# prod-orm ## Docs - [prorm documentation](https://774589.apidog.io/prorm-documentation-2464380m0.md): - [Known test gaps](https://774589.apidog.io/known-test-gaps-2464381m0.md): - [Architecture](https://774589.apidog.io/architecture-2464382m0.md): - [Core concepts](https://774589.apidog.io/core-concepts-2464398m0.md): - [Database types & coverage](https://774589.apidog.io/database-types-coverage-2464399m0.md): - [Getting started](https://774589.apidog.io/getting-started-2464500m0.md): - [Going further](https://774589.apidog.io/going-further-2464501m0.md): - compliance [Compliance](https://774589.apidog.io/compliance-2464383m0.md): - compliance [The security toolkit: `prorm audit`](https://774589.apidog.io/the-security-toolkit-prorm-audit-2464384m0.md): - compliance [Checklists by regulation](https://774589.apidog.io/checklists-by-regulation-2464385m0.md): - compliance [Declaring personal data](https://774589.apidog.io/declaring-personal-data-2464386m0.md): - compliance [Evidence bundles](https://774589.apidog.io/evidence-bundles-2464387m0.md): - compliance [Evidence](https://774589.apidog.io/evidence-2464388m0.md): - compliance [Frameworks: `@Security`](https://774589.apidog.io/frameworks-security-2464389m0.md): - compliance [Jurisdictions](https://774589.apidog.io/jurisdictions-2464390m0.md): - compliance [Platform policies](https://774589.apidog.io/platform-policies-2464391m0.md): - compliance [Protecting data](https://774589.apidog.io/protecting-data-2464392m0.md): - compliance [The regulation dataset](https://774589.apidog.io/the-regulation-dataset-2464393m0.md): - compliance [Residency and cross-border transfers](https://774589.apidog.io/residency-and-cross-border-transfers-2464394m0.md): - compliance [Retention & integrity](https://774589.apidog.io/retention-integrity-2464395m0.md): - compliance [Status](https://774589.apidog.io/status-2464396m0.md): - compliance [Subject rights](https://774589.apidog.io/subject-rights-2464397m0.md): - decorators [prorm with decorators](https://774589.apidog.io/prorm-with-decorators-2464400m0.md): - decorators [Models with decorators](https://774589.apidog.io/models-with-decorators-2464401m0.md): - decorators [Querying a decorated model](https://774589.apidog.io/querying-a-decorated-model-2464402m0.md): - decorators [Relations with decorators](https://774589.apidog.io/relations-with-decorators-2464403m0.md): - diagrams [Diagram generators](https://774589.apidog.io/diagram-generators-2464404m0.md): - diagrams [Chen diagram](https://774589.apidog.io/chen-diagram-2464405m0.md): - diagrams [Class diagram](https://774589.apidog.io/class-diagram-2464406m0.md): - diagrams [Dependency diagram](https://774589.apidog.io/dependency-diagram-2464407m0.md): - diagrams [ER diagram](https://774589.apidog.io/er-diagram-2464408m0.md): - diagrams [Flow diagram](https://774589.apidog.io/flow-diagram-2464409m0.md): - diagrams [From your models to a diagram](https://774589.apidog.io/from-your-models-to-a-diagram-2464410m0.md): - diagrams [Gantt diagram](https://774589.apidog.io/gantt-diagram-2464411m0.md): - diagrams [Index diagram](https://774589.apidog.io/index-diagram-2464412m0.md): - diagrams [Migration diagram](https://774589.apidog.io/migration-diagram-2464413m0.md): - diagrams [Model diagram](https://774589.apidog.io/model-diagram-2464414m0.md): - diagrams [Package diagram](https://774589.apidog.io/package-diagram-2464415m0.md): - diagrams [Crow’s-foot diagram](https://774589.apidog.io/crows-foot-diagram-2464416m0.md): - diagrams [Schema documentation](https://774589.apidog.io/schema-documentation-2464417m0.md): - diagrams [Sequence diagram](https://774589.apidog.io/sequence-diagram-2464418m0.md): - diagrams [State diagram](https://774589.apidog.io/state-diagram-2464419m0.md): - diagrams [Tree diagram](https://774589.apidog.io/tree-diagram-2464420m0.md): - dialects [SQL dialects](https://774589.apidog.io/sql-dialects-2464421m0.md): - dialects [AlloyDB Dialect](https://774589.apidog.io/alloydb-dialect-2464422m0.md): - dialects [AlloyDB Omni Dialect](https://774589.apidog.io/alloydb-omni-dialect-2464423m0.md): - dialects [Amazon Athena Dialect](https://774589.apidog.io/amazon-athena-dialect-2464424m0.md): - dialects [Aurora DSQL Dialect](https://774589.apidog.io/aurora-dsql-dialect-2464425m0.md): - dialects [Amazon Aurora MySQL Dialect](https://774589.apidog.io/amazon-aurora-mysql-dialect-2464426m0.md): - dialects [Amazon Aurora PostgreSQL Dialect](https://774589.apidog.io/amazon-aurora-postgresql-dialect-2464427m0.md): - dialects [Azure Database for MySQL Dialect](https://774589.apidog.io/azure-database-for-mysql-dialect-2464428m0.md): - dialects [Azure Database for PostgreSQL Dialect](https://774589.apidog.io/azure-database-for-postgresql-dialect-2464429m0.md): - dialects [Azure SQL Database Dialect](https://774589.apidog.io/azure-sql-database-dialect-2464430m0.md): - dialects [Azure SQL Managed Instance Dialect](https://774589.apidog.io/azure-sql-managed-instance-dialect-2464431m0.md): - dialects [Google BigQuery Dialect](https://774589.apidog.io/google-bigquery-dialect-2464432m0.md): - dialects [Citus Dialect](https://774589.apidog.io/citus-dialect-2464433m0.md): - dialects [ClickHouse dialect](https://774589.apidog.io/clickhouse-dialect-2464434m0.md): - dialects [Cloud Authentication (`cloud-auth`)](https://774589.apidog.io/cloud-authentication-cloud-auth-2464435m0.md): - dialects [Cloud SQL for SQL Server Dialect](https://774589.apidog.io/cloud-sql-for-sql-server-dialect-2464436m0.md): - dialects [Cloud SQL for MySQL Dialect](https://774589.apidog.io/cloud-sql-for-mysql-dialect-2464437m0.md): - dialects [Cloud SQL for PostgreSQL Dialect](https://774589.apidog.io/cloud-sql-for-postgresql-dialect-2464438m0.md): - dialects [CockroachDB Dialect](https://774589.apidog.io/cockroachdb-dialect-2464439m0.md): - dialects [Azure Cosmos DB for PostgreSQL Dialect](https://774589.apidog.io/azure-cosmos-db-for-postgresql-dialect-2464440m0.md): - dialects [CrateDB Dialect](https://774589.apidog.io/cratedb-dialect-2464441m0.md): - dialects [Cloudflare D1 Dialect](https://774589.apidog.io/cloudflare-d1-dialect-2464442m0.md): - dialects [Databricks dialect](https://774589.apidog.io/databricks-dialect-2464443m0.md): - dialects [IBM Db2 Dialect](https://774589.apidog.io/ibm-db2-dialect-2464444m0.md): - dialects [Dolt Dialect](https://774589.apidog.io/dolt-dialect-2464445m0.md): - dialects [Apache Doris Dialect](https://774589.apidog.io/apache-doris-dialect-2464446m0.md): - dialects [Druid Dialect](https://774589.apidog.io/druid-dialect-2464447m0.md): - dialects [DuckDB Dialect](https://774589.apidog.io/duckdb-dialect-2464448m0.md): - dialects [Exasol dialect](https://774589.apidog.io/exasol-dialect-2464449m0.md): - dialects [Microsoft Fabric Data Warehouse Dialect](https://774589.apidog.io/microsoft-fabric-data-warehouse-dialect-2464450m0.md): - dialects [Firebird Dialect](https://774589.apidog.io/firebird-dialect-2464451m0.md): - dialects [Greenplum Dialect](https://774589.apidog.io/greenplum-dialect-2464452m0.md): - dialects [SAP HANA Dialect](https://774589.apidog.io/sap-hana-dialect-2464453m0.md): - dialects [MySQL HeatWave Dialect](https://774589.apidog.io/mysql-heatwave-dialect-2464454m0.md): - dialects [Azure Data Explorer (Kusto) Dialect — T-SQL](https://774589.apidog.io/azure-data-explorer-kusto-dialect-t-sql-2464455m0.md): - dialects [MariaDB Dialect](https://774589.apidog.io/mariadb-dialect-2464456m0.md): - dialects [Materialize Dialect](https://774589.apidog.io/materialize-dialect-2464457m0.md): - dialects [MonetDB Dialect](https://774589.apidog.io/monetdb-dialect-2464458m0.md): - dialects [MotherDuck Dialect](https://774589.apidog.io/motherduck-dialect-2464459m0.md): - dialects [Microsoft SQL Server Dialect](https://774589.apidog.io/microsoft-sql-server-dialect-2464460m0.md): - dialects [MySQL Dialect](https://774589.apidog.io/mysql-dialect-2464461m0.md): - dialects [Neon Dialect](https://774589.apidog.io/neon-dialect-2464462m0.md): - dialects [OceanBase Dialect](https://774589.apidog.io/oceanbase-dialect-2464463m0.md): - dialects [openGauss Dialect](https://774589.apidog.io/opengauss-dialect-2464464m0.md): - dialects [Oracle Dialect](https://774589.apidog.io/oracle-dialect-2464465m0.md): - dialects [Oracle Autonomous Database Dialect](https://774589.apidog.io/oracle-autonomous-database-dialect-2464466m0.md): - dialects [ParadeDB Dialect](https://774589.apidog.io/paradedb-dialect-2464467m0.md): - dialects [PolarDB Dialect](https://774589.apidog.io/polardb-dialect-2464468m0.md): - dialects [PostgreSQL Dialect](https://774589.apidog.io/postgresql-dialect-2464469m0.md): - dialects [Presto Dialect](https://774589.apidog.io/presto-dialect-2464470m0.md): - dialects [QuestDB Dialect](https://774589.apidog.io/questdb-dialect-2464471m0.md): - dialects [Aurora RDS Data API Dialect (`rdsdata`)](https://774589.apidog.io/aurora-rds-data-api-dialect-rdsdata-2464472m0.md): - dialects [Amazon RDS for Db2 Dialect](https://774589.apidog.io/amazon-rds-for-db2-dialect-2464473m0.md): - dialects [Amazon RDS for MariaDB Dialect](https://774589.apidog.io/amazon-rds-for-mariadb-dialect-2464474m0.md): - dialects [Amazon RDS for SQL Server Dialect](https://774589.apidog.io/amazon-rds-for-sql-server-dialect-2464475m0.md): - dialects [Amazon RDS for MySQL Dialect](https://774589.apidog.io/amazon-rds-for-mysql-dialect-2464476m0.md): - dialects [Amazon RDS for Oracle Dialect](https://774589.apidog.io/amazon-rds-for-oracle-dialect-2464477m0.md): - dialects [Amazon RDS for PostgreSQL Dialect](https://774589.apidog.io/amazon-rds-for-postgresql-dialect-2464478m0.md): - dialects [Amazon Redshift](https://774589.apidog.io/amazon-redshift-2464479m0.md): - dialects [Amazon Redshift Data API Dialect](https://774589.apidog.io/amazon-redshift-data-api-dialect-2464480m0.md): - dialects [RisingWave Dialect](https://774589.apidog.io/risingwave-dialect-2464481m0.md): - dialects [rqlite Dialect](https://774589.apidog.io/rqlite-dialect-2464482m0.md): - dialects [SingleStore Dialect](https://774589.apidog.io/singlestore-dialect-2464483m0.md): - dialects [Snowflake Dialect](https://774589.apidog.io/snowflake-dialect-2464484m0.md): - dialects [Google Cloud Spanner Dialect](https://774589.apidog.io/google-cloud-spanner-dialect-2464485m0.md): - dialects [Spanner (PostgreSQL interface) Dialect](https://774589.apidog.io/spanner-postgresql-interface-dialect-2464486m0.md): - dialects [SQLite Dialect](https://774589.apidog.io/sqlite-dialect-2464487m0.md): - dialects [StarRocks Dialect](https://774589.apidog.io/starrocks-dialect-2464488m0.md): - dialects [Supabase Dialect](https://774589.apidog.io/supabase-dialect-2464489m0.md): - dialects [Azure Synapse Analytics (dedicated SQL pool)](https://774589.apidog.io/azure-synapse-analytics-dedicated-sql-pool-2464490m0.md): - dialects [Teradata Dialect](https://774589.apidog.io/teradata-dialect-2464491m0.md): - dialects [TiDB Dialect](https://774589.apidog.io/tidb-dialect-2464492m0.md): - dialects [TimescaleDB Dialect](https://774589.apidog.io/timescaledb-dialect-2464493m0.md): - dialects [Trino Dialect](https://774589.apidog.io/trino-dialect-2464494m0.md): - dialects [Turso / libSQL Dialect](https://774589.apidog.io/turso-libsql-dialect-2464495m0.md): - dialects [Vertica dialect](https://774589.apidog.io/vertica-dialect-2464496m0.md): - dialects [Vitess Dialect](https://774589.apidog.io/vitess-dialect-2464497m0.md): - dialects [Yellowbrick Dialect](https://774589.apidog.io/yellowbrick-dialect-2464498m0.md): - dialects [YugabyteDB Dialect](https://774589.apidog.io/yugabytedb-dialect-2464499m0.md): - guides [Access rules and behaviour profiles](https://774589.apidog.io/access-rules-and-behaviour-profiles-2464502m0.md): - guides [ArangoDB (AQL)](https://774589.apidog.io/arangodb-aql-2464503m0.md): - guides [Associations](https://774589.apidog.io/associations-2464504m0.md): - guides [Audit levels and escalation](https://774589.apidog.io/audit-levels-and-escalation-2464505m0.md): - guides [Audit logging](https://774589.apidog.io/audit-logging-2464506m0.md): - guides [In the browser](https://774589.apidog.io/in-the-browser-2464507m0.md): - guides [Bulk operations](https://774589.apidog.io/bulk-operations-2464508m0.md): - guides [Caching](https://774589.apidog.io/caching-2464509m0.md): - guides [Capabilities, tiers and team roles](https://774589.apidog.io/capabilities-tiers-and-team-roles-2464510m0.md): - guides [CLI](https://774589.apidog.io/cli-2464511m0.md): - guides [Cloudflare](https://774589.apidog.io/cloudflare-2464512m0.md): - guides [Compliance & data protection](https://774589.apidog.io/compliance-data-protection-2464513m0.md): - guides [Connection Pooling & Performance](https://774589.apidog.io/connection-pooling-performance-2464514m0.md): - guides [Security in the console](https://774589.apidog.io/security-in-the-console-2464515m0.md): - guides [Couchbase: structured N1QL queries](https://774589.apidog.io/couchbase-structured-n1ql-queries-2464516m0.md): - guides [Data types](https://774589.apidog.io/data-types-2464517m0.md): - guides [Decorators](https://774589.apidog.io/decorators-2464518m0.md): - guides [Eager loading](https://774589.apidog.io/eager-loading-2464519m0.md): - guides [Enums and constants](https://774589.apidog.io/enums-and-constants-2464520m0.md): - guides [Error handling & error types](https://774589.apidog.io/error-handling-error-types-2464521m0.md): - guides [Extensions](https://774589.apidog.io/extensions-2464522m0.md): - guides [External fields](https://774589.apidog.io/external-fields-2464523m0.md): - guides [Foreign data wrappers](https://774589.apidog.io/foreign-data-wrappers-2464524m0.md): - guides [Graph databases](https://774589.apidog.io/graph-databases-2464525m0.md): - guides [Hooks & lifecycle events](https://774589.apidog.io/hooks-lifecycle-events-2464526m0.md): - guides [Indexes & constraints](https://774589.apidog.io/indexes-constraints-2464527m0.md): - guides [InfluxDB: structured Flux pipelines](https://774589.apidog.io/influxdb-structured-flux-pipelines-2464528m0.md): - guides [klock-errors](https://774589.apidog.io/klock-errors-2464529m0.md): - guides [klock — the `.klock` file](https://774589.apidog.io/klock-the-klock-file-2464530m0.md): - guides [Local databases (`prorm db up`)](https://774589.apidog.io/local-databases-prorm-db-up-2464531m0.md): - guides [Structured log search — Splunk, Graylog, Papertrail, Sumo Logic](https://774589.apidog.io/structured-log-search-splunk-graylog-papertrail-sumo-logic-2464532m0.md): - guides [Logging](https://774589.apidog.io/logging-2464533m0.md): - guides [Grafana Loki: structured LogQL queries](https://774589.apidog.io/grafana-loki-structured-logql-queries-2464534m0.md): - guides [MCP server](https://774589.apidog.io/mcp-server-2464535m0.md): - guides [Migrate — the data transfer subsystem](https://774589.apidog.io/migrate-the-data-transfer-subsystem-2464536m0.md): - guides [Migrations & Schema Sync](https://774589.apidog.io/migrations-schema-sync-2464537m0.md): - guides [Models from an existing database](https://774589.apidog.io/models-from-an-existing-database-2464538m0.md): - guides [Defining models](https://774589.apidog.io/defining-models-2464539m0.md): - guides [Multiple databases](https://774589.apidog.io/multiple-databases-2464540m0.md): - guides [OrientDB, Neptune and TigerGraph](https://774589.apidog.io/orientdb-neptune-and-tigergraph-2464541m0.md): - guides [Passwords](https://774589.apidog.io/passwords-2464542m0.md): - guides [Importing a Prisma schema](https://774589.apidog.io/importing-a-prisma-schema-2464543m0.md): - guides [Structured PromQL and MetricsQL](https://774589.apidog.io/structured-promql-and-metricsql-2464544m0.md): - guides [Query firewall](https://774589.apidog.io/query-firewall-2464545m0.md): - guides [QueryInterface](https://774589.apidog.io/queryinterface-2464546m0.md): - guides [Query operators reference](https://774589.apidog.io/query-operators-reference-2464547m0.md): - guides [Query optimization](https://774589.apidog.io/query-optimization-2464548m0.md): - guides [Composing find options with `pipe()` and `Q`](https://774589.apidog.io/composing-find-options-with-pipe-and-q-2464549m0.md): - guides [Query safety: the fail-closed WHERE guard](https://774589.apidog.io/query-safety-the-fail-closed-where-guard-2464550m0.md): - guides [Querying](https://774589.apidog.io/querying-2464551m0.md): - guides [Raw Queries & Query Building](https://774589.apidog.io/raw-queries-query-building-2464552m0.md): - guides [Read replicas](https://774589.apidog.io/read-replicas-2464553m0.md): - guides [Schema diffing & migration generation](https://774589.apidog.io/schema-diffing-migration-generation-2464554m0.md): - guides [Views, triggers & other schema objects](https://774589.apidog.io/views-triggers-other-schema-objects-2464555m0.md): - guides [Scopes & default scopes](https://774589.apidog.io/scopes-default-scopes-2464556m0.md): - guides [Seeders](https://774589.apidog.io/seeders-2464557m0.md): - guides [SPARQL / RDF triplestores](https://774589.apidog.io/sparql-rdf-triplestores-2464558m0.md): - guides [SQL constants](https://774589.apidog.io/sql-constants-2464559m0.md): - guides [SQL features](https://774589.apidog.io/sql-features-2464560m0.md): - guides [SQL function builders](https://774589.apidog.io/sql-function-builders-2464561m0.md): - guides [SQLite advanced features](https://774589.apidog.io/sqlite-advanced-features-2464562m0.md): - guides [StoreKey — a prod-orm database as the storage](https://774589.apidog.io/storekey-a-prod-orm-database-as-the-storage-2464563m0.md): - guides [Streaming results](https://774589.apidog.io/streaming-results-2464564m0.md): - guides [Terraform](https://774589.apidog.io/terraform-2464565m0.md): - guides [Transactions & Isolation Levels](https://774589.apidog.io/transactions-isolation-levels-2464566m0.md): - guides [Type mapping: legacy and modern](https://774589.apidog.io/type-mapping-legacy-and-modern-2464567m0.md): - guides [TypeScript types](https://774589.apidog.io/typescript-types-2464568m0.md): - guides [Database users, roles & privileges](https://774589.apidog.io/database-users-roles-privileges-2464569m0.md): - guides [Validation & constraints](https://774589.apidog.io/validation-constraints-2464570m0.md): - guides [Virtual & Computed Fields](https://774589.apidog.io/virtual-computed-fields-2464571m0.md): - guides [Writing docs](https://774589.apidog.io/writing-docs-2464572m0.md): - javascript [prorm in JavaScript](https://774589.apidog.io/prorm-in-javascript-2464573m0.md): - javascript [Models in JavaScript](https://774589.apidog.io/models-in-javascript-2464574m0.md): - javascript [Querying in JavaScript](https://774589.apidog.io/querying-in-javascript-2464575m0.md): - javascript [Relations in JavaScript](https://774589.apidog.io/relations-in-javascript-2464576m0.md): - runbooks [Operational runbooks](https://774589.apidog.io/operational-runbooks-2464577m0.md): - runbooks [Connection failures](https://774589.apidog.io/connection-failures-2464578m0.md): - runbooks [Credential rotation](https://774589.apidog.io/credential-rotation-2464579m0.md): - runbooks [Failover](https://774589.apidog.io/failover-2464580m0.md): - runbooks [Incident checklist](https://774589.apidog.io/incident-checklist-2464581m0.md): - runbooks [Deploying klock v2](https://774589.apidog.io/deploying-klock-v2-2464582m0.md): - runbooks [Migration rollback](https://774589.apidog.io/migration-rollback-2464583m0.md): - running-databases [Running databases in Docker](https://774589.apidog.io/running-databases-in-docker-2464584m0.md): - running-databases [Running prorm under Bun in Docker](https://774589.apidog.io/running-prorm-under-bun-in-docker-2464585m0.md): - running-databases [Running Cassandra in Docker with prorm](https://774589.apidog.io/running-cassandra-in-docker-with-prorm-2464586m0.md): - running-databases [Running ClickHouse in Docker with prorm](https://774589.apidog.io/running-clickhouse-in-docker-with-prorm-2464587m0.md): - running-databases [Running CockroachDB in Docker with prorm](https://774589.apidog.io/running-cockroachdb-in-docker-with-prorm-2464588m0.md): - running-databases [Running prorm under Deno in Docker](https://774589.apidog.io/running-prorm-under-deno-in-docker-2464589m0.md): - running-databases [Running Elasticsearch in Docker with prorm](https://774589.apidog.io/running-elasticsearch-in-docker-with-prorm-2464590m0.md): - running-databases [Running MariaDB in Docker with prorm](https://774589.apidog.io/running-mariadb-in-docker-with-prorm-2464591m0.md): - running-databases [Running MongoDB in Docker with prorm](https://774589.apidog.io/running-mongodb-in-docker-with-prorm-2464592m0.md): - prorm control plane [Introduction](https://774589.apidog.io/introduction-2465699m0.md): - prorm control plane [Authentication](https://774589.apidog.io/authentication-2465700m0.md): - prorm control plane [Errors](https://774589.apidog.io/errors-2465701m0.md): ## API Docs - prorm control plane > Getting started > Service [Is it up](https://774589.apidog.io/is-it-up-44723692e0.md): - prorm control plane > Getting started > Service [This description](https://774589.apidog.io/this-description-44723693e0.md): The OpenAPI document, exactly as it is in the repository. It is - prorm control plane > Account > Sign-up and verification [Create an account](https://774589.apidog.io/create-an-account-44723694e0.md): Answers 201 with no token. The address is unproven until it receives the - prorm control plane > Account > Sign-up and verification [Exchange credentials for a token](https://774589.apidog.io/exchange-credentials-for-a-token-44723695e0.md): Takes an email address, a username, or a `login` field holding either. - prorm control plane > Account > Sign-up and verification [Verify with the emailed code](https://774589.apidog.io/verify-with-the-emailed-code-44723696e0.md): Verifying is the proof signin would have asked for, so it also signs you in. - prorm control plane > Account > Sign-up and verification [Verify by clicking the emailed link](https://774589.apidog.io/verify-by-clicking-the-emailed-link-44723697e0.md): - prorm control plane > Account > Sign-up and verification [Name the parent or guardian](https://774589.apidog.io/name-the-parent-or-guardian-44723698e0.md): The parental-information step, after signup and before anything is - prorm control plane > Account > Sign-up and verification [What a consent link is about](https://774589.apidog.io/what-a-consent-link-is-about-44723699e0.md): Unauthenticated, because the parent arrives from an email and has not signed in yet. Says as little as it can — a first name, the address the child signed up with, and which address must approve. - prorm control plane > Account > Sign-up and verification [Give consent for a child's account](https://774589.apidog.io/give-consent-for-a-childs-account-44723700e0.md): Authenticated on purpose: the link identifies the child, and being the guardian is proved by a session on an account that is 18 or over and at the address the child named. Idempotent — approving twice changes nothing. Records the relationship and makes the approver a `parent`. - prorm control plane > Account > Sign-up and verification [Ask the parent or guardian again](https://774589.apidog.io/ask-the-parent-or-guardian-again-44723701e0.md): - prorm control plane > Account > Sign-up and verification [Send a new code and link](https://774589.apidog.io/send-a-new-code-and-link-44723702e0.md): Answers the same whether or not the address has an account waiting. - prorm control plane > Account > Family [Everyone this account is responsible for](https://774589.apidog.io/everyone-this-account-is-responsible-for-44723703e0.md): Only accounts the caller is recorded as a parent or guardian of, from consent having been given. A parent of somebody is not a parent of everybody. - prorm control plane > Account > Family [One child, in detail](https://774589.apidog.io/one-child-in-detail-44723704e0.md): Resources as the child would see them described — never a credential. Oversight is not impersonation; nothing here lets the parent act as the child rather than about them. - prorm control plane > Account > Family [Turn a limit on or off](https://774589.apidog.io/turn-a-limit-on-or-off-44723705e0.md): Both switches only ever restrict. There is no route that creates, deletes or spends on the child's behalf. - prorm control plane > Account > Profile [Who am I](https://774589.apidog.io/who-am-i-44723709e0.md): - prorm control plane > Account > Profile [Change the account](https://774589.apidog.io/change-the-account-44723710e0.md): Every field is optional, but at least one of `firstname`, `lastname`, - prorm control plane > Account > Profile [Every address on the account](https://774589.apidog.io/every-address-on-the-account-44723711e0.md): - prorm control plane > Account > Profile [Add an address](https://774589.apidog.io/add-an-address-44723712e0.md): It is not the address you sign in with until it is promoted, and it - prorm control plane > Account > Profile [Confirm an address with the code mailed to it](https://774589.apidog.io/confirm-an-address-with-the-code-mailed-to-it-44723713e0.md): An address that is already confirmed answers 200 with `That address is - prorm control plane > Account > Profile [Mail