Environments

Rekor bases support two environments: production and preview. Agents experiment freely in preview bases, and a human operator promotes validated config to production.

How It Works

1. Production base — the live environment. Agents can read everything and write records, but cannot change the schema (record_types, triggers, inbound webhooks).
2. Preview base — a sandbox linked to a production base. Agents have full access: modify schemas, create test records, configure triggers.
3. Promote — a human-only operation that copies config from preview to production after review. Records stay in preview.

Access Control

Operation	Production	Preview
Read record_types, records, relationships	Yes	Yes
Write records and relationships	Yes	Yes
Upsert/delete record_types	No	Yes
Create/delete triggers and inbound webhooks	No	Yes
Promote	Human only (CLI)	N/A

Workflow

1. Create a preview base

rekor bases create-preview my-base --name "add-invoices"

2. Agent works in preview

# Add a new record_type
rekor record-types upsert invoices \
  --base my-base--add-invoices \
  --schema '{"type":"object","properties":{"amount":{"type":"number"},"status":{"type":"string"}}}'

# Test with sample records
rekor records upsert invoices \
  --base my-base--add-invoices \
  --data '{"amount": 5000, "status": "draft"}'

3. Review and promote (human)

# See what would change
rekor bases promote my-base \
  --from my-base--add-invoices --dry-run

# Apply
rekor bases promote my-base \
  --from my-base--add-invoices

4. Rollback if needed

# List promotions
rekor bases promotions my-base

# Rollback a specific promotion
rekor bases rollback my-base --promotion <promotion-id>

What Gets Promoted

Only config is promoted — not data:

• RecordTypes — JSON Schema, display hints, external sources
• Triggers — webhook dispatch rules (new secrets generated on production side)
• Inbound Webhooks — receivers (new secrets generated)

Records and relationships in the preview base are test data and stay behind.

External-source credentials are never copied across environments. A record_type's external source is promoted, but its inline credential is not — set it on the production base directly. Until you do, a newly promoted source stays unconfigured and requests to it fail with a clear "no usable credential configured" error. (Credentials stored as a vault reference travel by reference and need no extra step.)

Schema Compatibility

When promoting a modified record_type schema, Rekor samples existing production records and validates them against the new schema. Breaking changes (removed required fields, type changes) are flagged before they can be applied.

Promotion is also blocked if it would break a published toolset — for example removing a record_type or relationship type the toolset exposes, or a field its typed filters depend on. Include that toolset in the same promotion (or adjust it) to proceed. A dry run lists any such conflicts before you promote.

Multiple Previews

A production base can have multiple preview bases. Each is independent — different agents or team members can experiment on different features in parallel.