DataStax Astra DevOps

Overview

Use a DataStax Astra application token to manage databases and keyspaces through the Astra DevOps API without exposing the token in code.

Note

Astra has two APIs and they do not share an authentication header. Use this provider to manage databases (create, list, terminate). To query data, use DataStax Astra DB (Data API) instead. The same application token works with both — only the header differs, so picking the wrong one returns HTTP 401 even though the token is valid.

Property	Value
Provider ID	astra-devops
Category	Database
Credential Type	Application Token
API host	api.astra.datastax.com (fixed)

Step 1: Get Credentials

Log in to the Astra Portal

Log in to the Astra Portal.

Generate an organization token

Open Settings > Tokens and generate a token with an organization-level role (Database Administrator or higher). A database-scoped token cannot manage databases.

Copy the token

Copy the application token (starts with AstraCS:) — it is only shown once.

Warning

Never share credentials publicly. Store them securely and only enter them in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add DataStax Astra DevOps

Go to Managed Secrets > Add Provider > DataStax Astra DevOps.

Enter credentials

Paste the Application Token into the credential field. The token is verified against the Astra DevOps API when you save.

Save

Click Save. You’ll receive a grant_id to use with the SDK.

Using in Code

response = await alter_app.request(
    HttpMethod.GET,
    "https://api.astra.datastax.com/v2/databases",
    grant_id="YOUR_GRANT_ID",
)

Notes

• The token is injected as Authorization: Bearer at the fixed host https://api.astra.datastax.com.
• Querying documents or vectors uses a different provider and a different header — see DataStax Astra DB (Data API).

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls. The catalog covers the complete published DevOps API surface — the same application token reaches every operation below, so destructive (delete) and administrative (admin) families are all governable.