a fresh code to an unconfirmed address](https://774589.apidog.io/mail-a-fresh-code-to-an-unconfirmed-address-44723714e0.md): - prorm control plane > Account > Profile [Make an address primary](https://774589.apidog.io/make-an-address-primary-44723715e0.md): This changes the address the account signs in with, so it asks for the - prorm control plane > Account > Profile [Remove an address](https://774589.apidog.io/remove-an-address-44723716e0.md): - prorm control plane > Account > Profile [What this caller may do](https://774589.apidog.io/what-this-caller-may-do-44723717e0.md): The caller's tier, the live capability ceiling, what a step-up would - prorm control plane > Security > Sessions [Everywhere this account is signed in](https://774589.apidog.io/everywhere-this-account-is-signed-in-44723787e0.md): Every session the account holds, of every kind: browsers, CLI tokens, - prorm control plane > Security > Sessions [Sign out everywhere else](https://774589.apidog.io/sign-out-everywhere-else-44723788e0.md): Revokes every session but the one asking. Service sessions (database - prorm control plane > Security > Sessions [Sign one out](https://774589.apidog.io/sign-one-out-44723789e0.md): The token keeps verifying; the session behind it does not. Audited. - prorm control plane > Security > Sessions [A token for the CLI on a named machine](https://774589.apidog.io/a-token-for-the-cli-on-a-named-machine-44723790e0.md): The v1 end of `prorm login`. The console, holding the caller's own - prorm control plane > Security > Sessions [A token for the customer console, from the staff one](https://774589.apidog.io/a-token-for-the-customer-console-from-the-staff-one-44723791e0.md): The two consoles are separate origins with separate sessions; this is - prorm control plane > Security > Sessions [Park a sign-in for the CLI to collect](https://774589.apidog.io/park-a-sign-in-for-the-cli-to-collect-44723792e0.md): The relay for `prorm login`, for browsers that cannot reach the CLI's - prorm control plane > Security > Sessions [The CLI collecting its sign-in](https://774589.apidog.io/the-cli-collecting-its-sign-in-44723793e0.md): No session needed — the state is the secret (at least 16 random - prorm control plane > Security > Sessions [The team's members' live sessions](https://774589.apidog.io/the-teams-members-live-sessions-44723794e0.md): The live sessions of the team's active and suspended members — not - prorm control plane > Security > Sessions [Sign a member's session out](https://774589.apidog.io/sign-a-members-session-out-44723795e0.md): Needs `session:manage-members` and a `reason`; not under an assumed - prorm control plane > Security > Sessions [Sign an account out everywhere](https://774589.apidog.io/sign-an-account-out-everywhere-44723796e0.md): Needs `support`. Every session, including any staff holds as them. - prorm control plane > Security > Sessions [Everywhere the account is signed in](https://774589.apidog.io/everywhere-the-account-is-signed-in-44723797e0.md): Needs `users`. Staff sessions carry `assumed`. - prorm control plane > Security > Sessions [Sign an account's session out](https://774589.apidog.io/sign-an-accounts-session-out-44723798e0.md): Needs the `support` admin scope, a fresh step-up and a reason of - prorm control plane > Security > Single sign-on [Begin a single sign-on](https://774589.apidog.io/begin-a-single-sign-on-44723809e0.md): Public. Sends the browser to the team's provider with a sealed state - prorm control plane > Security > Single sign-on [The provider's return](https://774589.apidog.io/the-providers-return-44723810e0.md): Public; the provider sends the browser here. The code is exchanged - prorm control plane > Security > Single sign-on [Link the signed-in account to a team's provider](https://774589.apidog.io/link-the-signed-in-account-to-a-teams-provider-44723811e0.md): Signed in. How an existing account — a member's included — comes to - prorm control plane > Security > Single sign-on [Which team an address signs in to](https://774589.apidog.io/which-team-an-address-signs-in-to-44723812e0.md): Public. From an email address (its domain, against the domains teams - prorm control plane > Security > Single sign-on [The team's single sign-on, as a member sees it](https://774589.apidog.io/the-teams-single-sign-on-as-a-member-sees-it-44723813e0.md): Any member (`team:read`). The client secret is never returned; - prorm control plane > Security > Single sign-on [Set the team's OpenID Connect provider up, or change it](https://774589.apidog.io/set-the-teams-openid-connect-provider-up-or-change-it-44723814e0.md): Needs `sso:manage` (owner, admin, security) and a verified account. - prorm control plane > Security > Single sign-on [Remove the provider](https://774589.apidog.io/remove-the-provider-44723815e0.md): Needs `sso:manage` and a verified account. Its linked identities and - prorm control plane > Security > Single sign-on [The team's domain claims and the DNS record each needs](https://774589.apidog.io/the-teams-domain-claims-and-the-dns-record-each-needs-44723816e0.md): A domain listed in the provider's `domains` is a claim, `pending` - prorm control plane > Security > Single sign-on [Prove a claimed domain](https://774589.apidog.io/prove-a-claimed-domain-44723817e0.md): Looks up the TXT record at `_prorm-challenge.` and, when it - prorm control plane > Security > MFA and passwords [Start enrolling a second factor](https://774589.apidog.io/start-enrolling-a-second-factor-44723818e0.md): Returns the secret and the `otpauth://` uri an authenticator scans, - prorm control plane > Security > MFA and passwords [Prove the app has it](https://774589.apidog.io/prove-the-app-has-it-44723819e0.md): Confirms the factor and hands out ten one-time recovery codes, shown - prorm control plane > Security > MFA and passwords [Remove the second factor](https://774589.apidog.io/remove-the-second-factor-44723820e0.md): A downgrade of the account, so it asks for both factors it guards: the - prorm control plane > Security > MFA and passwords [Ask for a reset link](https://774589.apidog.io/ask-for-a-reset-link-44723821e0.md): Answers the same whether or not the address has an account. The link - prorm control plane > Security > MFA and passwords [Set a new password with the emailed token](https://774589.apidog.io/set-a-new-password-with-the-emailed-token-44723822e0.md): One-time and short-lived; every other reset link still open for the - prorm control plane > Security > Klock [Open a device-bound klock session](https://774589.apidog.io/open-a-device-bound-klock-session-44723823e0.md): Opens a klock v2 session bound to a device key, and hands back its - prorm control plane > Security > Klock [Check in, for the next grant](https://774589.apidog.io/check-in-for-the-next-grant-44723824e0.md): The session that signed the request gets a fresh grant, with the - prorm control plane > Security > Klock [Step up the session asking](https://774589.apidog.io/step-up-the-session-asking-44723825e0.md): Proves a second factor now, which wakes the session's dormant - prorm control plane > Security > Klock [Rotate the device key](https://774589.apidog.io/rotate-the-device-key-44723826e0.md): Signed by the old key; `proof` is a JWS by the new key over - prorm control plane > Security > Klock [Freeze a session](https://774589.apidog.io/freeze-a-session-44723827e0.md): Any of the caller's sessions. A frozen session cannot authenticate - prorm control plane > Security > Klock [Unfreeze a session](https://774589.apidog.io/unfreeze-a-session-44723828e0.md): From another of the caller's sessions (a frozen one cannot - prorm control plane > Security > Klock [A guest grant](https://774589.apidog.io/a-guest-grant-44723829e0.md): An anonymous device key gets the public capability set, with no - prorm control plane > Security > Klock [The revocation feed](https://774589.apidog.io/the-revocation-feed-44723830e0.md): Sessions, devices and certificates revoked after `since`, as a compact - prorm control plane > Security > Klock [The published keyset](https://774589.apidog.io/the-published-keyset-44723831e0.md): The root-signed keyset exactly as published — a compact JWS; clients - prorm control plane > Security > Klock [What this control plane supports](https://774589.apidog.io/what-this-control-plane-supports-44723832e0.md): For a client deciding between klock v2 and the legacy sign-in. - prorm control plane > Security > Devices [Your devices, or a team's](https://774589.apidog.io/your-devices-or-a-teams-44723833e0.md): The caller's klock devices, the one asking marked `current`. With - prorm control plane > Security > Devices [Approve a new device's pairing code](https://774589.apidog.io/approve-a-new-devices-pairing-code-44723834e0.md): A new device shows a pairing code; approving it here opens the new - prorm control plane > Security > Devices [One device](https://774589.apidog.io/one-device-44723835e0.md): The device in full, the sessions on it, and — for its owner — its last - prorm control plane > Security > Devices [Rename a device](https://774589.apidog.io/rename-a-device-44723836e0.md): `device:manage` for your own (not under an assumed identity); with - prorm control plane > Security > Devices [Revoke a device](https://774589.apidog.io/revoke-a-device-44723837e0.md): Final. The device's sessions end at once, it goes on the revocation - prorm control plane > Security > Devices [Suspend a device](https://774589.apidog.io/suspend-a-device-44723838e0.md): Klock stops issuing it grants at sync, and its sessions are frozen so - prorm control plane > Security > Devices [Reinstate a suspended device](https://774589.apidog.io/reinstate-a-suspended-device-44723839e0.md): The reverse of a suspension: sessions frozen by it thaw. Who may: as - prorm control plane > Security > Devices [Wipe a device](https://774589.apidog.io/wipe-a-device-44723840e0.md): Its sessions end, it is suspended, and an API-signed `wipe` command is - prorm control plane > Security > Devices [Ask a device to rotate its key](https://774589.apidog.io/ask-a-device-to-rotate-its-key-44723841e0.md): Queues an API-signed `rotate-key` command for its next sync. Only an - prorm control plane > Security > Devices [The team's members' devices](https://774589.apidog.io/the-teams-members-devices-44723842e0.md): Every device of the team's active and suspended members, and any - prorm control plane > Security > Devices [Revoke a member's device](https://774589.apidog.io/revoke-a-members-device-44723843e0.md): As `DELETE /security/devices/{id}` with `team`: a `reason` is - prorm control plane > Security > Devices [An account's devices](https://774589.apidog.io/an-accounts-devices-44723844e0.md): Every device of the account, revoked ones included. Needs the `support` admin scope. - prorm control plane > Security > Devices [Revoke an account's device](https://774589.apidog.io/revoke-an-accounts-device-44723845e0.md): As the owner's own revoke. Needs the `support` admin scope and, in - prorm control plane > Security > Devices [Wipe an account's device](https://774589.apidog.io/wipe-an-accounts-device-44723846e0.md): As the owner's own wipe. Needs the `support` admin scope, a fresh - prorm control plane > Security > Devices [The device fleet](https://774589.apidog.io/the-device-fleet-44723847e0.md): Counts by status, kind and key store, and the newest devices. Needs the `support` admin scope. - prorm control plane > Security > Access rules and behaviour [The access rules that bear on you](https://774589.apidog.io/the-access-rules-that-bear-on-you-44723848e0.md): With no `scope`, every rule on the account, its devices (any device - prorm control plane > Security > Access rules and behaviour [Add an access rule](https://774589.apidog.io/add-an-access-rule-44723849e0.md): A rule allows or blocks requests by one dimension — client address - prorm control plane > Security > Access rules and behaviour [This request, as the rules see it](https://774589.apidog.io/this-request-as-the-rules-see-it-44723850e0.md): What a rule would be matched against for the request making this - prorm control plane > Security > Access rules and behaviour [One access rule](https://774589.apidog.io/one-access-rule-44723851e0.md): Needs `access-rule:read` and read access to the rule's scope, checked - prorm control plane > Security > Access rules and behaviour [Remove an access rule](https://774589.apidog.io/remove-an-access-rule-44723852e0.md): Runs the same lock-out guard as a create — removing an allow can shut - prorm control plane > Security > Access rules and behaviour [The behaviour profiles that bear on