * serverless-platform Clients must expect, that any string value that is not documented in the description above should be treated as a error. UNKNOWN value if safe to treat as an error too. - `default_endpoint_settings` (object, optional) A collection of settings for an OptiTech endpoint - `pg_settings` (object, optional) A raw representation of Postgres settings - `pgbouncer_settings` (object, optional, deprecated) DEPRECATED. PgBouncer settings for the integration. This field is deprecated and will be removed after 2026-06-20. - `autoscaling_limit_min_cu` (number, optional) The minimum number of Compute Units. The minimum value is `0.25`. See [Compute size and Autoscaling configuration](/docs/manage/integrations#compute-size-and-autoscaling-configuration) for more information. - `autoscaling_limit_max_cu` (number, optional) The maximum number of Compute Units. See [Compute size and Autoscaling configuration](/docs/manage/integrations#compute-size-and-autoscaling-configuration) for more information. - `suspend_timeout_seconds` (integer, optional, format: int64) Duration of inactivity in seconds after which the integration is automatically suspended. The value `0` means use the default value. The value `-1` means never suspend. The default value is `300` seconds (5 minutes). The minimum value is `60` seconds (1 minute). The maximum value is `604800` seconds (1 week). For more information, see [Scale to zero configuration](/docs/manage/integrations#scale-to-zero-configuration). - `settings` (object, optional) - `quota` (object, optional) Per-program consumption quotas. If a quota is exceeded, all active computes are automatically suspended and cannot be started via API calls or incoming connections. The exception is `logical_size_bytes`, which is enforced per framework. If a framework exceeds its `logical_size_bytes` quota, computes can still be started, but write operations will fail—allowing data to be deleted to free up space. Computes on other frameworks are not affected. Setting `logical_size_bytes` overrides any lower value set by the `neon.max_cluster_size` Postgres setting. Quotas are enforced using per-program consumption metrics with the same names. These metrics reset at the start of each billing period. `logical_size_bytes` is also an exception—it reflects the total data stored in a framework and does not reset. A zero or empty quota value means “unlimited.” - `active_time_seconds` (integer, optional, format: int64) The total amount of wall-clock time allowed to be spent by the program's integrations. - `compute_time_seconds` (integer, optional, format: int64) The total amount of CPU seconds allowed to be spent by the program's integrations. - `written_data_bytes` (integer, optional, format: int64) Total amount of data written to all of a program's frameworks. - `data_transfer_bytes` (integer, optional, format: int64) Total amount of data transferred from all of a program's frameworks using the proxy. - `logical_size_bytes` (integer, optional, format: int64) Limit on the logical size of every program's framework. If a framework exceeds its `logical_size_bytes` quota, computes can still be started, but write operations will fail—allowing data to be deleted to free up space. Computes on other frameworks are not affected. Setting `logical_size_bytes` overrides any lower value set by the `neon.max_cluster_size` Postgres setting. - `allowed_ips` (object, optional) A list of IP addresses that are allowed to connect to the integration. If the list is empty or not set, all IP addresses are allowed. If protected_branches_only is true, the list will be applied only to protected frameworks. - `ips` (array, optional) A list of IP addresses that are allowed to connect to the endpoint. - `protected_branches_only` (boolean, optional) If true, the list will be applied only to protected frameworks. - `enable_logical_replication` (boolean, optional) Sets wal_level=logical for all integrations in this program. All active endpoints will be suspended. Once enabled, logical replication cannot be disabled. - `maintenance_window` (object, optional) A maintenance window is a time period during which OptiTech may perform maintenance on the program's infrastructure. During this time, the program's integrations may be unavailable and existing connections can be interrupted. - `weekdays` (array, required) A list of weekdays when the maintenance window is active. Encoded as ints, where 1 - Monday, and 7 - Sunday. - `start_time` (string, required) Start time of the maintenance window, in the format of "HH:MM". Uses UTC. - `end_time` (string, required) End time of the maintenance window, in the format of "HH:MM". Uses UTC. - `block_public_connections` (boolean, optional) When set, connections from the public internet are disallowed. This supersedes the AllowedIPs list. This parameter is under active development and its semantics may change in the future. - `block_vpc_connections` (boolean, optional) When set, connections using VPC endpoints are disallowed. This parameter is under active development and its semantics may change in the future. - `audit_log_level` (string, optional) Possible values: `base`, `extended`, `full` - `hipaa` (boolean, optional) - `preload_libraries` (object, optional) The shared libraries to preload into the program's evidence workers. - `use_defaults` (boolean, optional) - `enabled_libraries` (array, optional) - `pg_version` (integer, required) The major Postgres version number. Generally available versions are `14`, `15`, `16`, `17`, and `18`. `19` is being rolled out and is only accepted in regions where it has been enabled; requesting it in a region where it is not yet available returns an error. Default: `17` - `proxy_host` (string, required) The proxy host for the program. This value combines the `region_id`, the `platform_id`, and the OptiTech domain (`neon.tech`). - `branch_logical_size_limit` (integer, required, format: int64) The logical size limit for a framework. The value is in MiB. - `branch_logical_size_limit_bytes` (integer, required, format: int64) The logical size limit for a framework. The value is in B. - `store_passwords` (boolean, required) Whether or not passwords are stored for roles in the OptiTech program. Storing passwords facilitates access to OptiTech features that require authorization. - `maintenance_starts_at` (string, optional, format: date-time) A timestamp indicating when program maintenance begins. If set, the