Operation ID	Families	Method	Provider path
GetAccessListTemplate	admin, read	POST	/v2/access-list/template
ValidateAccessList	admin, read	POST	/v2/access-list/validate
GetAllAccessListsForOrganization	admin, read	GET	/v2/access-lists
listAvailableRegions	read	GET	/v2/availableRegions
getClientsForOrg	admin, read	GET	/v2/clientIdSecrets
generateTokenForClient	admin, write	POST	/v2/clientIdSecrets
deleteTokenForClient	admin, delete	DELETE	/v2/clientIdSecrets/{clientId}
getCurrentOrganization	read	GET	/v2/currentOrg
listDatabases	read	GET	/v2/databases
createDatabase	admin, write	POST	/v2/databases
getDatabase	read	GET	/v2/databases/{databaseID}
DeleteAddressesOrAccessListForDatabase	admin, delete	DELETE	/v2/databases/{databaseID}/access-list
GetAccessListForDatabase	admin, read	GET	/v2/databases/{databaseID}/access-list
UpdateAccessListForDatabase	admin, write	PATCH	/v2/databases/{databaseID}/access-list
AddAddressesToAccessListForDatabase	admin, write	POST	/v2/databases/{databaseID}/access-list
UpsertAccessListForDatabase	admin, write	PUT	/v2/databases/{databaseID}/access-list
listDatacenters	read	GET	/v2/databases/{databaseID}/datacenters
addDatacenters	admin, write	POST	/v2/databases/{databaseID}/datacenters
initializeMigrationDC	admin, write	POST	/v2/databases/{databaseID}/datacenters/{datacenterID}/migrations/initialize
terminateDatacenter	admin, delete	POST	/v2/databases/{databaseID}/datacenters/{datacenterID}/terminate
updateEngineType	admin, write	PUT	/v2/databases/{databaseID}/engineType
removeKeyspace	admin, delete	DELETE	/v2/databases/{databaseID}/keyspaces/{keyspaceName}
addKeyspace	admin, write	POST	/v2/databases/{databaseID}/keyspaces/{keyspaceName}
alterKeyspaceWithGraphEngine	admin, write	POST	/v2/databases/{databaseID}/keyspaces/{keyspaceName}/actions/alterWithGraphEngine
createSolrIndex	admin, write	POST	/v2/databases/{databaseID}/keyspaces/{keyspaceName}/tables/{tableName}/solr/createCorewithconfigs
initializeMigration	admin, write	POST	/v2/databases/{databaseID}/migrations/initialize
getMigrationStatus	read	GET	/v2/databases/{databaseID}/migrations/{migrationID}
abortMigration	admin, write	POST	/v2/databases/{databaseID}/migrations/{migrationID}/abort
cleanupMigration	admin, write	POST	/v2/databases/{databaseID}/migrations/{migrationID}/cleanup
launchMigration	admin, write	POST	/v2/databases/{databaseID}/migrations/{migrationID}/launch
pauseMigration	admin, write	POST	/v2/databases/{databaseID}/migrations/{migrationID}/pause
resumeMigration	admin, write	POST	/v2/databases/{databaseID}/migrations/{migrationID}/resume
resetPassword	admin, write	POST	/v2/databases/{databaseID}/resetPassword
resizeDatabase	admin, write	POST	/v2/databases/{databaseID}/resize
generateSecureBundleURL	admin, read	POST	/v2/databases/{databaseID}/secureBundleURL
listSnapshots	read	GET	/v2/databases/{databaseID}/snapshots
getTelemetryConfig	admin, read	GET	/v2/databases/{databaseID}/telemetry/metrics
configureTelemetry	admin, write	POST	/v2/databases/{databaseID}/telemetry/metrics
terminateDatabase	admin, delete	POST	/v2/databases/{databaseID}/terminate
cloneFromDB	admin, write	POST	/v2/databases/{targetDBID}/cloneFrom/{sourceDBID}
cloneStatus	read	GET	/v2/databases/{targetDBID}/cloneStatus/{operationID}
generateReport	admin, write	POST	/v2/enterprises/billing-reports/generate-report
getReportDetails	admin, read	GET	/v2/enterprises/billing-reports/{reportId}
GetEnterpriseConsumption	admin, read	POST	/v2/enterprises/consumption
createOrganizationInEnterprise	admin, write	POST	/v2/enterprises/organizations
get:/v2/kms	admin, read	GET	/v2/kms
post:/v2/kms	admin, write	POST	/v2/kms
ListClassicKeys	admin, read	GET	/v2/kms/classic
CreateClassicKey	admin, write	POST	/v2/kms/classic
AssignCloudAccount	admin, write	POST	/v2/kms/classic/provider/{provider}/accounts
GetClassicKey	admin, read	GET	/v2/kms/classic/provider/{provider}/region/{region}
GetClassicCloudAccounts	admin, read	GET	/v2/kms/classic/provider/{provider}/region/{region}/accounts
GetServerlessKey	admin, read	GET	/v2/kms/provider/{provider}/region/{region}
GetServerlessCloudAccounts	admin, read	GET	/v2/kms/provider/{provider}/region/{region}/accounts
get:/v2/kms/serverless	admin, read	GET	/v2/kms/serverless
post:/v2/kms/serverless	admin, write	POST	/v2/kms/serverless
RemoveAllowedPrincipalFromService	admin, delete	DELETE	/v2/organizations/clusters/{clusterID}/datacenters/{datacenterID}/allowed-principals
AddAllowedPrincipal	admin, write	POST	/v2/organizations/clusters/{clusterID}/datacenters/{datacenterID}/allowed-principals
AcceptEndpointToService	admin, write	POST	/v2/organizations/clusters/{clusterID}/datacenters/{datacenterID}/endpoints
