---
id: w4/m6/t003
title: "Render-compatible REST GET/PUT/DELETE /v1/services/{id}/env-vars + GraphQL + MCP adapters"
worker: worker4
status: done
estimate: 45m
depends_on: [w4/m6/t002]
---

## Objective

Expose the secrets Core over all three adapters, Render-shaped: `GET /v1/services/{id}/env-vars` (Render semantics for value visibility), `PUT` (replace-set, Render's update shape, returns the new set), `DELETE /v1/services/{id}/env-vars/{key}`; the equivalent GraphQL fields and MCP verbs as thin wrappers over the same Core methods.

## Context

- Verify shapes against Render's public OpenAPI spec (the repo's standing practice per docs/ADR006-bex-api.md — pillar 1 claims verified compatibility).
- Adapters stay thin: validation + shape mapping only; logic lives in the Core (t002).
- Store nil ⇒ 503 on these routes only (same UX as request-metrics without `BEX_PROM_URL`).

## Steps

1. Check Render's OpenAPI for the env-vars request/response shapes.
2. REST handlers + routes; GraphQL schema + resolvers; MCP tool registrations.
3. Handler tests with the fake store: happy paths, 503-when-nil, 404 unknown service.

## Files

- `operator/internal/api/` REST/GraphQL/MCP adapter files (follow existing layout)

## Acceptance criteria

- [ ] Shapes match Render's spec; all three adapters call the same Core methods.
- [ ] 503 when the store is unconfigured; `make test` green.

## Out of scope

- Env groups / secret files (Render features — defer); authorization (t005).