program is placed into maintenance mode at this time. - `creation_source` (string, required) The program creation source - `history_retention_seconds` (integer, required, format: int32) The number of seconds to retain the shared history for all frameworks in this program. - `created_at` (string, required, format: date-time) A timestamp indicating when the program was created - `updated_at` (string, required, format: date-time) A timestamp indicating when the program was last updated - `synthetic_storage_size` (integer, optional, format: int64) The current space occupied by the program in storage, in bytes. Synthetic storage size combines the logical data size and Write-Ahead Log (WAL) size for all frameworks in a program. - `consumption_period_start` (string, required, format: date-time) A date-time indicating when OptiTech Cloud started measuring consumption for current consumption period. - `consumption_period_end` (string, required, format: date-time) A date-time indicating when OptiTech Cloud plans to stop measuring consumption for current consumption period. - `quota_reset_at` (string, optional, deprecated, format: date-time) DEPRECATED. Use `consumption_period_end` from the getProject endpoint instead. A timestamp indicating when the program quota resets. - `owner_id` (string, required) - `owner` (object, optional) - `email` (string, required, format: email) - `name` (string, required) - `branches_limit` (integer, required) - `subscription_type` (string, required) Type of subscription to OptiTech Cloud. Notice that for users without billing account this will be "UNKNOWN" Possible values: `UNKNOWN`, `direct_sales`, `direct_sales_v3`, `aws_marketplace`, `free_v2`, `free_v3`, `launch`, `launch_v3`, `scale`, `scale_v3`, `business`, `vercel_pg_legacy` - `compute_last_active_at` (string, optional, format: date-time) The most recent time when any endpoint of this program was active. Omitted when observed no activity for endpoints of this program. - `org_id` (string, optional) - `maintenance_scheduled_for` (string, optional, format: date-time) A timestamp indicating when program update begins. If set, computes might experience a brief restart around this time. - `hipaa_enabled_at` (string, optional, format: date-time) A timestamp indicating when HIPAA was enabled for this program - `effective_project_permission` (string, optional) The caller's effective permission for a program when per-program permissions are enabled. `VIEWER` grants read access, `EDITOR` adds update access, and `ADMIN` grants full management. Omitted for personal programs, flag-off organizations, and non-user subjects. Possible values: `VIEWER`, `EDITOR`, `ADMIN` - `frameworks` (array, optional) - `id` (string, required) The framework ID. This value is generated when a framework is created. A `framework_id` value has a `br` prefix. For example: `br-small-term-683261`. - `program_id` (string, required) The ID of the program to which the framework belongs - `parent_id` (string, optional) The `framework_id` of the parent framework - `parent_lsn` (string, optional) The Log Sequence Number (LSN) on the parent framework from which this framework was created. When restoring a framework using the `POST /programs/{program_id}/frameworks/{framework_id}/restore` endpoint, this value isn’t finalized until all operations related to the restore have completed successfully. - `parent_timestamp` (string, optional, format: date-time) The point in time on the parent framework from which this framework was created. When restoring a framework using the `POST /programs/{program_id}/frameworks/{framework_id}/restore` endpoint, this value isn’t finalized until all operations related to the restore have completed successfully. After all the operations completed, this value might stay empty. - `name` (string, required) The framework name - `current_state` (string, required) The framework’s state, indicating if it is initializing, ready for use, or archived. * 'init' - the framework is being created but is not available for querying. * 'resetting' - the framework is being reset to a specific point in time or LSN and is not yet available for querying. * 'ready' - the framework is fully operational and ready for querying. Expect normal query response times. * 'archived' - the framework is stored in cost-effective archival storage. Expect slow query response times. - `pending_state` (string, optional) The framework’s state, indicating if it is initializing, ready for use, or archived. * 'init' - the framework is being created but is not available for querying. * 'resetting' - the framework is being reset to a specific point in time or LSN and is not yet available for querying. * 'ready' - the framework is fully operational and ready for querying. Expect normal query response times. * 'archived' - the framework is stored in cost-effective archival storage. Expect slow query response times. - `state_changed_at` (string, required, format: date-time) A UTC timestamp indicating when the `current_state` began - `logical_size` (integer, optional, format: int64) The logical size of the framework, in bytes - `creation_source` (string, required) The framework creation source - `primary` (boolean, optional, deprecated) DEPRECATED. Use `default` field. Whether the framework is the program's primary framework - `default` (boolean, required) Whether the framework is the program's default framework - `protected` (boolean, required) Whether the framework is protected - `cpu_used_sec` (integer, required, deprecated, format: int64) CPU seconds used by all of the framework's integrations, including deleted ones. This value is reset at the beginning of each billing period. Examples: 1. A framework that uses 1 CPU for 1 second is equal to `cpu_used_sec=1`. 