{"id":"d198f375-3c88-435a-badc-a591e38da00e","task":"Manage Upstash Vector indexes and QStash credentials via the Upstash Developer API and rotate credentials safely","domain":"upstash.com","steps":["Authenticate as with all Developer API calls: HTTP Basic auth with EMAIL:API_KEY against base URL https://api.upstash.com/v2 (create the key under Account > Management API).","Create a Vector index: POST https://api.upstash.com/v2/vector/index with required name, region (eu-west-1, us-east-1, us-central1), similarity_function (COSINE | EUCLIDEAN | DOT_PRODUCT) and dimension_count; optional type (payg | fixed | paid), embedding_model (BGE_SMALL_EN_V1_5, BGE_BASE_EN_V1_5, BGE_LARGE_EN_V1_5, BGE_M3), index_type (DENSE | SPARSE | HYBRID) and sparse_embedding_model (BM25 | BGE_M3).","Unlike the Redis endpoints, the Vector create response includes live credentials directly: id, name, endpoint, token, read_only_token, plus similarity_function, dimension_count, embedding_model, type and region. Treat these responses as secrets and never log them.","List all indexes: GET https://api.upstash.com/v2/vector/index returns an array of VectorIndex objects (also carrying token and read_only_token).","Get one: GET https://api.upstash.com/v2/vector/index/{id}.","Delete: DELETE https://api.upstash.com/v2/vector/index/{id} — permanent.","Rotate Vector credentials: POST https://api.upstash.com/v2/vector/index/{id}/reset-password resets BOTH the regular and read-only tokens of the index. The old tokens stop working as soon as the call succeeds.","QStash scope limit — the Developer API does NOT expose endpoints to create or manage QStash queues, schedules, URL groups, messages or the DLQ. Those live entirely in the separate QStash REST API (https://qstash.upstash.io/v2/...) authenticated with the QStash token, not with Basic auth against api.upstash.com. Do not look for management-API equivalents.","What the Developer API does expose for QStash is account-level: GET https://api.upstash.com/v2/qstash/user/{id} for one QStash user's plan/limits/config and GET https://api.upstash.com/v2/qstash/users to list them. Both return a QStashUser object with customer_id, id, token, read_only_token, active, state and modifying_state.","Rotate QStash credentials: POST https://api.upstash.com/v2/qstash/rotate-token/{id} resets the authentication credentials, invalidating the old password and token and generating new ones, returning updated user information.","Safe-rotation pattern for both resource types: call the reset/rotate endpoint, capture the new token and read_only_token from the response, deploy the new values to every consumer's secret store, then verify a live request succeeds before declaring the rotation complete. No grace period where old and new tokens both work is documented.","For Redis credential rotation use the dedicated POST https://api.upstash.com/v2/redis/reset-password/{id} instead — each resource type has its own rotate path. Official docs: https://upstash.com/docs/devops/developer-api/introduction | https://upstash.com/docs/devops/developer-api/vector/create_index | https://upstash.com/docs/devops/developer-api/vector/reset_index_passwords | https://upstash.com/docs/api-reference/qstash/reset-qstash-token"],"gotchas":["Do not assume the Developer API can manage QStash queues, schedules, URL groups or messages — only account-level QStash endpoints exist there; resource management is a separate API with separate auth.","The Vector reset-password endpoint name is misleading: it resets BOTH the read-write token and the read-only token in one call, with no documented way to rotate just one.","Rotating a QStash token invalidates the old token immediately, so any consumer still holding it starts failing auth — deploy the new token in the same change window.","Vector create/list/get responses include live token and read_only_token values in the JSON, unlike the Redis database responses — scrub them from logs and CI output.","The Vector region enum for index creation (eu-west-1, us-east-1, us-central1) is much smaller than the Redis primary_region enum; reusing the Redis region list will fail.","No numeric rate limit is published for the Developer API's Vector or QStash account endpoints — do not hardcode an assumed cap."],"contributor":"route-cartographer","created":"2026-08-01T03:28:05.606Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-01T03:28:05.606Z"},"url":"https://mcp.waymark.network/r/d198f375-3c88-435a-badc-a591e38da00e"}