Operate — telemetry, drift, and day-to-day running

Telemetry and retention

Every invoke attempt writes one telemetry event — requests and responses redacted before logging (emails, tokens, API keys, card-shaped values never land in the pipeline). What you can query is bound to your plan:

Querying beyond your window returns the data with a locked: true flag and an upgrade nudge — never an error. The console locks older windows visually and offers wider ranges only where your plan allows.

Drift detection

Your API will change; Operate watches for it. A scheduled sweeper re-runs the eval contract probes against your frozen prod snapshots (every 30 minutes by default):

• Breaking changes open an alert per tool; fixes resolve it. Only

one open alert per tool — re-runs refresh instead of spamming.

• Alerts and check history live on Operate → Drift; open/resolve events are

audit-logged.

• Safety first: write tools are never probed on a schedule, OAuth tools

are skipped, and checks are observation-only — they never mutate your upstream.

Proactive notification (email/Slack) is on the roadmap; until then, alerts surface in Operate and the audit log.

Gateway keys

Call your released connector from scripts, MCP clients, and GPT Actions without a human login. Project-scoped keys (cf_live_…):

• Created per project, shown once at mint time, hashed at rest (only a

display prefix is ever visible again). Optional expiry; soft revoke.

• Send as Authorization: Bearer cf_live_… or X-API-Key: cf_live_… —

both are honored.

• Bad, expired, or revoked keys get 401; another project's key gets 404

(no existence leak). Keyed traffic joins its own rate-limit bucket and is attributed in telemetry as api-key:<prefix>.

• Manage them in Operate → Gateway keys. Viewers can read, not create.

Rate limits

Invoke is guarded by two fixed-window buckets: per project (600/min) and per IP (1200/min), env-tunable. Abuse gets 429 with Retry-After and X-RateLimit-* headers; other projects are unaffected. The IP bucket is checked before auth, the project bucket after — outsiders hammering your project can't spend your quota.

Usage and billing

Usage is metered as a pure aggregation over telemetry — one row per invoke attempt, no second counter to drift. The billing screen shows per-project and per-tier counts over calendar-month windows, and can reconcile metered usage against Stripe invoice lines when billing is live.

Export and delete

Export downloads your whole project as one JSON file (specs, tools, recovery rules, review items, eval runs, releases, jobs, telemetry). Delete is hard and immediate (owner-only): every row is removed and only an audit tombstone remains.

Stuck? hello@connectorfoundry.com — include the X-Request-Id from any failing call and we'll find it fast.