- prorm documentation
- Known test gaps
- Architecture
- Core concepts
- Database types & coverage
- Getting started
- Going further
- compliance
- decorators
- diagrams
- dialects
- SQL dialects
- AlloyDB Dialect
- AlloyDB Omni Dialect
- Amazon Athena Dialect
- Aurora DSQL Dialect
- Amazon Aurora MySQL Dialect
- Amazon Aurora PostgreSQL Dialect
- Azure Database for MySQL Dialect
- Azure Database for PostgreSQL Dialect
- Azure SQL Database Dialect
- Azure SQL Managed Instance Dialect
- Google BigQuery Dialect
- Citus Dialect
- ClickHouse dialect
- Cloud Authentication (`cloud-auth`)
- Cloud SQL for SQL Server Dialect
- Cloud SQL for MySQL Dialect
- Cloud SQL for PostgreSQL Dialect
- CockroachDB Dialect
- Azure Cosmos DB for PostgreSQL Dialect
- CrateDB Dialect
- Cloudflare D1 Dialect
- Databricks dialect
- IBM Db2 Dialect
- Dolt Dialect
- Apache Doris Dialect
- Druid Dialect
- DuckDB Dialect
- Exasol dialect
- Microsoft Fabric Data Warehouse Dialect
- Firebird Dialect
- Greenplum Dialect
- SAP HANA Dialect
- MySQL HeatWave Dialect
- Azure Data Explorer (Kusto) Dialect — T-SQL
- MariaDB Dialect
- Materialize Dialect
- MonetDB Dialect
- MotherDuck Dialect
- Microsoft SQL Server Dialect
- MySQL Dialect
- Neon Dialect
- OceanBase Dialect
- openGauss Dialect
- Oracle Dialect
- Oracle Autonomous Database Dialect
- ParadeDB Dialect
- PolarDB Dialect
- PostgreSQL Dialect
- Presto Dialect
- QuestDB Dialect
- Aurora RDS Data API Dialect (`rdsdata`)
- Amazon RDS for Db2 Dialect
- Amazon RDS for MariaDB Dialect
- Amazon RDS for SQL Server Dialect
- Amazon RDS for MySQL Dialect
- Amazon RDS for Oracle Dialect
- Amazon RDS for PostgreSQL Dialect
- Amazon Redshift
- Amazon Redshift Data API Dialect
- RisingWave Dialect
- rqlite Dialect
- SingleStore Dialect
- Snowflake Dialect
- Google Cloud Spanner Dialect
- Spanner (PostgreSQL interface) Dialect
- SQLite Dialect
- StarRocks Dialect
- Supabase Dialect
- Azure Synapse Analytics (dedicated SQL pool)
- Teradata Dialect
- TiDB Dialect
- TimescaleDB Dialect
- Trino Dialect
- Turso / libSQL Dialect
- Vertica dialect
- Vitess Dialect
- Yellowbrick Dialect
- YugabyteDB Dialect
- guides
- Access rules and behaviour profiles
- ArangoDB (AQL)
- Associations
- Audit levels and escalation
- Audit logging
- In the browser
- Bulk operations
- Caching
- Capabilities, tiers and team roles
- CLI
- Cloudflare
- Compliance & data protection
- Connection Pooling & Performance
- Security in the console
- Couchbase: structured N1QL queries
- Data types
- Decorators
- Eager loading
- Enums and constants
- Error handling & error types
- Extensions
- External fields
- Foreign data wrappers
- Graph databases
- Hooks & lifecycle events
- Indexes & constraints
- InfluxDB: structured Flux pipelines
- klock-errors
- klock — the `.klock` file
- Local databases (`prorm db up`)
- Structured log search — Splunk, Graylog, Papertrail, Sumo Logic
- Logging
- Grafana Loki: structured LogQL queries
- MCP server
- Migrate — the data transfer subsystem
- Migrations & Schema Sync
- Models from an existing database
- Defining models
- Multiple databases
- OrientDB, Neptune and TigerGraph
- Passwords
- Importing a Prisma schema
- Structured PromQL and MetricsQL
- Query firewall
- QueryInterface
- Query operators reference
- Query optimization
- Composing find options with `pipe()` and `Q`
- Query safety: the fail-closed WHERE guard
- Querying
- Raw Queries & Query Building
- Read replicas
- Schema diffing & migration generation
- Views, triggers & other schema objects
- Scopes & default scopes
- Seeders
- SPARQL / RDF triplestores
- SQL constants
- SQL features
- SQL function builders
- SQLite advanced features
- StoreKey — a prod-orm database as the storage
- Streaming results
- Terraform
- Transactions & Isolation Levels
- Type mapping: legacy and modern
- TypeScript types
- Database users, roles & privileges
