The data layer your agents actually use

# Define a record_type schema
rekor record-types upsert incidents \
  --schema '{"type":"object","properties":{"title":{"type":"string"}}}'

# Upsert a record by external ID
rekor records upsert incidents \
  --external-id INC-2847 --external-source pagerduty \
  --data '{"title":"API spike","severity":"p1"}'

# Declare the relationship type, then link two records
rekor relationship-types upsert caused_by \
  --source-record_types '["incidents"]' --target-record_types '["deployments"]'
rekor relationships upsert \
  --type caused_by --source incidents/rec_1 \
  --target deployments/rec_2

# CLI — agent builders set up schemas and test in preview
npm install -g rekor-cli
rekor record-types upsert incidents --base my-ws--preview \
  --schema '{"type":"object","properties":{"title":{"type":"string"}}}'
rekor bases promote my-ws --from my-ws--preview

# MCP — production agents read and write records
{
  "mcpServers": {
    "rekor": { "url": "https://mcp.rekor.pro/mcp?token=rec_..." }
  }
}

# REST — external systems integrate via HTTP
curl https://api.rekor.pro/v1/{base_id}/records/incidents \
  -H "Authorization: Bearer rec_..." \
  -d '{"data":{"title":"Alert from monitoring"}}'

# Atomic operations — all succeed or all fail
rekor batch --base my-base --operations '[
  {"type":"upsert_record","record_type":"orders",
   "data":{"customer":"Acme","total":5000}},
  {"type":"upsert_record","record_type":"line_items",
   "data":{"product":"Widget","qty":10}},
  {"type":"upsert_relationship",
   "rel_type":"contains",
   "source_record_type":"orders","source_id":"ord_1",
   "target_record_type":"line_items","target_id":"li_1"}
]'

# Up to 1,000 operations per batch
# Records, relationships, and record_types supported

# Upload files with folder structure
rekor attachments upload incidents rec_abc \
  --filename docs/runbook.md --content-type text/markdown

rekor attachments upload incidents rec_abc \
  --filename docs/screenshots/error.png --content-type image/png

# Get a signed download URL for any file
rekor attachments url incidents rec_abc --filename docs/runbook.md

# List all files, or filter by folder
rekor attachments list incidents rec_abc --prefix docs/

# Same tool, different backends — the agent doesn't know the difference

# Upsert a Stripe invoice (proxied to Stripe API)
rekor records upsert invoices \
  --external-id inv_2847 --external-source stripe \
  --data '{"amount":5000,"status":"issued"}'

# Upsert a native record (stored in Rekor)
rekor records upsert notes \
  --data '{"title":"Follow up on invoice"}'

# Query records — same interface for both
rekor sql "SELECT * FROM records WHERE org_id = {org_id:String} AND base_id = {base_id:String} \
  AND record_type = 'invoices' AND deleted = false LIMIT 10" --base my-base

# Create an inbound webhook — external systems POST data to Rekor
rekor inbound-webhooks create --base my-base \
  --name "PagerDuty Incidents" --secret <hmac-secret> \
  --record_type-scope incidents

# Inbound webhook returns a unique URL: /inbound/{org}/{db}/{inbound_webhook_id}/ingest
# External system POSTs JSON → Rekor creates a record automatically

# Create a trigger — Rekor notifies you when data changes
rekor triggers create --base my-base \
  --name "Notify Slack on P1" --record_type-scope incidents \
  --url https://hooks.slack.com/services/T00/B00/xxx \
  --secret <hmac-secret> \
  --events record.created,record.updated

# When a record is created or updated, Rekor POSTs to the URL
# with an HMAC signature for authenticity

# 1. Author first-class actions — one record_type + one operation each
rekor actions upsert get_invoice     --record_type invoices --operation get
rekor actions upsert search_invoices --record_type invoices --operation list \
  --description "Search invoices by customer, status, or date range"
rekor actions upsert create_payment  --record_type payments --operation create
rekor actions upsert list_payments   --record_type payments --operation list

# 2. Compose a toolset that references those actions by id
rekor toolsets upsert invoicing-agent \
  --name "Invoicing Agent" \
  --action get_invoice --action search_invoices \
  --action create_payment --action list_payments \
  --relationship "invoice_payment:list" \
  --batch "invoices:create,update" --batch "payments:create" \
  --sql-query

# Get the MCP connection URL
rekor toolsets url invoicing-agent
# → https://mcp.rekor.pro/t/invoicing-agent/mcp

# Create a scoped API key for a specific agent
rekor tokens create --name "client-a-agent" \
  --grants '[{
    "scope": {"bases": ["client-a"], "environments": ["production"]},
    "permissions": ["read:records", "write:records"]
  }]'

# Create a read-only key for a dashboard integration
rekor tokens create --name "dashboard-reader" \
  --grants '[{
    "scope": {"bases": ["*"]},
    "permissions": ["read:records", "read:record_types"]
  }]'

# Group bases by client with tags
rekor bases create client-a --name "Client A" \
  --tags "client:acme,region:us"
rekor bases list --tag "client:acme"

# List and revoke keys
rekor tokens list
rekor tokens revoke <token_id>

# Create a preview base to experiment safely
rekor bases create-preview my-base --name "add-invoices"

# Agent works freely in preview — modify schemas, test with data
rekor record-types upsert invoices \
  --base my-base--add-invoices \
  --schema '{"type":"object","properties":{"amount":{"type":"number"}}}'

# Human reviews and promotes to production
rekor bases promote my-base \
  --from my-base--add-invoices --dry-run

# Apply when ready
rekor bases promote my-base \
  --from my-base--add-invoices