Skip to main content
POST
Issue one time-bound PostgreSQL credential for Dev or Prod

Authorizations

Authorization
string
header
required

WorkOS access JWT or a user-owned WorkOS API key. User keys are bound to one organization and restricted to their enabled product permissions. Session-only onboarding and session revocation require an interactive access JWT. No cookie session is assumed.

Headers

X-Request-Id
string

Optional caller-provided correlation identifier.

Required string length: 1 - 128

Path Parameters

project_id
string
required

Project identifier.

Pattern: ^[0-9A-HJKMNP-TV-Z]{26}$

Body

application/json
environment
enum<string>
required
Available options:
dev,
prod
mode
enum<string>
default:read

read joins the read-only role; write joins the restricted runtime role. Neither can change schema.

Available options:
read,
write
ttl_seconds
integer
default:3600

Credential lifetime between 5 minutes and 24 hours.

Required range: 300 <= x <= 86400
label
string | null

Optional customer label without control characters or surrounding whitespace.

Required string length: 1 - 64

Response

The connection URI is returned once and is never persisted in plaintext.

database
string
required

neondb for a transitional Neon credential; the exact 20-character PGCF database identity for WSS.

Allowed value: "neondb"
access_id
string
required
Pattern: ^[0-9A-HJKMNP-TV-Z]{26}$
environment
enum<string>
required
Available options:
dev,
prod
mode
enum<string>
required
Available options:
read,
write
role_name
string
required
Pattern: ^ohmyho_da_[0-7][0-9a-hjkmnp-tv-z]{25}_[0-9a-z]{8}$
host
string
required
Required string length: 1 - 253
label
string | null
required
Required string length: 1 - 64
state
enum<string>
required
Available options:
active,
expired,
revoked
issued_at
string<date-time>
required
expires_at
string<date-time>
required
revoked_at
string<date-time> | null
required
revocation_reason
enum<string> | null
required
Available options:
principal,
expired,
budget,
creation_failed,
data_change,
null
connection_uri
string<uri>
required

Returned once as credential material. For PGCF this identifies a WSS transport, never direct public TCP. Never place it in command arguments, files, notes or source.

psql_command
string
required

For PGCF, a secret-free ohmyhost database psql invocation that obtains and revokes its own session credential. Transitional Neon responses retain their original direct invocation.

provider
string
Allowed value: "pgcf"
transport
string
Allowed value: "wss"
websocket_url
string<uri>

Verified WSS origin ending in / and matching host. The local bridge adds /v2 and the bound database and user; no public PostgreSQL TCP endpoint.