Critical-risk tools in EchoRelay
19 of the 78 tools in EchoRelay are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
cancel_line_publishDestructiveCancel one line schedule before its two-minute lock.
-
delete_credentialDestructiveDelete a saved credential. Blocked (not a permission or not-found error — a validation error) while any target still references it; repoint or remove those targets first.
-
delete_endpointDestructiveDelete an endpoint and its targets, publishing the removal immediately. Requires edit access.
-
delete_lineDestructiveDelete a line and every endpoint under it, publishing the removal immediately. Requires edit access.
-
discard_dlq_entryDestructivePermanently delete a DLQ entry without retrying. Requires edit access.
-
discard_draft_endpointDestructiveDiscard one endpoint change from a line draft.
-
discard_line_draftDestructiveDiscard every unpublished change and schedule for one line.
-
remove_memberDestructiveRemove a member (accepted or pending) from this project by their member ID or email. Owner only.
-
revoke_api_keyDestructiveManual hard revoke. The key stops authenticating on the next request. Owner anywhere, editor on own keys.
-
revoke_project_tokenDestructiveRevoke a PROJECT-scoped API token on a project you own — any holder's, not just your own (the account-owner kill switch for a leaked or retired integration token). Soft-revoke: ...
-
rollback_configDestructivePublish a retained line revision immediately and clear any pending schedule.
-
cancel_subscriptionFinancialSchedule the project owner's subscription for cancellation at the end of the current billing period. Returns `{kind: 'scheduled', newPlan: 'free', effectiveAt}`. Add-ons keep re...
-
change_planFinancialSwitch the project owner between Pro and Scale, or cancel the subscription (effectively dropping to Free at period end). Returns `{kind, newPlan, effectiveAt, applied}` — `appli...
-
downgrade_addonFinancialSchedule a tier downgrade for a non-stackable add-on (RPM tier). The current tier stays active until `nextRenewalAt`; at that point the lower tier is charged and activated. No m...
-
retry_dlq_entryFinancialRe-enqueue a DLQ entry to the main relay stream and delete it from the DLQ. A replay is billed like any relay — it charges the entry's original credit cost to the project before...
-
start_subscriptionFinancialBegin a new Pro or Scale subscription for the project owner. Returns `{checkoutUrl, plan}` — surface the URL to the human for approval. Errors if the owner is already on an acti...
-
start_topupFinancialBegin a credit-pack top-up for the project owner. Pass the pack`s `eurCents` (from list_credit_packs). Returns `{checkoutUrl, credits, eurCents, directCharge}` or `{transactionI...
-
subscribe_addonFinancialSubscribe the project owner to a monthly add-on (RPM upgrade, team seat, extended log retention, extra file storage in +5 GB blocks, …). Charges the saved payment method immedia...
-
unsubscribe_addonFinancialCancel an active add-on subscription. Stops future charges; the current cycle stays active until expiry. RPM upgrades are cancelled for THIS project. Returns `{addonKey, project...
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.