you](https://774589.apidog.io/the-behaviour-profiles-that-bear-on-you-44723853e0.md): A behaviour profile says what normal looks like at a scope and what to - prorm control plane > Security > Access rules and behaviour [Add or change a behaviour profile](https://774589.apidog.io/add-or-change-a-behaviour-profile-44723854e0.md): Saves by scope and name: a profile of that name at that scope is - prorm control plane > Security > Access rules and behaviour [The profile presets](https://774589.apidog.io/the-profile-presets-44723855e0.md): The ORM's built-in presets, each with its full spec, to save as they - prorm control plane > Security > Access rules and behaviour [Your behaviour findings](https://774589.apidog.io/your-behaviour-findings-44723856e0.md): What your profiles caught, newest first, at most 500. Only the - prorm control plane > Security > Access rules and behaviour [Acknowledge a finding](https://774589.apidog.io/acknowledge-a-finding-44723857e0.md): One of your own findings. Acknowledging twice changes nothing. Needs - prorm control plane > Security > Access rules and behaviour [One behaviour profile](https://774589.apidog.io/one-behaviour-profile-44723858e0.md): Needs `behaviour:read` and read access to the profile's scope, checked - prorm control plane > Security > Access rules and behaviour [Remove a behaviour profile](https://774589.apidog.io/remove-a-behaviour-profile-44723859e0.md): Removes the profile and what it had learned. Removing one that is - prorm control plane > Security > Access rules and behaviour [The team's access rules](https://774589.apidog.io/the-teams-access-rules-44723860e0.md): Any active member may read them: they are the rules applied to them. - prorm control plane > Security > Access rules and behaviour [Add a team access rule](https://774589.apidog.io/add-a-team-access-rule-44723861e0.md): As `POST /security/access-rules` with the scope fixed to this team: - prorm control plane > Security > Access rules and behaviour [Remove a team access rule](https://774589.apidog.io/remove-a-team-access-rule-44723862e0.md): Only a rule of this team (any other is a 404). The role must carry - prorm control plane > Security > Access rules and behaviour [The team's behaviour profiles](https://774589.apidog.io/the-teams-behaviour-profiles-44723863e0.md): Any active member. The controller also checks the session holds - prorm control plane > Security > Access rules and behaviour [Add or change a team behaviour profile](https://774589.apidog.io/add-or-change-a-team-behaviour-profile-44723864e0.md): As `POST /security/behaviour` with the scope fixed to this team. The - prorm control plane > Security > Access rules and behaviour [Remove a team behaviour profile](https://774589.apidog.io/remove-a-team-behaviour-profile-44723865e0.md): Only a profile of this team. `behaviour:team`; an enforcing profile - prorm control plane > Security > Access rules and behaviour [What the team's profiles caught](https://774589.apidog.io/what-the-teams-profiles-caught-44723866e0.md): Findings of the team's behaviour profiles, newest first, at most 500; - prorm control plane > Security > Access rules and behaviour [Acknowledge a team finding](https://774589.apidog.io/acknowledge-a-team-finding-44723867e0.md): A finding of one of this team's profiles. The role and the session - prorm control plane > Security > Recovery and lockdown [Ask for a recovery link](https://774589.apidog.io/ask-for-a-recovery-link-44723868e0.md): For an account its own access rules (or a lockdown) lock out. Emails - prorm control plane > Security > Recovery and lockdown [Recover access with the emailed code](https://774589.apidog.io/recover-access-with-the-emailed-code-44723869e0.md): Takes the code from the link, the password, and — when the account - prorm control plane > Security > Recovery and lockdown [Is the account locked down](https://774589.apidog.io/is-the-account-locked-down-44723870e0.md): Needs `session:read`, checked in the route in every mode; not under - prorm control plane > Security > Recovery and lockdown [Lock the account down](https://774589.apidog.io/lock-the-account-down-44723871e0.md): The emergency switch. Signs out every interactive, device, delegated, - prorm control plane > Security > Recovery and lockdown [Release a lockdown](https://774589.apidog.io/release-a-lockdown-44723872e0.md): Needs a fresh sign-in — a session opened within the last 15 minutes — - prorm control plane > Security > Recovery and lockdown [Lock a member down](https://774589.apidog.io/lock-a-member-down-44723873e0.md): Suspends the membership — the team's resources then refuse them — and - prorm control plane > Security > Recovery and lockdown [Release a member's lockdown](https://774589.apidog.io/release-a-members-lockdown-44723874e0.md): Makes a suspended membership active again. Needs a `reason`; audited - prorm control plane > Security > MCP tokens [Make a delegated token for one MCP client](https://774589.apidog.io/make-a-delegated-token-for-one-mcp-client-44723875e0.md): A token (`prorm_dt_…`) a third-party MCP client holds: a subset of the - prorm control plane > Security > MCP tokens [The account's delegated tokens](https://774589.apidog.io/the-accounts-delegated-tokens-44723876e0.md): Newest first; revoked ones stay listed for 30 days. Never the token. - prorm control plane > Security > MCP tokens [Revoke a delegated token](https://774589.apidog.io/revoke-a-delegated-token-44723877e0.md): At once: the next call with it is refused, and the revoke goes onto - prorm control plane > Security > MCP tokens [What a delegated token may do now](https://774589.apidog.io/what-a-delegated-token-may-do-now-44723878e0.md): The token's scope intersected with what its owner may do right now - prorm control plane > Security > MCP tokens [Run one MCP tool with a delegated token](https://774589.apidog.io/run-one-mcp-tool-with-a-delegated-token-44723879e0.md): The tool is looked up in the shared MCP registry, and the HTTP call it - prorm control plane > Security > MCP tokens [Run a device-signed MCP tool call relayed by the MCP Worker](https://774589.apidog.io/run-a-device-signed-mcp-tool-call-relayed-by-the-mcp-worker-44723880e0.md): For the MCP Worker, not for clients. The Worker relays a request a - prorm control plane > Security > Kerberos [Give the team its own Kerberos realm](https://774589.apidog.io/give-the-team-its-own-kerberos-realm-44723945e0.md): At kerberos.prod-orm.io/: its own KDC master key, service - prorm control plane > Security > Kerberos [The team's realm](https://774589.apidog.io/the-teams-realm-44723946e0.md): Its KDC, service and CA. Any member (`team:read`). - prorm control plane > Security > Kerberos [Remove the team's realm](https://774589.apidog.io/remove-the-teams-realm-44723947e0.md): Every session in it stops verifying at once. `kerberos:manage`. Needs a verified account. - prorm control plane > Logging and monitoring > Audit log [What has been done to the account](https://774589.apidog.io/what-has-been-done-to-the-account-44723706e0.md): The audit log — signins, keys created, databases provisioned. Not the query log: what a child ran against their own database is their data. - prorm control plane > Logging and monitoring > Audit log [What has happened to this account](https://774589.apidog.io/what-has-happened-to-this-account-44723707e0.md): Paginated, newest last as recorded. - prorm control plane > Logging and monitoring > Audit log [The account's audit trail](https://774589.apidog.io/the-accounts-audit-trail-44723708e0.md): Needs `users`. Newest first. - prorm control plane > Logging and monitoring > Operations [Everything that has been asked of this database](https://774589.apidog.io/everything-that-has-been-asked-of-this-database-44723762e0.md): **Capability:** `resource:read` (area `resource`, on the database). - prorm control plane > Logging and monitoring > Operations [One, with its steps](https://774589.apidog.io/one-with-its-steps-44723763e0.md): The view that answers where it failed, rather than that it did. - prorm control plane > Logging and monitoring > Operations [Stop it](https://774589.apidog.io/stop-it-44723764e0.md): A queued operation stops now. A running one is asked to stop at its next - prorm control plane > Logging and monitoring > Operations [Put a failed one back in the queue](https://774589.apidog.io/put-a-failed-one-back-in-the-queue-44723765e0.md): Steps that already succeeded are kept, so a retry resumes rather than restarts. - prorm control plane > Logging and monitoring > Operations [Every operation, across all accounts](https://774589.apidog.io/every-operation-across-all-accounts-44723766e0.md): Oldest first, so a stuck queue is on the first page. - prorm control plane > Logging and monitoring > Metrics and events [Every measurement, for a graph](https://774589.apidog.io/every-measurement-for-a-graph-44723777e0.md): **Capability:** `resource:read` (area `resource`, on the database). - prorm control plane > Logging and monitoring > Metrics and events [Who did what to it](https://774589.apidog.io/who-did-what-to-it-44723778e0.md): **Capability:** `resource:read` (area `resource`, on the database). - prorm control plane > Billing > Plans and pricing [What the plans allow](https://774589.apidog.io/what-the-plans-allow-44723902e0.md): - prorm control plane > Billing > Plans and pricing [The rate card](https://774589.apidog.io/the-rate-card-44723903e0.md): What each unit costs per month, in integer cents. Databases are billed at cost per resource, so this is the whole price list; never a Stripe Price id. - prorm control plane > Billing > Plans and pricing [What one database would cost](https://774589.apidog.io/what-one-database-would-cost-44723904e0.md): Prices a database before it is created, or a resize before it is applied. Returns the itemisation rather than a number, so a customer can see what each line was computed from. - prorm control plane > Billing > Plans and pricing [What this account is paying for, itemised](https://774589.apidog.io/what-this-account-is-paying-for-itemised-44723905e0.md): - prorm control plane > Billing > Subscriptions and invoices [What this month's invoice will say](https://774589.apidog.io/what-this-months-invoice-will-say-44723906e0.md): The same walk the invoice.created webhook makes, without creating anything — so a customer can read their bill before Stripe sends it. - prorm control plane > Billing > Subscriptions and invoices [What this account is on](https://774589.apidog.io/what-this-account-is-on-44723907e0.md): - prorm control plane > Billing > Subscriptions and invoices [What it has been charged](https://774589.apidog.io/what-it-has-been-charged-44723908e0.md): - prorm control plane > Billing > Subscriptions and invoices [Start a Stripe Checkout session](https://774589.apidog.io/start-a-stripe-checkout-session-44723909e0.md): - prorm control plane > Billing > Subscriptions and invoices [Open the customer portal](https://774589.apidog.io/open-the-customer-portal-44723910e0.md): Upgrades, downgrades, cancellation and card changes are all Stripe's to host. - prorm control plane > Billing > Subscriptions and invoices [Stripe's events](https://774589.apidog.io/stripes-events-44723911e0.md): Verified against `STRIPE_WEBHOOK_SECRET` over the raw body — a body that - prorm control plane > Billing > Subscriptions and invoices [Buy more connection pools](https://774589.apidog.io/buy-more-connection-pools-44723912e0.md): Raises the account's pool allowance at once (`extraPools`), so a - prorm control plane > Billing > Team billing [The team's billing account](https://774589.apidog.io/the-teams-billing-account-44723933e0.md): A team the caller is not an active member of answers 404 `Unknown - prorm control plane > Billing > Team billing [What the team has been charged](https://774589.apidog.io/what-the-team-has-been-charged-44723934e0.md): Newest first, mirrored from Stripe by the webhook. - prorm control plane > Billing > Team billing [What this month's invoice will say](https://774589.apidog.io/what-this-months-invoice-will-say-44723935e0.md): The team's billable resources, priced the way the invoice will price them, before Stripe raises it. - prorm control plane > Billing > Team billing [The team's cards](https://774589.apidog.io/the-teams-cards-44723936e0.md): Empty when the team has no Stripe customer yet, or billing is not configured. - prorm control plane > Billing > Team billing [Add a card, through a Stripe-hosted setup session](https://774589.apidog.io/add-a-card-through-a-stripe-hosted-setup-session-44723937e0.md): The card never passes through this API; the webhook makes it the - prorm control plane > Billing > Team billing [Make a card the team's default](https://774589.apidog.io/make-a-card-the-teams-default-44723938e0.md): Another customer's card is as unknown here as one that does not exist. - prorm control plane > Billing > Team billing [Remove a card](https://774589.apidog.io/remove-a-card-44723939e0.md): **Capability:** `billing:manage` (area `team`). - prorm control plane > Billing > Team billing [Start the team paying](https://774589.apidog.io/start-the-team-paying-44723940e0.md): The same checkout an account's is — the zero-cost usage price, and - prorm control plane > Billing > Team billing [Open the Stripe portal on the team's customer](https://774589.apidog.io/open-the-stripe-portal-on-the-teams-customer-44723941e0.md): Invoices, cards and cancellation. Needs a verified account; a child's account cannot. - prorm control plane > Billing > Team billing [Change the team's plan](https://774589.apidog.io/change-the-teams-plan-44723942e0.md): On the team's existing subscription: `free` cancels at the end of the - prorm control plane > Billing > Team billing [Who receives the team's bills](https://774589.apidog.io/who-receives-the-teams-bills-44723943e0.md): An active member whose role may read billing (`billing:read`), or - prorm control plane > Billing > Team billing [How the team pays for transfers](https://774589.apidog.io/how-the-team-pays-for-transfers-44723944e0.md): `immediate` charges each transfer as it completes; `deferred` settles - prorm control plane > Support > Support chat [My conversations](https://774589.apidog.io/my-conversations-44723799e0.md): Every conversation the caller is in, most recent first, each with its - prorm control plane > Support > Support chat [Start a conversation](https://774589.apidog.io/start-a-conversation-44723800e0.md): `direct` with `userId` — a colleague on one of your teams, or admin to - prorm control plane > Support > Support chat [Every support conversation, open first](https://774589.apidog.io/every-support-conversation-open-first-44723801e0.md): Needs the `support` admin scope. - prorm control plane > Support > Support chat [A ticket for the socket](https://774589.apidog.io/a-ticket-for-the-socket-44723802e0.md): A browser cannot put a bearer header on a WebSocket and a token in a - prorm control plane > Support > Support chat [One conversation, with who is in it and who is connected](https://774589.apidog.io/one-conversation-with-who-is-in-it-and-who-is-connected-44723803e0.md): - prorm control plane > Support > Support chat [Rename a group; open or close a support conversation](https://774589.apidog.io/rename-a-group-open-or-close-a-support-conversation-44723804e0.md): A title needs `chat:manage` on the team, or to have started the group. Open/closed is support staff's; a customer writing again reopens it. - prorm control plane > Support > Support chat [The lines, oldest first](https://774589.apidog.io/the-lines-oldest-first-44723805e0.md): The newest 50 by default. `before` pages back from a message id; `after` reads forward from one (what a client that lost its socket asks for). - prorm control plane > Support > Support chat [Say something](https://774589.apidog.io/say-something-44723806e0.md): Written first, then fanned out to every open socket. Support staff answering are added to the conversation, so the record shows who answered. Needs a verified address. - prorm control plane > Support > Support chat [Add somebody](https://774589.apidog.io/add-somebody-44723807e0.md): To a group, a member of its team; to a support conversation, a member (by a member) or support staff (by staff). Idempotent. - prorm control plane > Support > Support chat [Mark read](https://774589.apidog.io/mark-read-44723808e0.md): Up to a message id, or the latest. Never moves backwards. - prorm control plane > Administration > Users [Every account](https://774589.apidog.io/every-account-44723948e0.md): Paginated, and never carrying a password hash or an outstanding - prorm control plane > Administration > Users [One account, with everything hanging off it](https://774589.apidog.io/one-account-with-everything-hanging-off-it-44723949e0.md): - prorm control plane > Administration > Users [Grant or revoke admin](https://774589.apidog.io/grant-or-revoke-admin-44723950e0.md): Emails the account, and writes an audit row. Refuses to remove the last - prorm control plane > Administration > Users [Verify an account by hand](https://774589.apidog.io/verify-an-account-by-hand-44723951e0.md): For an address that is broken but real. Retires any outstanding code. - prorm control plane > Administration > Users [Lock or unlock sign-in](https://774589.apidog.io/lock-or-unlock-sign-in-44723952e0.md): Needs `support` (`grant-admin` for an admin account). Locking ends every live session; unlocking restores sign-in only. - prorm control plane > Administration > Users [Allow or hold provisioning](https://774589.apidog.io/allow-or-hold-provisioning-44723953e0.md): Needs `resources`. The account keeps what it has and cannot create more. - prorm control plane > Administration > Users [Send the verification mail again](https://774589.apidog.io/send-the-verification-mail-again-44723954e0.md): Needs `support`. - prorm control plane > Administration > Users [Set the plan by hand](https://774589.apidog.io/set-the-plan-by-hand-44723955e0.md): Needs `billing`. Writes the column a Stripe subscription writes; does not touch Stripe. A reason is required. - prorm control plane > Administration > Platform [Every database and store, across all accounts](https://774589.apidog.io/every-database-and-store-across-all-accounts-44723956e0.md): - prorm control plane > Administration > Platform [The counts worth putting on a dashboard](https://774589.apidog.io/the-counts-worth-putting-on-a-dashboard-44723957e0.md): - prorm control plane > Administration > Staff and permissions [What kind of admin the caller is, and which scopes they hold](https://774589.apidog.io/what-kind-of-admin-the-caller-is-and-which-scopes-they-hold-44723958e0.md): The one admin route any admin may reach; it is how a UI knows which pages to offer. - prorm control plane > Administration > Staff and permissions [The admin presets](https://774589.apidog.io/the-admin-presets-44723959e0.md): Each kind of admin, what it may do, and whether it may grant admin. Needs `grant-admin`. - prorm control plane > Administration > Staff and permissions [Every admin, and the scopes each resolves to](https://774589.apidog.io/every-admin-and-the-scopes-each-resolves-to-44723960e0.md): Needs `grant-admin`. - prorm control plane > Administration > Staff and permissions [Make an account an admin of a kind](https://774589.apidog.io/make-an-account-an-admin-of-a-kind-44723961e0.md): Needs `grant-admin`. A preset `type` resolves to its constants; `other` - prorm control plane > Administration > Staff and permissions [Change an admin's kind, or a custom admin's scopes](https://774589.apidog.io/change-an-admins-kind-or-a-custom-admins-scopes-44723962e0.md): Needs `grant-admin`. - prorm control plane > Administration > Staff and permissions [Revoke admin](https://774589.apidog.io/revoke-admin-44723963e0.md): Needs `grant-admin`. The account goes back to basic. The last general - prorm control plane > Administration > Team administration [Every team, with its owner and size](https://774589.apidog.io/every-team-with-its-owner-and-size-44723964e0.md): Needs `users`. `?userId=` narrows to the teams that account is in. - prorm control plane > Administration > Team administration [One team in full — members with their accounts, and projects](https://774589.apidog.io/one-team-in-full-members-with-their-accounts-and-projects-44723965e0.md): Needs `users`. - prorm control plane > Administration > Team administration [Hand the team to another member](https://774589.apidog.io/hand-the-team-to-another-member-44723966e0.md): Needs `users`. What the owner does with their password, done for them; the heir must be an active member, the old owner becomes an admin. A reason is required. - prorm control plane > Administration > Team administration [Put an account in the team, active at once](https://774589.apidog.io/put-an-account-in-the-team-active-at-once-44723967e0.md): Needs `users`. No invitation; ownership is transferred, not granted. - prorm control plane > Administration > Team administration [Change a member's role](https://774589.apidog.io/change-a-members-role-44723968e0.md): Needs `users`. The owner's row is transferred, not rewritten. - prorm control plane > Administration > Team administration [Remove a member](https://774589.apidog.io/remove-a-member-44723969e0.md): Needs `users`. The owner cannot be removed; transfer first. - prorm control plane > Administration > Assumed identities [Assume an identity — act as a customer account](https://774589.apidog.io/assume-an-identity-act-as-a-customer-account-44723970e0.md): Needs `assume`. Mints a bearer token that *is* the customer's: every - prorm control plane > Administration > Assumed identities [The identities the caller holds open](https://774589.apidog.io/the-identities-the-caller-holds-open-44723971e0.md): - prorm control plane > Administration > Assumed identities [End an assumed identity](https://774589.apidog.io/end-an-assumed-identity-44723972e0.md): The token keeps verifying; the session behind it does not. Only the caller's own. - prorm control plane > Administration > Support inbox [The platform's addresses](https://774589.apidog.io/the-platforms-addresses-44723973e0.md): Any admin: an `email` holder sees every address the platform answers - prorm control plane > Administration > Support inbox [Add a platform address](https://774589.apidog.io/add-a-platform-address-44723974e0.md): Needs `email`. The address has to be at the sending domain - prorm control plane > Administration > Support inbox [One address, with its counts](https://774589.apidog.io/one-address-with-its-counts-44723975e0.md): - prorm control plane > Administration > Support inbox [Change an address's label, routing, or whether it accepts mail](https://774589.apidog.io/change-an-addresss-label-routing-or-whether-it-accepts-mail-44723976e0.md): Not the address itself — mail is matched against it and a routing rule - prorm control plane > Administration > Support inbox [Remove an address that holds no mail](https://774589.apidog.io/remove-an-address-that-holds-no-mail-44723977e0.md): An address with messages at it is history and cannot be removed — - prorm control plane > Administration > Support inbox [Make, adopt or repair the address's routing rule](https://774589.apidog.io/make-adopt-or-repair-the-addresss-routing-rule-44723978e0.md): The Cloudflare Email Routing rule that delivers this address's mail to - prorm control plane > Administration > Support inbox [Every admin's personal address, made where missing](https://774589.apidog.io/every-admins-personal-address-made-where-missing-44723979e0.md): Granting admin makes a personal `@` address; this is for - prorm control plane > Administration > Support inbox [File a raw message, as if it had arrived](https://774589.apidog.io/file-a-raw-message-as-if-it-had-arrived-44723980e0.md): Needs `email`. The same function the Worker's `email` export calls on - prorm control plane > Administration > Support inbox [The inbox](https://774589.apidog.io/the-inbox-44723981e0.md): Any admin. One holding `email` sees every address; any other sees the - prorm control plane > Administration > Support inbox [One message, whole](https://774589.apidog.io/one-message-whole-44723982e0.md): Every header, both bodies, the attachments it named (name, type, size - prorm control plane > Administration > Support inbox [Mark a message](https://774589.apidog.io/mark-a-message-44723983e0.md): Read, unread, archived or spam. Audited when it changes. - prorm control plane > Administration > Support inbox [Hand a message to an admin, or take it back](https://774589.apidog.io/hand-a-message-to-an-admin-or-take-it-back-44723984e0.md): `userId` names an admin holding `email`; null releases it. A pointer - prorm control plane > Administration > Support inbox [Leave an internal note](https://774589.apidog.io/leave-an-internal-note-44723985e0.md): For the other admins. Never sent; the sender never sees it. Audited. - prorm control plane > Administration > Support inbox [Reply, from the address the message came to](https://774589.apidog.io/reply-from-the-address-the-message-came-to-44723986e0.md): Any admin who can see the message (see the inbox). Plain text in; it goes out through the same template - prorm control plane > Administration > Support inbox [What is