Instant claim provisioning
POST /claims provisions the real resource on the named engine, pins a version, mints a Vault credential and returns a ready binding — one call, no console clickops, no capacity request.
Capability group 04
A claim provisions in one API call with a ready binding — no capacity planning. Branching is expressed as point-in-time restore to a NEW claim: fork the state of any claim as of a timestamp into a fresh, independently-credentialed database. A CDC pull seam drains ordered change events, and dynamic Vault leases keep every credential short-lived. We are candid where we trail Neon — see the honest gap below.
Instant provisioning · PITR branches · CDC
Sub-capabilities
POST /claims provisions the real resource on the named engine, pins a version, mints a Vault credential and returns a ready binding — one call, no console clickops, no capacity request.
Restore is always to a NEW cluster, never in place: fork a claim's state as of at into a fresh claim named new_name. That fresh claim is a branch — independently credentialed, safe to write, cheap to throw away.
The same primitive is disaster recovery: restore to any point in the retention window. PITR of 10 GB completes in ≤30 min with RPO ≤5 min; the request, actor and target timestamp are audit-chained.
GET …/cdc is the CDC pull seam: the SS-03 relay drains ordered change events (put/delete/expire) and republishes them to the claim's declared subject. Read forward from ?cursor= and resume from the returned cursor.
Every consumer draws a short-lived lease per claim (≤1h TTL), validated engine-side; rotation mints a new Vault version with no downtime. A stolen credential has a one-hour blast radius.
Endpoints
Method + path straight from the SS-02 OpenAPI spec. Governed routes take an SS-01 bearer token and, where marked, an X-Tenant-Id; the S3 wire gateway authenticates with AWS SigV4 instead.
/api/v1/claimsbearertenantidempotency-keyInstant provisioning: create + provision a claim and return a ready binding.
/api/v1/claims/{name}/restorebearertenantPITR/branch — restore the source claim as of at into a NEW claim new_name.
/api/v1/claims/{name}/cdcbearertenantCDC pull seam; read forward from ?cursor=, resume from the returned cursor.
/api/v1/claims/{name}/leasesbearertenantIssue a dynamic credential lease (TTL capped at the one-hour ceiling).
/api/v1/claims/{name}/leases/{id}bearertenantValidate a lease engine-side; expired/rotated/foreign leases fail.
/api/v1/claims/{name}/rotatebearertenantidempotency-keyRotate the credential with no downtime; DSN unchanged.
Worked example
# A branch is a point-in-time restore to a NEW claim. Fork the state
# of `orders` as of 11:00 into an independently-credentialed database.
curl -X POST "$BASE/claims/orders/restore" \
-H "Authorization: Bearer $TOKEN" -H "X-Tenant-Id: acme" \
-H "Content-Type: application/json" \
-d '{"new_name":"orders-preview","at":"2026-07-05T11:00:00Z"}'
# → 201 the newly-provisioned claim `orders-preview`
# (same shape as POST /claims) with its OWN binding & secret_ref.
# Read the branch's credential-free binding and connect a driver.
curl "$BASE/claims/orders-preview/binding" \
-H "Authorization: Bearer $TOKEN" -H "X-Tenant-Id: acme"
# → {"dsn":"postgresql://orders-preview.acme.ss-02.svc:5433/…",…}
# Refusals are explicit: new_name must differ from the source
# (in-place restore is refused → 400).This is our branching primitive today — a real fork with its own credentials. It is NOT yet Neon-class copy-on-write / scale-to-zero branching; that is our stated direction, and we say so on /compare.
In the architecture
Provisioning, restore and CDC all run on the one claim plane, so a branch inherits the source engine's isolation, encryption and backup posture automatically. Restore-to-new-cluster is deliberate: it never mutates the source, so a branch can never corrupt production. CDC hands off to the SS-03 bus relay; leases resolve against SS-05 Vault.
Explore the rest of the platform. Relational SQL · Polyglot engines & tiers · Object storage (S3/R2) · Data governance & isolation
Get started →