# Render config surfaces beyond plain env vars: environment groups + secret files

bex's env-vars surface has full 5-endpoint parity (w4/m6), but Render ships two adjacent config surfaces bex omits (documented as a "safe superset" gap in docs/ADR006-bex-api.md). Both extend the existing OpenBao-backed `secrets` feature — no new store:

- **Environment groups** — Render `/v1/env-groups` (CRUD) + `…/services/{id}/link|unlink`: a named, shared set of env vars/secret files linked to many services (change once, all linked services pick it up). Needs a group object in the control-plane store + OpenBao path, projection into each linked App's `<name>-env` Secret, and link/unlink verbs. The single most-requested of the two.
- **Secret files** — Render `/v1/services/{id}/secret-files`: files (not KEY=VALUE) mounted at `/etc/secrets/<name>`. bex projects env vars into a Secret already; this projects file entries into the same Secret + a volumeMount. Smaller; possibly sub-hour once the shape is decided.

Three-adapter parity (REST tracks Render's public shape, GraphQL the dashboard, MCP the official server) once built.

Source: `docs/ADR018-render-parity.md` audit (w1/m13, 2026-07-08). Goal: pillar 1 (Render parity — configuration). Promote env-groups to a milestone; secret-files can ride it or land as a follow-on note.