waiting](https://774589.apidog.io/what-is-waiting-44723987e0.md): Any admin. Unread and unassigned inbound counts, and each address with - prorm control plane > Databases > Databases > Data stores [Every data store on the account](https://774589.apidog.io/every-data-store-on-the-account-44723727e0.md): **Capability:** `resource:read` (area `resource`, on the store). - prorm control plane > Databases > Databases > Data stores [Provision a data store](https://774589.apidog.io/provision-a-data-store-44723728e0.md): **Capability:** `resource:provision` (area `resource`, on the store). With a team context: resource:provision in that team. - prorm control plane > Databases > Databases > Data stores [Change a data store that is already running](https://774589.apidog.io/change-a-data-store-that-is-already-running-44723729e0.md): **Capability:** `resource:operate` (area `resource`, on the store). - prorm control plane > Databases > Databases > Data stores [One data store](https://774589.apidog.io/one-data-store-44723730e0.md): **Capability:** `resource:read` (area `resource`, on the store). - prorm control plane > Databases > Databases > Data stores [Deprovision it](https://774589.apidog.io/deprovision-it-44723731e0.md): **Capability:** `resource:delete` (area `resource`, on the store). - prorm control plane > Databases > Databases > Data stores [Report what it is using](https://774589.apidog.io/report-what-it-is-using-44723732e0.md): **Capability:** `resource:operate` (area `resource`, on the store). - prorm control plane > Databases > Databases > Data stores [How to reach a data store](https://774589.apidog.io/how-to-reach-a-data-store-44723733e0.md): The store's answer to a database's `/connect`. A managed store on - prorm control plane > Databases > Databases > Connections and credentials [The api keys on a database](https://774589.apidog.io/the-api-keys-on-a-database-44723734e0.md): The secret half is never returned again, by anything. - prorm control plane > Databases > Databases > Connections and credentials [Issue a key](https://774589.apidog.io/issue-a-key-44723735e0.md): The only moment the secret exists anywhere but in the caller's hands. - prorm control plane > Databases > Databases > Connections and credentials [Revoke a key](https://774589.apidog.io/revoke-a-key-44723736e0.md): Revoked, not deleted — the row answers who had access, and until when. - prorm control plane > Databases > Databases > Connections and credentials [The engine users we created](https://774589.apidog.io/the-engine-users-we-created-44723737e0.md): **Capability:** `access:read` (area `resource`, on the database). - prorm control plane > Databases > Databases > Connections and credentials [Create a user inside the database](https://774589.apidog.io/create-a-user-inside-the-database-44723738e0.md): Made with the ORM's own user management, so the privilege becomes real - prorm control plane > Databases > Databases > Connections and credentials [Give a user a new password](https://774589.apidog.io/give-a-user-a-new-password-44723739e0.md): **Capability:** `access:write` (area `resource`, on the database). - prorm control plane > Databases > Databases > Connections and credentials [Drop a user](https://774589.apidog.io/drop-a-user-44723740e0.md): **Capability:** `access:write` (area `resource`, on the database). - prorm control plane > Databases > Databases > Connections and credentials [How the database is reached](https://774589.apidog.io/how-the-database-is-reached-44723741e0.md): Never returns the admin secret — only whether there is one. - prorm control plane > Databases > Databases > Connections and credentials [Set how it is reached](https://774589.apidog.io/set-how-it-is-reached-44723742e0.md): One row per database, so this creates or replaces. `adminPassword` is - prorm control plane > Databases > Databases > Connections and credentials [Revoke every api key on it](https://774589.apidog.io/revoke-every-api-key-on-it-44723743e0.md): **Capability:** `access:write` (area `resource`, on the database). - prorm control plane > Databases > Databases > Connections and credentials [How to connect to it](https://774589.apidog.io/how-to-connect-to-it-44723744e0.md): The question a person actually has, answered in the form their client - prorm control plane > Databases > Databases > Connections and credentials [The ssh keys that open its bastion](https://774589.apidog.io/the-ssh-keys-that-open-its-bastion-44723745e0.md): **Capability:** `access:read` (area `resource`, on the database). - prorm control plane > Databases > Databases > Connections and credentials [Add a key, or have one made](https://774589.apidog.io/add-a-key-or-have-one-made-44723746e0.md): Send `publicKey` and we never see the private half — the better of the - prorm control plane > Databases > Databases > Connections and credentials [The private half of a generated key, once](https://774589.apidog.io/the-private-half-of-a-generated-key-once-44723747e0.md): For a client that lost the response. Reading it drops it, so the second - prorm control plane > Databases > Databases > Connections and credentials [Revoke an ssh key](https://774589.apidog.io/revoke-an-ssh-key-44723748e0.md): **Capability:** `access:write` (area `resource`, on the database). - prorm control plane > Databases > Databases > Schema and objects [The SQL objects we put in it](https://774589.apidog.io/the-sql-objects-we-put-in-it-44723749e0.md): **Capability:** `resource:read` (area `resource`, on the database). - prorm control plane > Databases > Databases > Schema and objects [Create one, and apply it](https://774589.apidog.io/create-one-and-apply-it-44723750e0.md): Described, not written: a trigger says what it fires on and what it does, - prorm control plane > Databases > Databases > Schema and objects [What is in the database, as the engine reports it](https://774589.apidog.io/what-is-in-the-database-as-the-engine-reports-it-44723751e0.md): Tables, columns and indexes read through the dialect's own introspection — the truth on the ground, including what a migration, a client or a person made directly. `/objects` is the platform's own ledger; this is not it. - prorm control plane > Databases > Databases > Schema and objects [One table](https://774589.apidog.io/one-table-44723752e0.md): **Capability:** `resource:read` (area `resource`, on the database). - prorm control plane > Databases > Databases > Schema and objects [What it would run, without running it](https://774589.apidog.io/what-it-would-run-without-running-it-44723753e0.md): **Capability:** `migration:write` (area `resource`, on the database). - prorm control plane > Databases > Databases > Schema and objects [Redefine an object in place](https://774589.apidog.io/redefine-an-object-in-place-44723754e0.md): An engine does not edit a trigger: it is dropped and made again. That is - prorm control plane > Databases > Databases > Schema and objects [Drop it](https://774589.apidog.io/drop-it-44723755e0.md): **Capability:** `migration:write` (area `resource`, on the database). - prorm control plane > Databases > Databases > Schema and objects [The extensions installed in it](https://774589.apidog.io/the-extensions-installed-in-it-44723756e0.md): **Capability:** `resource:read` (area `resource`, on the database). - prorm control plane > Databases > Databases > Migrations [A plan compiled to statements, recording nothing](https://774589.apidog.io/a-plan-compiled-to-statements-recording-nothing-44723757e0.md): What `POST /migrations` would run, for a reviewer — or `prorm db push --dry-run` — that wants to see the statements first. Column types may be engine types (`VARCHAR(200)`) or the ORM's own (`STRING(200)`, `BOOLEAN`, `ENUM('a','b')`), which are rendered for this database's engine; that is also true of `POST /migrations` itself. - prorm control plane > Databases > Databases > Migrations [The migrations recorded for it](https://774589.apidog.io/the-migrations-recorded-for-it-44723758e0.md): **Capability:** `resource:read` (area `resource`, on the database). - prorm control plane > Databases > Databases > Migrations [Record one](https://774589.apidog.io/record-one-44723759e0.md): Operations, not SQL. The checksum is taken over the structured - prorm control plane > Databases > Databases > Migrations [Apply everything recorded and not yet run](https://774589.apidog.io/apply-everything-recorded-and-not-yet-run-44723760e0.md): Enqueues the `migrate` operation — the same as `POST - prorm control plane > Databases > Databases > Migrations [Apply everything pending, oldest version first](https://774589.apidog.io/apply-everything-pending-oldest-version-first-44723761e0.md): **Capability:** `migration:apply` (area `resource`, on the database). - prorm control plane > Databases > Databases > Lifecycle [Grow or shrink it](https://774589.apidog.io/grow-or-shrink-it-44723767e0.md): **Capability:** `resource:operate` (area `resource`, on the database). - prorm control plane > Databases > Databases > Lifecycle [Stop it accepting connections](https://774589.apidog.io/stop-it-accepting-connections-44723768e0.md): **Capability:** `resource:operate` (area `resource`, on the database). - prorm control plane > Databases > Databases > Lifecycle [Start it again](https://774589.apidog.io/start-it-again-44723769e0.md): **Capability:** `resource:operate` (area `resource`, on the database). - prorm control plane > Databases > Databases > Lifecycle [Move it to another region](https://774589.apidog.io/move-it-to-another-region-44723770e0.md): Built there, switched over, then the old one is torn down — in that order. - prorm control plane > Databases > Databases > Backups and replicas [Take a backup](https://774589.apidog.io/take-a-backup-44723771e0.md): **Capability:** `resource:operate` (area `resource`, on the database). - prorm control plane > Databases > Databases > Backups and replicas [The backups it has](https://774589.apidog.io/the-backups-it-has-44723772e0.md): **Capability:** `resource:read` (area `resource`, on the database). - prorm control plane > Databases > Databases > Backups and replicas [Restore one into it](https://774589.apidog.io/restore-one-into-it-44723773e0.md): **Capability:** `resource:operate` and `data:write` (area `resource`, on the database). - prorm control plane > Databases > Databases > Backups and replicas [What has been restored into it, and from where](https://774589.apidog.io/what-has-been-restored-into-it-and-from-where-44723774e0.md): **Capability:** `resource:read` (area `resource`, on the database). - prorm control plane > Databases > Databases > Backups and replicas [Its read copies](https://774589.apidog.io/its-read-copies-44723775e0.md): **Capability:** `resource:read` (area `resource`, on the database). - prorm control plane > Databases > Databases > Backups and replicas [Add one](https://774589.apidog.io/add-one-44723776e0.md): **Capability:** `resource:operate` (area `resource`, on the database). - prorm control plane > Databases > Databases > Policies [The catalog](https://774589.apidog.io/the-catalog-44723779e0.md): Every policy, grouped by category. Needs no session. With any filter the answer is a flat list instead. - prorm control plane > Databases > Databases > Policies [One policy](https://774589.apidog.io/one-policy-44723780e0.md): **Capability:** none — public. - prorm control plane > Databases > Databases > Policies [What this database is held to](https://774589.apidog.io/what-this-database-is-held-to-44723781e0.md): **Capability:** `audit:read` (area `resource`, on the database). - prorm control plane > Databases > Databases > Policies [Switch a policy on, or change its knobs](https://774589.apidog.io/switch-a-policy-on-or-change-its-knobs-44723782e0.md): Idempotent. `params` may only name what the policy declares, within its bounds; anything else is a 400 that says which. - prorm control plane > Databases > Databases > Policies [Switch it off](https://774589.apidog.io/switch-it-off-44723783e0.md): The history under `policy.fired` in the events feed stays. - prorm control plane > Databases > Databases > Policies [Mark the policies reviewed](https://774589.apidog.io/mark-the-policies-reviewed-44723784e0.md): What the quarterly-review policies measure from. - prorm control plane > Databases > Databases > Policies [Evaluate the periodic policies now](https://774589.apidog.io/evaluate-the-periodic-policies-now-44723785e0.md): The metric, age, schedule and state policies on this database, without waiting for the sweep. Event-driven policies evaluate as events arrive and are not affected. - prorm control plane > Databases > Databases > Policies [Who is behind a