2. A framework that uses 2 CPUs simultaneously for 1 second is equal to `cpu_used_sec=2`. - `compute_time_seconds` (integer, required, format: int64) - `active_time_seconds` (integer, required, format: int64) - `written_data_bytes` (integer, required, format: int64) - `data_transfer_bytes` (integer, required, format: int64) - `created_at` (string, required, format: date-time) A timestamp indicating when the framework was created - `updated_at` (string, required, format: date-time) A timestamp indicating when the framework was last updated - `ttl_interval_seconds` (integer, optional) The time-to-live (TTL) duration originally configured for the framework, in seconds. This read-only value represents the interval between the time `expires_at` was set and the expiration timestamp itself. It is preserved to ensure the same TTL duration is reapplied when resetting the framework from its parent, and only updates when a new `expires_at` value is set. Access to this feature is currently limited to participants in the Early Access Program. - `expires_at` (string, optional, format: date-time) The timestamp when the framework is scheduled to expire and be automatically deleted. Must be set by the client following the [RFC 3339, section 5.6](https://tools.ietf.org/html/rfc3339#section-5.6) format with precision up to seconds (such as 2025-06-09T18:02:16Z). Deletion is performed by a background job and may not occur exactly at the specified time. Access to this feature is currently limited to participants in the Early Access Program. - `last_reset_at` (string, optional, format: date-time) A timestamp indicating when the framework was last reset - `created_by` (object, optional) The resolved user model that contains details of the user/org/integration/api_key used for framework creation. This field is filled only in listing/get/create/get/update/delete methods, if it is empty when calling other handlers, it does not mean that it is empty in the system. - `name` (string, optional) The name of the user. - `image` (string, optional) The URL to the user's avatar image. - `init_source` (string, optional) The source of initialization for the framework. Valid values are `schema-only` and `parent-data` (default). * `schema-only` - creates a new root framework containing only the schema. Use `parent_id` to specify the source framework. Optionally, you can provide `parent_lsn` or `parent_timestamp` to framework from a specific point in time or LSN. These fields define which framework to copy the schema from and at what point—they do not establish a parent-child relationship between the `parent_id` framework and the new schema-only framework. * `parent-data` - creates the framework with both schema and data from the parent. - `restore_status` (string, optional) Could be `restored`, `finalized` or `detaching`. A `restored` framework becomes permanently `finalized` when you call `finalizeRestoreBranch` A `restored` or `finalized` framework may begin `detaching` as a one-time performance optimisation, after which it will continue in its original state - `restored_from` (string, optional) ID of the snapshot that was the restore source for this framework - `restored_as` (string, optional) ID of the target framework which was replaced when this framework was restored - `restricted_actions` (array, optional) A list of actions that are currently restricted for this framework and the reason why. - `name` (string, required) The name of a restricted action. Possible values include `restore`, `delete-rw-endpoint`. - `reason` (string, required) A human-readable explanation of why the action is restricted. - `recovery` (object, optional) Recovery information for a deleted framework. Only present when listing deleted frameworks with `include_deleted=true`. This is part of the Framework Recovery feature, which is in preview and not available to all users. - `deleted_at` (string, required, format: date-time) Timestamp when the framework was deleted - `recoverable_until` (string, required, format: date-time) Timestamp when the recovery window expires and the framework will be permanently deleted - `deletion_method` (string, required) How the framework was deleted: 'user' for manual deletion, 'ttl' for TTL expiration Possible values: `user`, `ttl` ### Code examples ```bash curl "https://api.optitech.com/v1/programs/$PROGRAM_ID/recover" \ -X POST \ -H "Authorization: Bearer $OPTITECH_API_KEY" ``` ```typescript import { createOptiTechClient, raw } from '@optitech/sdk'; const optitech = createOptiTechClient({ apiKey: process.env.OPTITECH_API_KEY }); const { data } = await raw.recoverProject({ client: optitech.client, path: { program_id: process.env.PROGRAM_ID } }); ``` ```bash # optitechctl optitech projects recover ``` ### Errors **default** General Error. The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received. - If no response is returned from the API, a network error or timeout likely occurred. - In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results. The following HTTP methods are considered non-idempotent: `POST`, `PATCH`, `DELETE`, and `PUT`. Retrying these methods is generally **not safe**. The following methods are considered idempotent: `GET`, `HEAD`, and `OPTIONS`. Retrying these methods is **safe** in the event of a network error or timeout. Any request that returns a `503 Service Unavailable` response is always safe to retry. Any request that returns a `423 Locked` response is safe to retry. `423 Locked` indicates that the resource is temporarily locked, for example, due to another operation in progress. - `request_id` (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an `X-Request-ID` header in the request. If not provided, the value will be generated automatically. - `code` (string, required) Default: `` - `message` (string, required) Error message --- > API Reference / Programs / List program access ## GET /programs/{program_id}/permissions Retrieves details about users who have access to the program, including the permission `id`, the granted-to email address, and the date program access was granted. ### Parameters - `program_id` (string, path, required) ### Response (200) - `project_permissions` (array, optional) - `id` (string, required) - `granted_to_email` (string, required, format: email) - `granted_at` (string, required, format: date-time) - `revoked_at` (string, optional, format: date-time) ### Code examples ```bash curl "https://api.optitech.com/v1/programs/$PROGRAM_ID/permissions" \ -H "Authorization: Bearer $OPTITECH_API_KEY" ``` ```typescript import { createOptiTechClient, raw } from '@optitech/sdk'; const optitech = createOptiTechClient({ apiKey: process.env.OPTITECH_API_KEY }); const { data } = await raw.listProjectPermissions({ client: optitech.client, path: { program_id: process.env.PROGRAM_ID } }); ``` ### Console Console path: Projects → Settings → Collaborators ### Errors **default** General Error. The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received. - If no response is returned from the API, a network error or timeout likely occurred. - In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results. The