Projects and environments
Console reference for projects, environments, the per-project Access page and an environment's Settings tab, with plan limits and required permissions.
Path: Projects
A project groups your deploy targets; an environment is one target and holds its keys (Environments and precedence).
Project list
/projects lists every project in your workspace: name, environments, creation date. On a plan with a project limit, the header and Plan allowance show how many you use. At the limit, New Project becomes an upgrade link for an owner or billing admin; we enforce the limit on the write.
Project page
/projects/[projectId] has two tabs, Environments and Access (Access only if you can read it).
Environments shows four figures (environments against your plan's limit, keys across all environments, the last write and where, the creation date) and a card per environment with its key count and last write. The counts come from version metadata; opening the page reads no value.
Header: New Environment (an upgrade link at your plan's limit) and the project menu: rename, delete, export an environment's values. Each card's menu: open, compare, export values, duplicate, activity, rename, delete.
Access page
/projects/[projectId]/access lists every grant on the project and its environments, grouped into Whole project and One environment: person, role, scope. Grant here to give someone an environment they do not reach at the workspace level; there is no separate production unlock.
Grant Access opens the form beside the list: member, role, and the project or one environment. The role list only offers roles whose permissions you hold at this project; we re-check every grant. Scope rules: Roles and permissions.
Environment settings
/projects/[projectId]/env/[environmentId]/settings, the Settings tab beside Parameters. Links to the old ?tab=settings address land here.
| Switch | What it does | Details |
|---|---|---|
| Write-only | Nobody views values here; deploys and CI still read them | Write-only environments |
| Require approval | A second person approves each change a person makes here | Change requests |
| Serve dynamic credentials over the API | Lets a machine identity mint credentials for itself. Shown once the environment holds a dynamic key | Dynamic engines |
Manage environment holds Rename, Duplicate (a new environment seeded from this one) and Delete Environment, the same dialogs as the environment menu.
CLI equivalents
| Console action | Command (penv project, penv env) |
|---|---|
| Create a project | penv project new |
| List projects | penv project ls |
| Create an environment | penv env new |
| List environments | penv env ls |
When penv push creates a project, we write the same project.created entry as the console, carrying the agent session that requested it.
Required permissions
Full matrix: Roles and permissions. Renaming or deleting an environment, copying values into a duplicate, and turning off write-only or require approval ask for step-up.
| Action | Permission | Audit entry |
|---|---|---|
| Open the project list | project:read | none |
| Create a project | project:create | project.created |
| Create an environment | environment:create on the project | environment.created |
| Open the Access page | member:read on the project | none |
| Grant a role | member:role_assign at the target scope | role.assigned |
| Revoke a grant | member:role_assign at that scope | role.unassigned |
| Open an environment's Settings tab | secret:read on the environment | none |
| Turn write-only on or off | environment:update on the environment | environment.write_only_enabled, environment.write_only_disabled |
| Turn require approval on or off | environment:update on the environment | environment.approval_required, environment.approval_not_required |
| Serve dynamic credentials over the API | dynamic:configure on the org | integration.lease_api_changed |
| Duplicate an environment | environment:create and secret:write on the project, secret:read on the source | environment.created, with duplicatedFrom |
| Duplicate with its values | the above, plus secret:reveal on the source | also secret.read and secret.write per copied value |
| Rename an environment | environment:update on the environment | environment.renamed |
| Delete an environment | environment:delete on the environment | environment.deleted |
role.assigned and role.unassigned are absent from the Audit Log action filter.
Next: Parameters.
The console
Console sidebar rows and the permission each needs, what the Overview shows, how a missing permission renders, and terminal sign-in approval.
Parameters
Console reference for parameters: the key list, setting values, version history, the Schema card, comparing environments, CLI equivalents, and required permissions.