credential](https://774589.apidog.io/who-is-behind-a-credential-44723786e0.md): The watermark. Every key is `prefix.secret` and the prefix is what appears in logs and events. Given the whole key or just the prefix, this names the account it was issued to, its privilege and state, and every address it has been used from. Only the prefix is used or echoed. A prefix that belongs to no key on this database is a 404, not a lead. - prorm control plane > Databases > Databases > Passwordless [The database's passwordless sessions](https://774589.apidog.io/the-databases-passwordless-sessions-44723913e0.md): Paginated with `limit` (default 50, at most 500) and `offset`; a `Link` header points at the next page. - prorm control plane > Databases > Databases > Passwordless [Issue a passwordless session (v1)](https://774589.apidog.io/issue-a-passwordless-session-v1-44723914e0.md): A session secret, returned once and never again: it is encrypted into - prorm control plane > Databases > Databases > Passwordless [Revoke a passwordless session](https://774589.apidog.io/revoke-a-passwordless-session-44723915e0.md): Kept as a row for the audit trail. A Kerberos principal is removed - prorm control plane > Databases > Databases > Passwordless [Bind a session to a device key](https://774589.apidog.io/bind-a-session-to-a-device-key-44723916e0.md): `prorm klock upgrade`: the owner's call, carrying the holder's new - prorm control plane > Databases > Databases > Passwordless [Issue a v2 session for a host to bind](https://774589.apidog.io/issue-a-v2-session-for-a-host-to-bind-44723917e0.md): A passwordless session that is v2 from birth and never has a secret - prorm control plane > Databases > Databases > Passwordless [Redeem an enrolment ticket on the host](https://774589.apidog.io/redeem-an-enrolment-ticket-on-the-host-44723918e0.md): `prorm klock init --service`. No account session: the ticket from - prorm control plane > Databases > Databases > Passwordless [Check a passwordless credential](https://774589.apidog.io/check-a-passwordless-credential-44723919e0.md): No account session, by design: the credential is the session's own. - prorm control plane > Databases > Databases > Passwordless [Run one described query under a passwordless credential](https://774589.apidog.io/run-one-described-query-under-a-passwordless-credential-44723920e0.md): The same credential forms and checks as `…/passwordless/exchange` (v1 - prorm control plane > Databases > Databases > Database roles [The database's roles](https://774589.apidog.io/the-databases-roles-44723921e0.md): Paginated with `limit` (default 50, at most 500) and `offset`. - prorm control plane > Databases > Databases > Database roles [Define a role](https://774589.apidog.io/define-a-role-44723922e0.md): A named scope over this database — which operations, which tables, - prorm control plane > Databases > Databases > Database roles [One role](https://774589.apidog.io/one-role-44723923e0.md): **Capability:** `access:read` (area `resource`, on the database). - prorm control plane > Databases > Databases > Database roles [Change what a role permits](https://774589.apidog.io/change-what-a-role-permits-44723924e0.md): The scope and description move; the name does not (sending `name` is - prorm control plane > Databases > Databases > Database roles [Delete a role, and revoke every key granted it](https://774589.apidog.io/delete-a-role-and-revoke-every-key-granted-it-44723925e0.md): The passwordless sessions and api keys granted the role are revoked - prorm control plane > Databases > Databases > Database roles [Grant a role, which mints a key](https://774589.apidog.io/grant-a-role-which-mints-a-key-44723926e0.md): The holder is a label (`ci-runner`, `ada's laptop`), not an account. - prorm control plane > Databases > Databases > Database roles [Who holds a role](https://774589.apidog.io/who-holds-a-role-44723927e0.md): The passwordless sessions granted it, revoked ones included. Paginated with `limit` and `offset`. - prorm control plane > Databases > Databases > Database roles [The api keys bound to a role](https://774589.apidog.io/the-api-keys-bound-to-a-role-44723928e0.md): **Capability:** `access:read` (area `resource`, on the database). - prorm control plane > Databases > Databases > Pools [A database's connection pools, and how busy each is](https://774589.apidog.io/a-databases-connection-pools-and-how-busy-each-is-44723929e0.md): Every pool, open or closed, oldest first. `active` is the requests in - prorm control plane > Databases > Databases > Pools [Open another pool](https://774589.apidog.io/open-another-pool-44723930e0.md): Takes one from the owner's allowance. When it is spent the answer is - prorm control plane > Databases > Databases > Pools [Rename a pool or change its size](https://774589.apidog.io/rename-a-pool-or-change-its-size-44723931e0.md): **Capability:** `resource:operate` (area `resource`, on the database). - prorm control plane > Databases > Databases > Pools [Close a pool](https://774589.apidog.io/close-a-pool-44723932e0.md): Clients on it fall back to the database's default on their next - prorm control plane > Databases > Databases > Data plane [Run a query against a database](https://774589.apidog.io/run-a-query-against-a-database-44723988e0.md): The data plane: what a client library talks to, continuously. Same - prorm control plane > Databases > Databases > Data plane [Several statements, in order, over one connection](https://774589.apidog.io/several-statements-in-order-over-one-connection-44723989e0.md): Not a transaction — engines differ on what one means over HTTP, and - prorm control plane > Databases > Databases > Data plane [Is this database answering](https://774589.apidog.io/is-this-database-answering-44723990e0.md): Cheap enough for a client to poll. - prorm control plane > Databases > Databases > Data plane [What the proxy itself is holding](https://774589.apidog.io/what-the-proxy-itself-is-holding-44723991e0.md): For the platform's own monitoring, not a tenant's: the open - prorm control plane > Databases > Databases > Transfers [The strategies this account's tier may use](https://774589.apidog.io/the-strategies-this-accounts-tier-may-use-44723992e0.md): The account's plan maps to a Migrate tier (`free` → free, `usage` → - prorm control plane > Databases > Databases > Transfers [Price a transfer without creating it](https://774589.apidog.io/price-a-transfer-without-creating-it-44723993e0.md): The same planning `POST /transfer/jobs` does — the strategy, the tier, - prorm control plane > Databases > Databases > Transfers [The account's transfer jobs, newest first](https://774589.apidog.io/the-accounts-transfer-jobs-newest-first-44723994e0.md): With no `scope`, exactly the jobs this account made that are not a - prorm control plane > Databases > Databases > Transfers [Create a transfer job](https://774589.apidog.io/create-a-transfer-job-44723995e0.md): Plans the job with Migrate, stores the projected price for the holder - prorm control plane > Databases > Databases > Transfers [One job, and whether its certificate holds](https://774589.apidog.io/one-job-and-whether-its-certificate-holds-44723996e0.md): The caller's own job, or their team's; anybody else's is 404. - prorm control plane > Databases > Databases > Transfers [Cancel an unfinished job](https://774589.apidog.io/cancel-an-unfinished-job-44723997e0.md): A job that has not started, or a recurring one whose next run is not - prorm control plane > Databases > Databases > Transfers [Start a created job, confirming its price](https://774589.apidog.io/start-a-created-job-confirming-its-price-44723998e0.md): The holder confirms the projected price they were shown; a job never - prorm control plane > Databases > Databases > Transfers [Report a job's status (the runner, or the owner's side of a local run)](https://774589.apidog.io/report-a-jobs-status-the-runner-or-the-owners-side-of-a-local-run-44723999e0.md): Not a customer route: the reporter is whoever moves the bytes, and the - prorm control plane > Databases > Databases [Every database on the account](https://774589.apidog.io/every-database-on-the-account-44723718e0.md): **Capability:** `resource:read` (area `resource`, on the database). - prorm control plane > Databases > Databases [Provision a database](https://774589.apidog.io/provision-a-database-44723719e0.md): A managed `sqlite` database is built on Cloudflare D1 during the request, - prorm control plane > Databases > Databases [Change a database that is already running](https://774589.apidog.io/change-a-database-that-is-already-running-44723720e0.md): Only what is ours to change without touching the engine: its name, what - prorm control plane > Databases > Databases [One database](https://774589.apidog.io/one-database-44723721e0.md): **Capability:** `resource:read` (area `resource`, on the database). - prorm control plane > Databases > Databases [Deprovision it](https://774589.apidog.io/deprovision-it-44723722e0.md): The engine is torn down first, then the row is soft-deleted — so what it - prorm control plane > Databases > Databases [Read or write it](https://774589.apidog.io/read-or-write-it-44723723e0.md): Takes a bearer token **or** an api key in `x-api-key`. A key is issued - prorm control plane > Databases > Databases [Report what it is using](https://774589.apidog.io/report-what-it-is-using-44723724e0.md): What the storage warnings fire on. Crossing 80% sends one email; hitting - prorm control plane > Databases > Databases [The engines this API will provision](https://774589.apidog.io/the-engines-this-api-will-provision-44723725e0.md): Read from the library, not written down: 27 SQL dialects and 102 stores, - prorm control plane > Databases > Databases [Where a managed database can be put](https://774589.apidog.io/where-a-managed-database-can-be-put-44723726e0.md): **Capability:** none — public. - prorm control plane > Teams > Teams > Members [Who is on it](https://774589.apidog.io/who-is-on-it-44723889e0.md): **Capability:** `team:read` (area `team`). - prorm control plane > Teams > Teams > Members [Invite somebody](https://774589.apidog.io/invite-somebody-44723890e0.md): Needs `team:manage-members`. Ownership is transferred, never granted. - prorm control plane > Teams > Teams > Members [Accept an invitation](https://774589.apidog.io/accept-an-invitation-44723891e0.md): **Capability:** none from the table; any signed-in account, about itself. - prorm control plane > Teams > Teams > Members [Change somebody's role](https://774589.apidog.io/change-somebodys-role-44723892e0.md): **Capability:** `team:manage-members` (area `team`). - prorm control plane > Teams > Teams > Members [Remove somebody](https://774589.apidog.io/remove-somebody-44723893e0.md): **Capability:** `team:manage-members` (area `team`). - prorm control plane > Teams > Teams > Projects [The projects a team runs](https://774589.apidog.io/the-projects-a-team-runs-44723894e0.md): **Capability:** `project:read` (area `team`). - prorm control plane > Teams > Teams > Projects [Start one](https://774589.apidog.io/start-one-44723895e0.md): Needs `project:write`. - prorm control plane > Teams > Teams > Projects [Rename a project, or move its environment](https://774589.apidog.io/rename-a-project-or-move-its-environment-44723896e0.md): **Capability:** `project:write` (area `team`). - prorm control plane > Teams > Teams > Projects [Delete a project](https://774589.apidog.io/delete-a-project-44723897e0.md): The grouping goes; the databases in it do not. Deleting a resource is a - prorm control plane > Teams > Teams > Projects [One project, and what is in it](https://774589.apidog.io/one-project-and-what-is-in-it-44723898e0.md): **Capability:** `project:read` (area `team`). - prorm control plane > Teams > Teams > Projects [Put a database or store in it](https://774589.apidog.io/put-a-database-or-store-in-it-44723899e0.md): **Capability:** `project:write` (area `team`). And ownership of the resource, one team per resource. - prorm control plane > Teams > Teams > Projects [What is in a project](https://774589.apidog.io/what-is-in-a-project-44723900e0.md): **Capability:** `project:read` (area `team`). - prorm control plane > Teams > Teams > Projects [Take one out](https://774589.apidog.io/take-one-out-44723901e0.md): **Capability:** `project:write` (area `team`). - prorm control plane > Teams > Teams [The teams this account is on](https://774589.apidog.io/the-teams-this-account-is-on-44723881e0.md): **Capability:** none from the table; any signed-in account, about itself. - prorm control plane > Teams > Teams [Start one](https://774589.apidog.io/start-one-44723882e0.md): The