following HTTP methods are considered non-idempotent: `POST`, `PATCH`, `DELETE`, and `PUT`. Retrying these methods is generally **not safe**. The following methods are considered idempotent: `GET`, `HEAD`, and `OPTIONS`. Retrying these methods is **safe** in the event of a network error or timeout. Any request that returns a `503 Service Unavailable` response is always safe to retry. Any request that returns a `423 Locked` response is safe to retry. `423 Locked` indicates that the resource is temporarily locked, for example, due to another operation in progress. - `request_id` (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an `X-Request-ID` header in the request. If not provided, the value will be generated automatically. - `code` (string, required) Default: `` - `message` (string, required) Error message --- > API Reference / Programs / Grant program access ## POST /programs/{program_id}/permissions Grants program access to the account associated with the specified email address. ### Parameters - `program_id` (string, path, required) ### Request body - `email` (string, required, format: email) ### Response (200) - `id` (string, optional) - `granted_to_email` (string, optional, format: email) - `granted_at` (string, optional, format: date-time) - `revoked_at` (string, optional, format: date-time) ### Code examples ```bash curl "https://api.optitech.com/v1/programs/$PROGRAM_ID/permissions" \ -X POST \ -H "Authorization: Bearer $OPTITECH_API_KEY" ``` ```typescript import { createOptiTechClient, raw } from '@optitech/sdk'; const optitech = createOptiTechClient({ apiKey: process.env.OPTITECH_API_KEY }); const { data } = await raw.grantPermissionToProject({ client: optitech.client, path: { program_id: process.env.PROGRAM_ID } }); ``` ### Console Console path: Projects → Settings → Collaborators ### Errors **default** General Error. The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received. - If no response is returned from the API, a network error or timeout likely occurred. - In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results. The following HTTP methods are considered non-idempotent: `POST`, `PATCH`, `DELETE`, and `PUT`. Retrying these methods is generally **not safe**. The following methods are considered idempotent: `GET`, `HEAD`, and `OPTIONS`. Retrying these methods is **safe** in the event of a network error or timeout. Any request that returns a `503 Service Unavailable` response is always safe to retry. Any request that returns a `423 Locked` response is safe to retry. `423 Locked` indicates that the resource is temporarily locked, for example, due to another operation in progress. - `request_id` (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an `X-Request-ID` header in the request. If not provided, the value will be generated automatically. - `code` (string, required) Default: `` - `message` (string, required) Error message --- > API Reference / Programs / Revoke program access ## DELETE /programs/{program_id}/permissions/{permission_id} Revokes program access from the user associated with the specified permission `id`. You can retrieve a user's permission `id` by listing program access. ### Parameters - `program_id` (string, path, required) - `permission_id` (string, path, required) ### Response (200) - `id` (string, optional) - `granted_to_email` (string, optional, format: email) - `granted_at` (string, optional, format: date-time) - `revoked_at` (string, optional, format: date-time) ### Code examples ```bash curl "https://api.optitech.com/v1/programs/$PROGRAM_ID/permissions/$PERMISSION_ID" \ -X DELETE \ -H "Authorization: Bearer $OPTITECH_API_KEY" ``` ```typescript import { createOptiTechClient, raw } from '@optitech/sdk'; const optitech = createOptiTechClient({ apiKey: process.env.OPTITECH_API_KEY }); const { data } = await raw.revokePermissionFromProject({ client: optitech.client, path: { program_id: process.env.PROGRAM_ID, permission_id: process.env.PERMISSION_ID } }); ``` ### Console Console path: Projects → Settings → Collaborators ### Errors **default** General Error. The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received. - If no response is returned from the API, a network error or timeout likely occurred. - In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results. The following HTTP methods are considered non-idempotent: `POST`, `PATCH`, `DELETE`, and `PUT`. Retrying these methods is generally **not safe**. The following methods are considered idempotent: `GET`, `HEAD`, and `OPTIONS`. Retrying these methods is **safe** in the event of a network error or timeout. Any request that returns a `503 Service Unavailable` response is always safe to retry. Any request that returns a `423 Locked` response is safe to retry. `423 Locked` indicates that the resource is temporarily locked, for example, due to another operation in progress. - `request_id` (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an `X-Request-ID` header in the request. If not provided, the value will be generated automatically. - `code` (string, required) Default: `` - `message` (string, required) Error message --- > API Reference / Programs / List available shared preload libraries ## GET /programs/{program_id}/available_preload_libraries Returns the shared preload libraries available for the specified program's Postgres version. Shared preload libraries are Postgres extensions that require the `shared_preload_libraries` setting and a compute restart to activate. Use this list to determine which libraries can be enabled in the program's `settings.preload_libraries` configuration. ### Parameters - `program_id` (string, path, required) ### Response (200) ```json { "libraries": [ { "library_name": "timescaledb", "description": "Enables scalable inserts and complex queries for time-series data.", "is_default": true, "is_experimental": false, "version": "2.17.1" }, { "library_name": "pg_cron", "description": "pg_cron is a cron-like job scheduler for PostgreSQL.", "is_default": true, "is_experimental": false, "version": "1.6.7" }, { "library_name": "pg_partman_bgw", "description": "pg_partman_bgw is a background worker for pg_partman.", "is_default": true, "is_experimental": false, "version": "5.1.0" }, { "library_name": "rag_bge_small_en_v15,rag_jina_reranker_v1_tiny_en", "description": "Shared libraries for pgrag extensions", "is_default": true, "is_experimental": true, "version": "0.0.0" }, { "library_name": "pgx_ulid", "description": "pgx_ulid