- Validation & constraints
- Virtual & Computed Fields
- Writing docs
- javascript
- runbooks
- running-databases
- Running databases in Docker
- Running prorm under Bun in Docker
- Running Cassandra in Docker with prorm
- Running ClickHouse in Docker with prorm
- Running CockroachDB in Docker with prorm
- Running prorm under Deno in Docker
- Running Elasticsearch in Docker with prorm
- Running MariaDB in Docker with prorm
- Running MongoDB in Docker with prorm
- prorm control plane
- Introduction
- Authentication
- Errors
- Getting started
- Account
- Security
- Sessions
- Everywhere this account is signed in
- Sign out everywhere else
- Sign one out
- A token for the CLI on a named machine
- A token for the customer console, from the staff one
- Park a sign-in for the CLI to collect
- The CLI collecting its sign-in
- The team's members' live sessions
- Sign a member's session out
- Sign an account out everywhere
- Everywhere the account is signed in
- Sign an account's session out
- Single sign-on
- Begin a single sign-on
- The provider's return
- Link the signed-in account to a team's provider
- Which team an address signs in to
- The team's single sign-on, as a member sees it
- Set the team's OpenID Connect provider up, or change it
- Remove the provider
- The team's domain claims and the DNS record each needs
- Prove a claimed domain
- MFA and passwords
- Klock
- Devices
- Your devices, or a team's
- Approve a new device's pairing code
- One device
- Rename a device
- Revoke a device
- Suspend a device
- Reinstate a suspended device
- Wipe a device
- Ask a device to rotate its key
- The team's members' devices
- Revoke a member's device
- An account's devices
- Revoke an account's device
- Wipe an account's device
- The device fleet
- Access rules and behaviour
- The access rules that bear on you
- Add an access rule
- This request, as the rules see it
- One access rule
- Remove an access rule
- The behaviour profiles that bear on you
- Add or change a behaviour profile
- The profile presets
- Your behaviour findings
- Acknowledge a finding
- One behaviour profile
- Remove a behaviour profile
- The team's access rules
- Add a team access rule
- Remove a team access rule
- The team's behaviour profiles
- Add or change a team behaviour profile
- Remove a team behaviour profile
- What the team's profiles caught
- Acknowledge a team finding
- Recovery and lockdown
- MCP tokens
- Kerberos
- Logging and monitoring
- Billing
- Plans and pricing
- Subscriptions and invoices
- Team billing
- The team's billing account
- What the team has been charged
- What this month's invoice will say
- The team's cards
- Add a card, through a Stripe-hosted setup session
- Make a card the team's default
- Remove a card
- Start the team paying
- Open the Stripe portal on the team's customer
- Change the team's plan
- Who receives the team's bills
- How the team pays for transfers
- Support
- Administration
- Users
- Platform
- Staff and permissions
- Team administration
- Assumed identities
- Support inbox
- The platform's addresses
- Add a platform address
- One address, with its counts
- Change an address's label, routing, or whether it accepts mail
- Remove an address that holds no mail
- Make, adopt or repair the address's routing rule
- Every admin's personal address, made where missing
- File a raw message, as if it had arrived
- The inbox
- One message, whole
- Mark a message
- Hand a message to an admin, or take it back
- Leave an internal note
- Reply, from the address the message came to
- What is waiting
- Databases
- Databases
- Data stores
- Connections and credentials
- The api keys on a database
- Issue a key
- Revoke a key
- The engine users we created
- Create a user inside the database
- Give a user a new password
- Drop a user
- How the database is reached
- Set how it is reached
