The data layer your agents actually use

# Define a collection schema
rekor collections upsert incidents \
  --schema '{"type":"object","properties":{"title":{"type":"string"}}}'

# Upsert a record by external ID
rekor records upsert incidents \
  --external-id INC-2847 --source pagerduty \
  --data '{"title":"API spike","severity":"p1"}'

# Link two records with a typed relationship
rekor relationships upsert \
  --type caused_by --source incidents/rec_1 \
  --target deployments/rec_2

# CLI — agent builders set up schemas and test in preview
npm install -g @rekor/cli
rekor collections upsert incidents --workspace my-ws--preview \
  --schema '{"type":"object","properties":{"title":{"type":"string"}}}'
rekor workspaces promote my-ws --from my-ws--preview

# MCP — production agents read and write records
{
  "mcpServers": {
    "rekor": { "url": "https://mcp.rekor.pro/sse?token=rec_..." }
  }
}

# REST — external systems integrate via HTTP
curl https://api.rekor.pro/v1/{workspace}/records/incidents \
  -H "Authorization: Bearer rec_..." \
  -d '{"data":{"title":"Alert from monitoring"}}'

# Atomic operations — all succeed or all fail
rekor batch --workspace my-workspace --operations '[
  {"type":"upsert_record","collection":"orders",
   "data":{"customer":"Acme","total":5000}},
  {"type":"upsert_record","collection":"line_items",
   "data":{"product":"Widget","qty":10}},
  {"type":"upsert_relationship",
   "rel_type":"contains",
   "source_collection":"orders","source_id":"ord_1",
   "target_collection":"line_items","target_id":"li_1"}
]'

# Up to 1,000 operations per batch
# Records, relationships, and collections supported

# Upload files with folder structure
rekor attachments upload incidents rec_abc \
  --filename docs/runbook.md --content-type text/markdown

rekor attachments upload incidents rec_abc \
  --filename docs/screenshots/error.png --content-type image/png

# Get a signed download URL for any file
rekor attachments url incidents rec_abc --filename docs/runbook.md

# List all files, or filter by folder
rekor attachments list incidents rec_abc --prefix docs/

# Same tool, different backends — the agent doesn't know the difference

# Upsert a Stripe invoice (proxied to Stripe API)
rekor records upsert invoices \
  --external-id inv_2847 --source stripe \
  --data '{"amount":5000,"status":"issued"}'

# Upsert a native record (stored in Rekor)
rekor records upsert notes \
  --data '{"title":"Follow up on invoice"}'

# Query records — same interface for both
rekor records query invoices --source stripe --limit 10

# Create a hook — external systems POST data to Rekor
rekor hooks create --workspace my-workspace \
  --name "PagerDuty Incidents" --collection incidents

# Hook returns a unique URL: /v1/{ws}/hooks/{hook_id}/ingest
# External system POSTs JSON → Rekor creates a record automatically

# Create a trigger — Rekor notifies you when data changes
rekor triggers create --workspace my-workspace \
  --name "Notify Slack on P1" --collection incidents \
  --url https://hooks.slack.com/services/T00/B00/xxx \
  --events '["create","update"]'

# When a record is created or updated, Rekor POSTs to the URL
# with an HMAC signature for authenticity

# Quick: create an endpoint with shorthand flags
rekor endpoints upsert invoicing-agent \
  --name "Invoicing Agent" \
  --tool "invoices:get,list" \
  --tool "payments:create,get,list" \
  --relationship "invoice_payment:list" \
  --batch "invoices:create,update" --batch "payments:create" \
  --sql-query

# Advanced: customize tool names and descriptions
rekor endpoints upsert invoicing-agent --config '{
  "name": "Invoicing Agent",
  "tools": [
    { "collection": "invoices", "operations": ["get", "list"],
      "name_override": "search_invoices",
      "description_override": "Find invoices by customer or status" }
  ]
}'

# Get the MCP connection URL
rekor endpoints url invoicing-agent
# → https://mcp.rekor.pro/e/invoicing-agent/mcp

# Create a scoped API key for a specific agent
rekor tokens create --name "client-a-agent" \
  --grants '[{
    "scope": {"workspaces": ["client-a"], "environments": ["production"]},
    "permissions": ["read:records", "write:records"]
  }]'

# Create a read-only key for a dashboard integration
rekor tokens create --name "dashboard-reader" \
  --grants '[{
    "scope": {"workspaces": ["*"]},
    "permissions": ["read:records", "read:collections"]
  }]'

# Group workspaces by client with tags
rekor workspaces create client-a --name "Client A" \
  --tags "client:acme,region:us"
rekor workspaces list --tag "client:acme"

# List and revoke keys
rekor tokens list
rekor tokens revoke <token_id>

# Create a preview workspace to experiment safely
rekor workspaces create-preview my-workspace --name "add-invoices"

# Agent works freely in preview — modify schemas, test with data
rekor collections upsert invoices \
  --workspace my-workspace--add-invoices \
  --schema '{"type":"object","properties":{"amount":{"type":"number"}}}'

# Human reviews and promotes to production
rekor workspaces promote my-workspace \
  --from my-workspace--add-invoices --dry-run

# Apply when ready
rekor workspaces promote my-workspace \
  --from my-workspace--add-invoices