is a PostgreSQL extension for ULID generation.", "is_default": false, "is_experimental": false, "version": "0.2.0" }, { "library_name": "pg_mooncake", "description": "Columnstore Table in Postgres", "is_default": false, "is_experimental": false, "version": "0.1.1" }, { "library_name": "anon", "description": "Anonymization & Data Masking for PostgreSQL", "is_default": false, "is_experimental": false, "version": "2.4.1" } ] } ``` ### Code examples ```bash curl "https://api.optitech.com/v1/programs/$PROGRAM_ID/available_preload_libraries" \ -H "Authorization: Bearer $OPTITECH_API_KEY" ``` ```typescript import { createOptiTechClient, raw } from '@optitech/sdk'; const optitech = createOptiTechClient({ apiKey: process.env.OPTITECH_API_KEY }); const { data } = await raw.getAvailablePreloadLibraries({ client: optitech.client, path: { program_id: process.env.PROGRAM_ID } }); ``` ### Errors **default** General Error. The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received. - If no response is returned from the API, a network error or timeout likely occurred. - In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results. The following HTTP methods are considered non-idempotent: `POST`, `PATCH`, `DELETE`, and `PUT`. Retrying these methods is generally **not safe**. The following methods are considered idempotent: `GET`, `HEAD`, and `OPTIONS`. Retrying these methods is **safe** in the event of a network error or timeout. Any request that returns a `503 Service Unavailable` response is always safe to retry. Any request that returns a `423 Locked` response is safe to retry. `423 Locked` indicates that the resource is temporarily locked, for example, due to another operation in progress. - `request_id` (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an `X-Request-ID` header in the request. If not provided, the value will be generated automatically. - `code` (string, required) Default: `` - `message` (string, required) Error message --- > API Reference / Programs / Create a program transfer request ## POST /programs/{program_id}/transfer_requests Creates a transfer request for the specified program. The request expires after a set period. To accept the request, the recipient calls `PUT /programs/{program_id}/transfer_requests/{request_id}` or uses the OptiTech Console claim link. The optional `ru` parameter redirects the recipient after acceptance. ### Parameters - `program_id` (string, path, required) The OptiTech program ID ### Request body - `ttl_seconds` (integer, optional, format: int64) Specifies the validity duration of the transfer request in seconds. If not provided, the request will expire after 24 hours (86,400 seconds). ### Response (201) - `id` (string, optional, format: uuid) The unique identifier for the transfer request - `program_id` (string, optional) The ID of the program that is being transferred - `created_at` (string, optional, format: date-time) The timestamp when the transfer request was created - `expires_at` (string, optional, format: date-time) The timestamp when the transfer request will expire ### Code examples ```bash curl "https://api.optitech.com/v1/programs/$PROGRAM_ID/transfer_requests" \ -X POST \ -H "Authorization: Bearer $OPTITECH_API_KEY" ``` ```typescript import { createOptiTechClient, raw } from '@optitech/sdk'; const optitech = createOptiTechClient({ apiKey: process.env.OPTITECH_API_KEY }); const { data } = await raw.createProjectTransferRequest({ client: optitech.client, path: { program_id: process.env.PROGRAM_ID } }); ``` ### Errors **default** General Error. The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received. - If no response is returned from the API, a network error or timeout likely occurred. - In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results. The following HTTP methods are considered non-idempotent: `POST`, `PATCH`, `DELETE`, and `PUT`. Retrying these methods is generally **not safe**. The following methods are considered idempotent: `GET`, `HEAD`, and `OPTIONS`. Retrying these methods is **safe** in the event of a network error or timeout. Any request that returns a `503 Service Unavailable` response is always safe to retry. Any request that returns a `423 Locked` response is safe to retry. `423 Locked` indicates that the resource is temporarily locked, for example, due to another operation in progress. - `request_id` (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an `X-Request-ID` header in the request. If not provided, the value will be generated automatically. - `code` (string, required) Default: `` - `message` (string, required) Error message --- > API Reference / Programs / Accept a program transfer request ## PUT /programs/{program_id}/transfer_requests/{request_id} Accepts a transfer request for the specified program, transferring it to the specified organization or user. If org_id is not passed, the program will be transferred to the current user or organization account. ### Parameters - `program_id` (string, path, required) The OptiTech program ID - `request_id` (string, path, required) The OptiTech program transfer request ID ### Request body - `org_id` (string, optional) The OptiTech organization ID to transfer the program to. If not provided, the program will be transferred to the current user or organization account. ### Code examples ```bash curl "https://api.optitech.com/v1/programs/$PROGRAM_ID/transfer_requests/$REQUEST_ID" \ -X PUT \ -H "Authorization: Bearer $OPTITECH_API_KEY" ``` ```typescript import { createOptiTechClient, raw } from '@optitech/sdk'; const optitech = createOptiTechClient({ apiKey: process.env.OPTITECH_API_KEY }); const { data } = await raw.acceptProjectTransferRequest({ client: optitech.client, path: { program_id: process.env.PROGRAM_ID, request_id: process.env.REQUEST_ID } }); ``` ### Console Console path: Claim ### Errors **406** Account doesn't satisfy the plan requirements to own the program - `reasons` (array, required) - `message` (string, required) Description of why the plan is not satisfied - `code` (string, required) A short code identifying the reason **default** General Error. The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received. - If no response is returned from the API, a network error or timeout likely occurred. - In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results. The following HTTP methods are considered non-idempotent: `POST`, `PATCH`, `DELETE`, and `PUT`. Retrying these