RejectEndpoint	admin, delete	DELETE	/v2/organizations/clusters/{clusterID}/datacenters/{datacenterID}/endpoints/{endpointID}
GetPrivateLinkEndpoint	admin, read	GET	/v2/organizations/clusters/{clusterID}/datacenters/{datacenterID}/endpoints/{endpointID}
UpdateEndpointDescription	admin, write	PUT	/v2/organizations/clusters/{clusterID}/datacenters/{datacenterID}/endpoints/{endpointID}
GetPrivateLinksForDatacenter	admin, read	GET	/v2/organizations/clusters/{clusterID}/datacenters/{datacenterID}/private-link
AddAllowedPrincipalToService	admin, write	POST	/v2/organizations/clusters/{clusterID}/datacenters/{datacenterID}/private-link
ListPrivateLinksForCluster	admin, read	GET	/v2/organizations/clusters/{clusterID}/private-link
getCustomDomains	admin, read	GET	/v2/organizations/customDomains
setCustomDomains	admin, write	POST	/v2/organizations/customDomains
ListPrivateLinksForOrg	admin, read	GET	/v2/organizations/private-link
getOrganizationRoles	admin, read	GET	/v2/organizations/roles
addOrganizationRole	admin, write	POST	/v2/organizations/roles
deleteOrganizationRole	admin, delete	DELETE	/v2/organizations/roles/{roleID}
getOrganizationRole	admin, read	GET	/v2/organizations/roles/{roleID}
updateRole	admin, write	PUT	/v2/organizations/roles/{roleID}
getOrganizationUsers	admin, read	GET	/v2/organizations/users
inviteUserToOrganization	admin, write	PUT	/v2/organizations/users
removeUserFromOrganization	admin, delete	DELETE	/v2/organizations/users/{userID}
getOrganizationUser	admin, read	GET	/v2/organizations/users/{userID}
UpdateRolesForUserInOrganization	admin, write	PUT	/v2/organizations/users/{userID}/roles
deleteAuditLogExporterConfig	admin, delete	DELETE	/v2/organizations/{orgID}/telemetry/auditLogs
getAuditLogExporterConfig	admin, read	GET	/v2/organizations/{orgID}/telemetry/auditLogs
setAuditLogExporterConfig	admin, write	POST	/v2/organizations/{orgID}/telemetry/auditLogs
delete:/v2/organizations/{orgId}/devops-acl	admin, delete	DELETE	/v2/organizations/{orgId}/devops-acl
get:/v2/organizations/{orgId}/devops-acl	admin, read	GET	/v2/organizations/{orgId}/devops-acl
patch:/v2/organizations/{orgId}/devops-acl	admin, write	PATCH	/v2/organizations/{orgId}/devops-acl
post:/v2/organizations/{orgId}/devops-acl	admin, write	POST	/v2/organizations/{orgId}/devops-acl
put:/v2/organizations/{orgId}/devops-acl	admin, write	PUT	/v2/organizations/{orgId}/devops-acl
pcuCreate	admin, write	POST	/v2/pcus
pcuUpdate	admin, write	PUT	/v2/pcus
pcuGet	read	POST	/v2/pcus/actions/get
pcuGroupGetByDatacenterUUID	read	GET	/v2/pcus/actions/get/{datacenterUUID}
pcuAssociationTransfer	admin, write	POST	/v2/pcus/association/transfer
pcuAssociationGet	read	GET	/v2/pcus/association/{pcuGroupUUID}
pcuAssociationDelete	admin, delete	DELETE	/v2/pcus/association/{pcuGroupUUID}/{datacenterUUID}
pcuAssociationCreate	admin, write	POST	/v2/pcus/association/{pcuGroupUUID}/{datacenterUUID}
pcuGroupPark	admin, write	POST	/v2/pcus/park/{pcuGroupUUID}
pcuGetTypes	read	POST	/v2/pcus/types
pcuGroupUnpark	admin, write	POST	/v2/pcus/unpark/{pcuGroupUUID}
pcuDelete	admin, delete	DELETE	/v2/pcus/{pcuGroupUUID}
DeleteVPCPeeringConnection	admin, delete	DELETE	/v2/peering/provider/{provider}/database/{databaseID}
GetVPCPeeringConnectionDetails	admin, read	GET	/v2/peering/provider/{provider}/database/{databaseID}
CreateVPCPeeringConnection	admin, write	POST	/v2/peering/provider/{provider}/database/{databaseID}
listServerlessRegions	read	GET	/v2/regions/serverless
getSCIMResourceTypes	admin, read	GET	/v2/scim/ResourceTypes
getSCIMSchemas	admin, read	GET	/v2/scim/Schemas
getSCIMServiceProviderConfig	admin, read	GET	/v2/scim/ServiceProviderConfig
listSCIMGroups	admin, read	GET	/v2/scim/groups
createSCIMGroup	admin, write	POST	/v2/scim/groups
deleteSCIMGroup	admin, delete	DELETE	/v2/scim/groups/{groupID}
getSCIMGroup	admin, read	GET	/v2/scim/groups/{groupID}
patchSCIMGroup	admin, write	PATCH	/v2/scim/groups/{groupID}
updateSCIMGroup	admin, write	PUT	/v2/scim/groups/{groupID}
listSCIMUsers	admin, read	GET	/v2/scim/users
createSCIMUser	admin, write	POST	/v2/scim/users
deleteSCIMUser	admin, delete	DELETE	/v2/scim/users/{userID}
getSCIMUser	admin, read	GET	/v2/scim/users/{userID}
patchSCIMUser	admin, write	PATCH	/v2/scim/users/{userID}
updateSCIMUser	admin, write	PUT	/v2/scim/users/{userID}
deleteToken	admin, delete	DELETE	/v2/tokens
getTokensForOrg	admin, read	GET	/v2/tokens
createToken	admin, write	POST	/v2/tokens
deleteCDC	admin, delete	DELETE	/v3/databases/{databaseID}/cdc
getCDC	read	GET	/v3/databases/{databaseID}/cdc
enableCDC	admin, write	POST	/v3/databases/{databaseID}/cdc
updateCDC	admin, write	PUT	/v3/databases/{databaseID}/cdc
getCDCStatus	read	GET	/v3/databases/{databaseID}/keyspaces/{keyspaceName}/tables/{tableName}/cdc