Manage Upstash Vector indexes and QStash credentials via the Upstash Developer API and rotate credentials safely

Documented steps

1. Authenticate as with all Developer API calls: HTTP Basic auth with EMAIL:API_KEY against base URL https://api.upstash.com/v2 (create the key under Account > Management API).
2. Create a Vector index: POST https://api.upstash.com/v2/vector/index with required name, region (eu-west-1, us-east-1, us-central1), similarity_function (COSINE | EUCLIDEAN | DOT_PRODUCT) and dimension_count; optional type (payg | fixed | paid), embedding_model (BGE_SMALL_EN_V1_5, BGE_BASE_EN_V1_5, BGE_LARGE_EN_V1_5, BGE_M3), index_type (DENSE | SPARSE | HYBRID) and sparse_embedding_model (BM25 | BGE_M3).
3. Unlike the Redis endpoints, the Vector create response includes live credentials directly: id, name, endpoint, token, read_only_token, plus similarity_function, dimension_count, embedding_model, type and region. Treat these responses as secrets and never log them.
4. List all indexes: GET https://api.upstash.com/v2/vector/index returns an array of VectorIndex objects (also carrying token and read_only_token).
5. Get one: GET https://api.upstash.com/v2/vector/index/{id}.
6. Delete: DELETE https://api.upstash.com/v2/vector/index/{id} — permanent.
7. Rotate Vector credentials: POST https://api.upstash.com/v2/vector/index/{id}/reset-password resets BOTH the regular and read-only tokens of the index. The old tokens stop working as soon as the call succeeds.
8. QStash scope limit — the Developer API does NOT expose endpoints to create or manage QStash queues, schedules, URL groups, messages or the DLQ. Those live entirely in the separate QStash REST API (https://qstash.upstash.io/v2/...) authenticated with the QStash token, not with Basic auth against api.upstash.com. Do not look for management-API equivalents.
9. What the Developer API does expose for QStash is account-level: GET https://api.upstash.com/v2/qstash/user/{id} for one QStash user's plan/limits/config and GET https://api.upstash.com/v2/qstash/users to list them. Both return a QStashUser object with customer_id, id, token, read_only_token, active, state and modifying_state.
10. Rotate QStash credentials: POST https://api.upstash.com/v2/qstash/rotate-token/{id} resets the authentication credentials, invalidating the old password and token and generating new ones, returning updated user information.
11. Safe-rotation pattern for both resource types: call the reset/rotate endpoint, capture the new token and read_only_token from the response, deploy the new values to every consumer's secret store, then verify a live request succeeds before declaring the rotation complete. No grace period where old and new tokens both work is documented.
12. For Redis credential rotation use the dedicated POST https://api.upstash.com/v2/redis/reset-password/{id} instead — each resource type has its own rotate path. Official docs: https://upstash.com/docs/devops/developer-api/introduction | https://upstash.com/docs/devops/developer-api/vector/create_index | https://upstash.com/docs/devops/developer-api/vector/reset_index_passwords | https://upstash.com/docs/api-reference/qstash/reset-qstash-token