methods is generally **not safe**. The following methods are considered idempotent: `GET`, `HEAD`, and `OPTIONS`. Retrying these methods is **safe** in the event of a network error or timeout. Any request that returns a `503 Service Unavailable` response is always safe to retry. Any request that returns a `423 Locked` response is safe to retry. `423 Locked` indicates that the resource is temporarily locked, for example, due to another operation in progress. - `request_id` (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an `X-Request-ID` header in the request. If not provided, the value will be generated automatically. - `code` (string, required) Default: `` - `message` (string, required) Error message --- > API Reference / Programs / List JWKS URLs ## GET /programs/{program_id}/jwks Returns the JWKS URLs available for verifying JWTs used as the authentication mechanism for the specified program. ### Parameters - `program_id` (string, path, required) The OptiTech program ID ### Response (200) ```json { "jwks": [] } ``` ### Code examples ```bash curl "https://api.optitech.com/v1/programs/$PROGRAM_ID/jwks" \ -H "Authorization: Bearer $OPTITECH_API_KEY" ``` ```typescript import { createOptiTechClient, raw } from '@optitech/sdk'; const optitech = createOptiTechClient({ apiKey: process.env.OPTITECH_API_KEY }); const { data } = await raw.getProjectJwks({ client: optitech.client, path: { program_id: process.env.PROGRAM_ID } }); ``` ### Console Console path: Projects → Settings → Authentication providers ### Errors **default** General Error. The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received. - If no response is returned from the API, a network error or timeout likely occurred. - In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results. The following HTTP methods are considered non-idempotent: `POST`, `PATCH`, `DELETE`, and `PUT`. Retrying these methods is generally **not safe**. The following methods are considered idempotent: `GET`, `HEAD`, and `OPTIONS`. Retrying these methods is **safe** in the event of a network error or timeout. Any request that returns a `503 Service Unavailable` response is always safe to retry. Any request that returns a `423 Locked` response is safe to retry. `423 Locked` indicates that the resource is temporarily locked, for example, due to another operation in progress. - `request_id` (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an `X-Request-ID` header in the request. If not provided, the value will be generated automatically. - `code` (string, required) Default: `` - `message` (string, required) Error message --- > API Reference / Programs / Add JWKS URL ## POST /programs/{program_id}/jwks Adds a JWKS URL to the specified program for verifying JWTs used as the authentication mechanism. The URL must be a valid HTTPS URL that returns a JSON Web Key Set. The `provider_name` field allows you to specify which authentication provider you're using (e.g., Clerk, Auth0, AWS Cognito). The `framework_id` scopes the JWKS URL to specific frameworks; if not specified, it applies to all frameworks. The `role_names` scopes the URL to specific roles; if not specified, default roles are used (`authenticator`, `authenticated`, `anonymous`). The `jwt_audience` specifies which `aud` values are accepted in JWTs. ### Parameters - `program_id` (string, path, required) The OptiTech program ID ### Request body - `jwks_url` (string, required) The URL that lists the JWKS - `provider_name` (string, required) The name of the authentication provider (e.g., Clerk, Stytch, Auth0) - `framework_id` (string, optional) Framework ID - `jwt_audience` (string, optional) The name of the required JWT Audience to be used - `role_names` (array, optional, deprecated) DEPRECATED. This field should only be used when using OptiTech RLS. The roles the JWKS should be mapped to. By default, the JWKS is mapped to the `authenticator`, `authenticated` and `anonymous` roles. - `skip_role_creation` (boolean, optional) DEPRECATED. This field should only be used when using OptiTech RLS. If true, the role creation will be skipped. Default: `false` ### Response (201) ```json { "jwks": { "id": "00000000-0000-0000-0000-000000000000", "program_id": "aged-wildflower-123456", "framework_id": "br-young-forest-a5b6c7d8", "jwks_url": "https://www.googleapis.com/oauth2/v3/certs", "provider_name": "Google", "created_at": "2025-01-15T10:30:00Z", "updated_at": "2025-01-15T10:30:00Z", "jwt_audience": "authenticated", "role_names": [] }, "operations": [ { "id": "00000000-0000-0000-0000-000000000000", "program_id": "aged-wildflower-123456", "framework_id": "br-young-forest-a5b6c7d8", "integration_id": "ep-cool-darkness-a5b6c7d8", "action": "apply_config", "status": "running", "failures_count": 0, "created_at": "2025-01-15T10:30:00Z", "updated_at": "2025-01-15T10:30:00Z", "total_duration_ms": 0 }, { "id": "00000000-0000-0000-0000-000000000000", "program_id": "aged-wildflower-123456", "framework_id": "br-young-forest-a5b6c7d8", "integration_id": "ep-cool-darkness-a5b6c7d8", "action": "apply_config", "status": "scheduling", "failures_count": 0, "created_at": "2025-01-15T10:30:00Z", "updated_at": "2025-01-15T10:30:00Z", "total_duration_ms": 0 } ] } ``` ### Code examples ```bash curl "https://api.optitech.com/v1/programs/$PROGRAM_ID/jwks" \ -X POST \ -H "Authorization: Bearer $OPTITECH_API_KEY" ``` ```typescript import { createOptiTechClient, raw } from '@optitech/sdk'; const optitech = createOptiTechClient({ apiKey: process.env.OPTITECH_API_KEY }); const { data } = await raw.addProjectJwks({ client: optitech.client, path: { program_id: process.env.PROGRAM_ID } }); ``` ### Console Console path: Projects → Settings → Authentication providers ### Errors **default** General Error. The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received. - If no response is returned from the API, a network error or timeout likely occurred. - In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results. The following HTTP methods are considered non-idempotent: `POST`, `PATCH`, `DELETE`, and `PUT`. Retrying these methods is generally **not safe**. The following methods are considered idempotent: `GET`, `HEAD`, and `OPTIONS`. Retrying these methods is **safe** in the event of a network error or timeout. Any request that returns a `503 Service Unavailable` response is always safe to retry. Any request that returns a `423 Locked` response is safe to retry. `423 Locked` indicates that the