creator is its owner, and that role is not granted to anybody else. - prorm control plane > Teams > Teams [The twelve roles, and what each may do](https://774589.apidog.io/the-twelve-roles-and-what-each-may-do-44723883e0.md): Roles are capability sets, not a ladder: `billing` is not "less than" - prorm control plane > Teams > Teams [Rename a team](https://774589.apidog.io/rename-a-team-44723884e0.md): Not the slug — that is an address, and things point at it. - prorm control plane > Teams > Teams [Close a team](https://774589.apidog.io/close-a-team-44723885e0.md): Owner only, and asks for the password: closing takes the projects with - prorm control plane > Teams > Teams [One team](https://774589.apidog.io/one-team-44723886e0.md): A team you are not on answers 404 — whether it exists is not yours to know. - prorm control plane > Teams > Teams [Hand the team to somebody else](https://774589.apidog.io/hand-the-team-to-somebody-else-44723887e0.md): Ownership is transferred, never granted — this is the route that does - prorm control plane > Teams > Teams [Leave a team](https://774589.apidog.io/leave-a-team-44723888e0.md): **Capability:** `team:read` (area `team`). ## Schemas - prorm control plane [Error](https://774589.apidog.io/error-18069924d0.md): - prorm control plane [ValidationErrors](https://774589.apidog.io/validationerrors-18069925d0.md): - prorm control plane [Token](https://774589.apidog.io/token-18069926d0.md): - prorm control plane [PolicyCategory](https://774589.apidog.io/policycategory-18069927d0.md): - prorm control plane [PolicySeverity](https://774589.apidog.io/policyseverity-18069928d0.md): - prorm control plane [PolicyAction](https://774589.apidog.io/policyaction-18069929d0.md): - prorm control plane [PolicyTrigger](https://774589.apidog.io/policytrigger-18069930d0.md): - prorm control plane [PolicyParam](https://774589.apidog.io/policyparam-18069931d0.md): - prorm control plane [Policy](https://774589.apidog.io/policy-18069932d0.md): - prorm control plane [PolicyCatalog](https://774589.apidog.io/policycatalog-18069933d0.md): - prorm control plane [PolicyAssignment](https://774589.apidog.io/policyassignment-18069934d0.md): - prorm control plane [PolicyOutcome](https://774589.apidog.io/policyoutcome-18069935d0.md): - prorm control plane [PolicyFiring](https://774589.apidog.io/policyfiring-18069936d0.md): - prorm control plane [CredentialTrace](https://774589.apidog.io/credentialtrace-18069937d0.md): - prorm control plane [Relation](https://774589.apidog.io/relation-18069938d0.md): - prorm control plane [Restrictions](https://774589.apidog.io/restrictions-18069939d0.md): - prorm control plane [ChildSummary](https://774589.apidog.io/childsummary-18069940d0.md): - prorm control plane [SignupRequest](https://774589.apidog.io/signuprequest-18069941d0.md): - prorm control plane [SigninRequest](https://774589.apidog.io/signinrequest-18069942d0.md): - prorm control plane [UpdateMeRequest](https://774589.apidog.io/updatemerequest-18069943d0.md): - prorm control plane [User](https://774589.apidog.io/user-18069944d0.md): - prorm control plane [Address](https://774589.apidog.io/address-18069945d0.md): - prorm control plane [GeoPoint](https://774589.apidog.io/geopoint-18069946d0.md): - prorm control plane [D1Region](https://774589.apidog.io/d1region-18069947d0.md): - prorm control plane [Usage](https://774589.apidog.io/usage-18069948d0.md): - prorm control plane [UsageReport](https://774589.apidog.io/usagereport-18069949d0.md): - prorm control plane [Resource](https://774589.apidog.io/resource-18069950d0.md): - prorm control plane [Database](https://774589.apidog.io/database-18069951d0.md): - prorm control plane [DataStore](https://774589.apidog.io/datastore-18069952d0.md): - prorm control plane [NewDatabase](https://774589.apidog.io/newdatabase-18069953d0.md): - prorm control plane [NewDataStore](https://774589.apidog.io/newdatastore-18069954d0.md): - prorm control plane [QueryRequest](https://774589.apidog.io/queryrequest-18069955d0.md): - prorm control plane [DatabasePrivilege](https://774589.apidog.io/databaseprivilege-18069956d0.md): - prorm control plane [ApiKey](https://774589.apidog.io/apikey-18069957d0.md): - prorm control plane [DbUser](https://774589.apidog.io/dbuser-18069958d0.md): - prorm control plane [Access](https://774589.apidog.io/access-18069959d0.md): - prorm control plane [AccessRequest](https://774589.apidog.io/accessrequest-18069960d0.md): - prorm control plane [DatabaseObject](https://774589.apidog.io/databaseobject-18069961d0.md): - prorm control plane [NewDatabaseObject](https://774589.apidog.io/newdatabaseobject-18069962d0.md): - prorm control plane [NewMigration](https://774589.apidog.io/newmigration-18069963d0.md): - prorm control plane [SchemaOperation](https://774589.apidog.io/schemaoperation-18069964d0.md): - prorm control plane [Migration](https://774589.apidog.io/migration-18069965d0.md): - prorm control plane [Operation](https://774589.apidog.io/operation-18069966d0.md): - prorm control plane [Session](https://774589.apidog.io/session-18069967d0.md): - prorm control plane [AdminPowers](https://774589.apidog.io/adminpowers-18069968d0.md): - prorm control plane [Admin](https://774589.apidog.io/admin-18069969d0.md): - prorm control plane [AuditEntry](https://774589.apidog.io/auditentry-18069970d0.md): - prorm control plane [TeamRole](https://774589.apidog.io/teamrole-18069971d0.md): - prorm control plane [Conversation](https://774589.apidog.io/conversation-18069972d0.md): - prorm control plane [ChatMessage](https://774589.apidog.io/chatmessage-18069973d0.md): - prorm control plane [TeamSso](https://774589.apidog.io/teamsso-18069974d0.md): - prorm control plane [Team](https://774589.apidog.io/team-18069975d0.md): - prorm control plane [TeamMember](https://774589.apidog.io/teammember-18069976d0.md): - prorm control plane [SshKey](https://774589.apidog.io/sshkey-18069977d0.md): - prorm control plane [ConnectionInfo](https://774589.apidog.io/connectioninfo-18069978d0.md): - prorm control plane [InboxAddress](https://774589.apidog.io/inboxaddress-18069979d0.md): - prorm control plane [InboxMailbox](https://774589.apidog.io/inboxmailbox-18069980d0.md): - prorm control plane [InboxMessageSummary](https://774589.apidog.io/inboxmessagesummary-18069981d0.md): - prorm control plane [InboxMessage](https://774589.apidog.io/inboxmessage-18069982d0.md): - prorm control plane [InboxNote](https://774589.apidog.io/inboxnote-18069983d0.md): - prorm control plane [Page](https://774589.apidog.io/page-18069984d0.md): - prorm control plane [Quote](https://774589.apidog.io/quote-18069985d0.md): - prorm control plane [Plan](https://774589.apidog.io/plan-18069986d0.md): - prorm control plane [ApiError](https://774589.apidog.io/apierror-18069987d0.md): - prorm control plane [CapabilityRefusal](https://774589.apidog.io/capabilityrefusal-18069988d0.md): - prorm control plane [KlockErrorCode](https://774589.apidog.io/klockerrorcode-18069989d0.md): - prorm control plane [PageWindow](https://774589.apidog.io/pagewindow-18069990d0.md): - prorm control plane [SessionView](https://774589.apidog.io/sessionview-18069991d0.md): - prorm control plane [KlockStepUpRequest](https://774589.apidog.io/klockstepuprequest-18069992d0.md): - prorm control plane [KlockOpenRequest](https://774589.apidog.io/klockopenrequest-18069993d0.md): - prorm control plane [KlockOpenedSession](https://774589.apidog.io/klockopenedsession-18069994d0.md): - prorm control plane [UpdateMeResult](https://774589.apidog.io/updatemeresult-18069995d0.md): - prorm control plane [CapabilitiesView](https://774589.apidog.io/capabilitiesview-18069996d0.md): - prorm control plane [SessionLimits](https://774589.apidog.io/sessionlimits-18069997d0.md): - prorm control plane [Device](https://774589.apidog.io/device-18069998d0.md): - prorm control plane [DeviceListed](https://774589.apidog.io/devicelisted-18069999d0.md): - prorm control plane [DeviceTeamRef](https://774589.apidog.io/deviceteamref-18070000d0.md): - prorm control plane [DeviceCommand](https://774589.apidog.io/devicecommand-18070001d0.md): - prorm control plane [DeviceAuditLine](https://774589.apidog.io/deviceauditline-18070002d0.md): - prorm control plane [DeviceActionRequest](https://774589.apidog.io/deviceactionrequest-18070003d0.md): - prorm control plane [StaffActionRequest](https://774589.apidog.io/staffactionrequest-18070004d0.md): - prorm control plane [ManagedSession](https://774589.apidog.io/managedsession-18070005d0.md): - prorm control plane [SessionRevoked](https://774589.apidog.io/sessionrevoked-18070006d0.md): - prorm control plane [AccessRule](https://774589.apidog.io/accessrule-18070007d0.md): - prorm control plane [AccessRuleRequest](https://774589.apidog.io/accessrulerequest-18070008d0.md): - prorm control plane [BehaviourProfile](https://774589.apidog.io/behaviourprofile-18070009d0.md): - prorm control plane [BehaviourProfileRequest](https://774589.apidog.io/behaviourprofilerequest-18070010d0.md): - prorm control plane [BehaviourProfileSaved](https://774589.apidog.io/behaviourprofilesaved-18070011d0.md): - prorm control plane [BehaviourFinding](https://774589.apidog.io/behaviourfinding-18070012d0.md): - prorm control plane [BehaviourFindingAck](https://774589.apidog.io/behaviourfindingack-18070013d0.md): - prorm control plane [StepUpProof](https://774589.apidog.io/stepupproof-18070014d0.md): - prorm control plane [Removed](https://774589.apidog.io/removed-18070015d0.md): - prorm control plane [MemberLockdownRequest](https://774589.apidog.io/memberlockdownrequest-18070016d0.md): - prorm control plane [McpClient](https://774589.apidog.io/mcpclient-18070017d0.md): - prorm control plane [McpDelegatedView](https://774589.apidog.io/mcpdelegatedview-18070018d0.md): - prorm control plane [McpToolCall](https://774589.apidog.io/mcptoolcall-18070019d0.md): - prorm control plane [McpForwardRequest](https://774589.apidog.io/mcpforwardrequest-18070020d0.md): - prorm control plane [PasswordlessScope](https://774589.apidog.io/passwordlessscope-18070021d0.md): - prorm control plane [RoleScope](https://774589.apidog.io/rolescope-18070022d0.md): - prorm control plane [PasswordlessSession](https://774589.apidog.io/passwordlesssession-18070023d0.md): - prorm control plane [PasswordlessTlsMaterial](https://774589.apidog.io/passwordlesstlsmaterial-18070024d0.md): - prorm control plane [PasswordlessKerberosMaterial](https://774589.apidog.io/passwordlesskerberosmaterial-18070025d0.md): - prorm control plane [ServiceDeviceKeys](https://774589.apidog.io/servicedevicekeys-18070026d0.md): - prorm control plane [ServiceSession](https://774589.apidog.io/servicesession-18070027d0.md): - prorm control plane [DatabaseRole](https://774589.apidog.io/databaserole-18070028d0.md): - prorm control plane [TransferEndpoint](https://774589.apidog.io/transferendpoint-18070029d0.md): - prorm control plane [TransferJobRequest](https://774589.apidog.io/transferjobrequest-18070030d0.md): - prorm control plane [TransferQuote](https://774589.apidog.io/transferquote-18070031d0.md): - prorm control plane [TransferStrategy](https://774589.apidog.io/transferstrategy-18070032d0.md): - prorm control plane [TransferJob](https://774589.apidog.io/transferjob-18070033d0.md): - prorm control plane [TransferJobAccess](https://774589.apidog.io/transferjobaccess-18070034d0.md): - prorm control plane [Pool](https://774589.apidog.io/pool-18070035d0.md): - prorm control plane [PoolAllowance](https://774589.apidog.io/poolallowance-18070036d0.md): - prorm control plane [BillingSubscription](https://774589.apidog.io/billingsubscription-18070037d0.md): - prorm control plane [Invoice](https://774589.apidog.io/invoice-18070038d0.md): - prorm control plane [BillingContact](https://774589.apidog.io/billingcontact-18070039d0.md): - prorm control plane [PaymentMethod](https://774589.apidog.io/paymentmethod-18070040d0.md): - prorm control plane [UpcomingCharges](https://774589.apidog.io/upcomingcharges-18070041d0.md): - prorm control plane [TeamBilling](https://774589.apidog.io/teambilling-18070042d0.md): - prorm control plane [TeamKerberosRealm](https://774589.apidog.io/teamkerberosrealm-18070043d0.md): - prorm control plane [TeamSsoDomain](https://774589.apidog.io/teamssodomain-18070044d0.md): - prorm control plane [TeamSsoResponse](https://774589.apidog.io/teamssoresponse-18070045d0.md): - prorm control plane [StoreConnection](https://774589.apidog.io/storeconnection-18070046d0.md): - prorm control plane [BatchFailure](https://774589.apidog.io/batchfailure-18070047d0.md): - prorm control plane [ProxyStatus](https://774589.apidog.io/proxystatus-18070048d0.md):