- Revoke every api key on it
- How to connect to it
- The ssh keys that open its bastion
- Add a key, or have one made
- The private half of a generated key, once
- Revoke an ssh key
- Schema and objects
- Migrations
- Lifecycle
- Backups and replicas
- Policies
- Passwordless
- Database roles
- Pools
- Data plane
- Transfers
- The strategies this account's tier may use
- Price a transfer without creating it
- The account's transfer jobs, newest first
- Create a transfer job
- One job, and whether its certificate holds
- Cancel an unfinished job
- Start a created job, confirming its price
- Report a job's status (the runner, or the owner's side of a local run)
- Every database on the account
- Provision a database
- Change a database that is already running
- One database
- Deprovision it
- Read or write it
- Report what it is using
- The engines this API will provision
- Where a managed database can be put
- Databases
- Teams
- Schemas
- Error
- ValidationErrors
- Token
- PolicyCategory
- PolicySeverity
- PolicyAction
- PolicyTrigger
- PolicyParam
- Policy
- PolicyCatalog
- PolicyAssignment
- PolicyOutcome
- PolicyFiring
- CredentialTrace
- Relation
- Restrictions
- ChildSummary
- SignupRequest
- SigninRequest
- UpdateMeRequest
- User
- Address
- GeoPoint
- D1Region
- Usage
- UsageReport
- Resource
- Database
- DataStore
- NewDatabase
- NewDataStore
- QueryRequest
- DatabasePrivilege
- ApiKey
- DbUser
- Access
- AccessRequest
- DatabaseObject
- NewDatabaseObject
- NewMigration
- SchemaOperation
- Migration
- Operation
- Session
- AdminPowers
- Admin
- AuditEntry
- TeamRole
- Conversation
- ChatMessage
- TeamSso
- Team
- TeamMember
- SshKey
- ConnectionInfo
- InboxAddress
- InboxMailbox
- InboxMessageSummary
- InboxMessage
- InboxNote
- Page
- Quote
- Plan
- ApiError
- CapabilityRefusal
- KlockErrorCode
- PageWindow
- SessionView
- KlockStepUpRequest
- KlockOpenRequest
- KlockOpenedSession
- UpdateMeResult
- CapabilitiesView
- SessionLimits
- Device
- DeviceListed
- DeviceTeamRef
- DeviceCommand
- DeviceAuditLine
- DeviceActionRequest
- StaffActionRequest
- ManagedSession
- SessionRevoked
- AccessRule
- AccessRuleRequest
- BehaviourProfile
- BehaviourProfileRequest
- BehaviourProfileSaved
- BehaviourFinding
- BehaviourFindingAck
- StepUpProof
- Removed
- MemberLockdownRequest
- McpClient
- McpDelegatedView
- McpToolCall
- McpForwardRequest
- PasswordlessScope
- RoleScope
- PasswordlessSession
- PasswordlessTlsMaterial
- PasswordlessKerberosMaterial
- ServiceDeviceKeys
- ServiceSession
- DatabaseRole
- TransferEndpoint
- TransferJobRequest
- TransferQuote
- TransferStrategy
- TransferJob
- TransferJobAccess
- Pool
- PoolAllowance
- BillingSubscription
- Invoice
- BillingContact
- PaymentMethod
- UpcomingCharges
- TeamBilling
- TeamKerberosRealm
- TeamSsoDomain
- TeamSsoResponse
- StoreConnection
- BatchFailure
- ProxyStatus
Give the team its own Kerberos realm
POST
/teams/{teamId}/kerberos
At kerberos.prod-orm.io/: its own KDC master key, service
principal and certificate authority. Passwordless sessions the team
issues with --auth kerberos (or --auth tls) are then principals in
the team's realm, revocable as a set by dropping it. A role with
kerberos:manage (owner, admin, security); the member's role is
checked first (404 for a non-member). Needs a verified account.
Capability: kerberos:manage (area team).
Request
Path Params
Header Params
Responses
🟢201
application/json
Headers
Bodyapplication/json
🔴502
🔴503
🟠401KlockUnauthorized
🟠403Forbidden
🟠404NotFound
Request Request Example
Shell
JavaScript
Java
Swift
curl --location --request POST 'https://api.prod-orm.io/teams//kerberos' \
--header 'Idempotency-Key;'Response Response Example
201 - Example 1
{
"kerberos": {
"team": "string",
"realm": "string",
"kdc": "string",
"service": "string",
"ca": "string"
}
}Modified at 2026-10-05 04:04:32