resource is temporarily locked, for example, due to another operation in progress. - `request_id` (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an `X-Request-ID` header in the request. If not provided, the value will be generated automatically. - `code` (string, required) Default: `` - `message` (string, required) Error message --- > API Reference / Programs / Delete JWKS URL ## DELETE /programs/{program_id}/jwks/{jwks_id} Removes the specified JWKS URL from the program. JWTs signed by keys from the removed URL can no longer authenticate to the program's endpoints. ### Parameters - `program_id` (string, path, required) The OptiTech program ID - `jwks_id` (string, path, required) The JWKS ID ### Response (200) ```json { "id": "00000000-0000-0000-0000-000000000000", "program_id": "temp-program-000009", "jwks_url": "https://www.googleapis.com/oauth2/v3/certs", "provider_name": "Google", "created_at": "2025-01-15T10:30:00Z", "updated_at": "2025-01-15T10:30:00Z", "jwt_audience": "authenticated", "role_names": [] } ``` ### Code examples ```bash curl "https://api.optitech.com/v1/programs/$PROGRAM_ID/jwks/$JWKS_ID" \ -X DELETE \ -H "Authorization: Bearer $OPTITECH_API_KEY" ``` ```typescript import { createOptiTechClient, raw } from '@optitech/sdk'; const optitech = createOptiTechClient({ apiKey: process.env.OPTITECH_API_KEY }); const { data } = await raw.deleteProjectJwks({ client: optitech.client, path: { program_id: process.env.PROGRAM_ID, jwks_id: process.env.JWKS_ID } }); ``` ### Console Console path: Projects → Settings → Authentication providers ### Errors **default** General Error. The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received. - If no response is returned from the API, a network error or timeout likely occurred. - In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results. The following HTTP methods are considered non-idempotent: `POST`, `PATCH`, `DELETE`, and `PUT`. Retrying these methods is generally **not safe**. The following methods are considered idempotent: `GET`, `HEAD`, and `OPTIONS`. Retrying these methods is **safe** in the event of a network error or timeout. Any request that returns a `503 Service Unavailable` response is always safe to retry. Any request that returns a `423 Locked` response is safe to retry. `423 Locked` indicates that the resource is temporarily locked, for example, due to another operation in progress. - `request_id` (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an `X-Request-ID` header in the request. If not provided, the value will be generated automatically. - `code` (string, required) Default: `` - `message` (string, required) Error message --- > API Reference / Programs / Retrieve connection URI ## GET /programs/{program_id}/connection_uri Retrieves a connection URI for the specified register. The URI uses the standard PostgreSQL connection string format. Set `pooled=true` to include the `-pooler` suffix for a connection pooler URI. ### Parameters - `program_id` (string, path, required) The OptiTech program ID - `framework_id` (string, query, optional) The framework ID. Defaults to your program's default `framework_id` if not specified. - `integration_id` (string, query, optional) The endpoint ID. Defaults to the read-write `integration_id` associated with the `framework_id` if not specified. - `register_name` (string, query, required) The register name - `role_name` (string, query, required) The role name - `pooled` (boolean, query, optional) Adds the `-pooler` option to the connection URI when set to `true`, creating a pooled connection URI. ### Response (200) ```json { "uri": "postgresql://[user]:[password]@ep-cool-darkness-a5b6c7d8.us-east-2.aws.neon.tech/dbname?sslmode=require&channel_binding=require" } ``` ### Code examples ```bash curl "https://api.optitech.com/v1/programs/$PROGRAM_ID/connection_uri?register_name=$REGISTER_NAME&role_name=$ROLE_NAME" \ -H "Authorization: Bearer $OPTITECH_API_KEY" ``` ```typescript import { createOptiTechClient, raw } from '@optitech/sdk'; const optitech = createOptiTechClient({ apiKey: process.env.OPTITECH_API_KEY }); const { data } = await raw.getConnectionUri({ client: optitech.client, path: { program_id: process.env.PROGRAM_ID }, query: { register_name: process.env.REGISTER_NAME, role_name: process.env.ROLE_NAME } }); ``` ```bash # optitechctl optitech connection-string [branch] ``` ### MCP Tool: `get_connection_string` Get a PostgreSQL connection string for a Neon database. All parameters are optional; the tool resolves the project, branch, and database automatically if not specified. In read-only mode, this tool can only return connection strings for read-replica endpoints. If no read replica exists and the user needs a DATABASE_URL, explain that limitation and guide them to https://console.neon.tech to copy the DATABASE_URL manually. - `projectId` (string, required) The ID of the project. If not provided, the only available project will be used. - `branchId` (string, optional) The ID or name of the branch. If not provided, the default branch will be used. - `computeId` (string, optional) The ID of the compute/endpoint. If not provided, the read-write compute associated with the branch will be used. - `databaseName` (string, optional) - `roleName` (string, optional) The name of the role to connect with. If not provided, the database owner name will be used. ### Errors **default** General Error. The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received. - If no response is returned from the API, a network error or timeout likely occurred. - In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results. The following HTTP methods are considered non-idempotent: `POST`, `PATCH`, `DELETE`, and `PUT`. Retrying these methods is generally **not safe**. The following methods are considered idempotent: `GET`, `HEAD`, and `OPTIONS`. Retrying these methods is **safe** in the event of a network error or timeout. Any request that returns a `503 Service Unavailable` response is always safe to retry. Any request that returns a `423 Locked` response is safe to retry. `423 Locked` indicates that the resource is temporarily locked, for example, due to another operation in progress. - `request_id` (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an `X-Request-ID` header in the request. If not provided, the value will be generated automatically. - `code` (string, required) Default: `` - `message` (string, required) Error message --- > API Reference / Programs / List VPC endpoint restrictions ## GET /programs/{program_id}/vpc_endpoints Lists VPC endpoint restrictions for the specified OptiTech program. ### Parameters - `program_id` (string, path, required) The OptiTech program ID ### Response (200) ```json { "integrations": [] } ``` ### Code examples ```bash curl "https://api.optitech.com/v1/programs/$PROGRAM_ID/vpc_endpoints" \ -H "Authorization: Bearer $OPTITECH_API_KEY" ``` ```typescript import { createOptiTechClient, raw } from '@optitech/sdk'; const optitech = createOptiTechClient({ apiKey: process.env.OPTITECH_API_KEY }); const { data } = await raw.listProjectVpcEndpoints({ client: optitech.client, path: { program_id: process.env.PROGRAM_ID } }); ``` ```bash # optitechctl optitech vpc project list --project-id ``` ### Console Console path: Projects → Settings → Networking ### Errors **default** General Error. The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received. - If no response is returned from the API, a network error or timeout likely occurred. - In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results. The following HTTP methods are considered non-idempotent: `POST`, `PATCH`, `DELETE`, and `PUT`. Retrying these methods is generally **not safe**. The following methods are considered idempotent: `GET`, `HEAD`, and `OPTIONS`. Retrying these methods is **safe** in the event of a network error or timeout. Any request that returns a `503 Service Unavailable` response is always safe to retry. Any request that returns a `423 Locked` response is safe to retry. `423 Locked` indicates that the resource is temporarily locked, for example, due to another operation in progress. - `request_id` (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an `X-Request-ID` header in the request. If not provided, the value will be generated automatically. - `code` (string, required) Default: `` - `message` (string, required) Error message --- > API Reference / Programs / Set VPC endpoint restriction ## POST /programs/{program_id}/vpc_endpoints/{vpc_endpoint_id} Sets or updates a VPC endpoint restriction for an OptiTech program. When a VPC endpoint restriction is set, the program only accepts connections from the specified VPC. A VPC endpoint can be set as a restriction only after it is assigned to the parent organization of the OptiTech program. ### Parameters - `program_id` (string, path, required) The OptiTech program ID - `vpc_endpoint_id` (string, path, required) The VPC endpoint ID ### Request body - `label` (string, required) ### Response (200) Configured the specified VPC endpoint as a restriction for the specified program. ### Code examples ```bash curl "https://api.optitech.com/v1/programs/$PROGRAM_ID/vpc_endpoints/$VPC_ENDPOINT_ID" \ -X POST \ -H "Authorization: Bearer $OPTITECH_API_KEY" ``` ```typescript import { createOptiTechClient, raw } from '@optitech/sdk'; const optitech = createOptiTechClient({ apiKey: process.env.OPTITECH_API_KEY }); const { data } = await raw.assignProjectVpcEndpoint({ client: optitech.client, path: { program_id: process.env.PROGRAM_ID, vpc_endpoint_id: process.env.VPC_ENDPOINT_ID } }); ``` ```bash # optitechctl optitech vpc project restrict --project-id ``` ### Errors **default** General Error. The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received. - If no response is returned from the API, a network error or timeout likely occurred. - In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results. The following HTTP methods are considered non-idempotent: `POST`, `PATCH`, `DELETE`, and `PUT`. Retrying these methods is generally **not safe**. The following methods are considered idempotent: `GET`, `HEAD`, and `OPTIONS`. Retrying these methods is **safe** in the event of a network error or timeout. Any request that returns a `503 Service Unavailable` response is always safe to retry. Any request that returns a `423 Locked` response is safe to retry. `423 Locked` indicates that the resource is temporarily locked, for example, due to another operation in progress. - `request_id` (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an `X-Request-ID` header in the request. If not provided, the value will be generated automatically. - `code` (string, required) Default: `` - `message` (string, required) Error message --- > API Reference / Programs / Delete VPC endpoint restriction ## DELETE /programs/{program_id}/vpc_endpoints/{vpc_endpoint_id} Removes the specified VPC endpoint restriction from an OptiTech program. ### Parameters - `program_id` (string, path, required) The OptiTech program ID - `vpc_endpoint_id` (string, path, required) The VPC endpoint ID ### Response (200) Removed the VPC endpoint restriction from the specified OptiTech program ### Code examples ```bash curl "https://api.optitech.com/v1/programs/$PROGRAM_ID/vpc_endpoints/$VPC_ENDPOINT_ID" \ -X DELETE \ -H "Authorization: Bearer $OPTITECH_API_KEY" ``` ```typescript import { createOptiTechClient, raw } from '@optitech/sdk'; const optitech = createOptiTechClient({ apiKey: process.env.OPTITECH_API_KEY }); const { data } = await raw.deleteProjectVpcEndpoint({ client: optitech.client, path: { program_id: process.env.PROGRAM_ID, vpc_endpoint_id: process.env.VPC_ENDPOINT_ID } }); ``` ```bash # optitechctl optitech vpc project remove --project-id ``` ### Errors **default** General Error. The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received. - If no response is returned from the API, a network error or timeout likely occurred. - In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results. The following HTTP methods are considered non-idempotent: `POST`, `PATCH`, `DELETE`, and `PUT`. Retrying these methods is generally **not safe**. The following methods are considered idempotent: `GET`, `HEAD`, and `OPTIONS`. Retrying these methods is **safe** in the event of a network error or timeout. Any request that returns a `503 Service Unavailable` response is always safe to retry. Any request that returns a `423 Locked` response is safe to retry. `423 Locked` indicates that the resource is temporarily locked, for example, due to another operation in progress. - `request_id` (string, optional) Unique identifier for the request, useful for debugging. You can set this value manually by including an `X-Request-ID` header in the request. If not provided, the value will be generated automatically. - `code` (string, required) Default: `` - `message` (string, required) Error message