Neon.Organization reference

OrganizationApiKey

Source: src/Neon/OrganizationApiKey.ts

A reveal-once Neon management API key owned by an organization, optionally restricted to one project. This is not a branch service credential; use Neon.Credential for branch-scoped storage and backend permissions.

Keep Alchemy state secure and backed up. Neon cannot reveal an existing key. Missing secrets, revoked keys, and same-name foreign keys fail with OrganizationApiKeyRecoveryError instead of being adopted or silently rotated. Restore the original state or explicitly revoke the recorded key and replace the resource. Changing the organization, project restriction, or name replaces the key. Explicit names may require deleting the recorded old key first.

OrganizationApiKey: Project-restricted access

const project = yield* Neon.Project("Application", { orgId: "org-example" });
const key = yield* Neon.OrganizationApiKey("Automation", {
  orgId: "org-example",
  projectId: project.projectId,
});

OrganizationApiKey: Organization-wide access

const key = yield* Neon.OrganizationApiKey("OrganizationAdministration", {
  orgId: "org-example",
});

Omitting projectId grants broad organization access; prefer a project restriction whenever possible. The secret output is key.key, a Redacted value.

OrganizationMemberRole

Source: src/Neon/OrganizationMemberRole.ts

Manage the role of an existing organization member, never their membership. Existing roles require explicit adoption. Destruction restores the captured original role, but refuses to overwrite a role changed outside this resource. A complete bounded organization-member listing can prove that a removed membership needs no restoration; listing failures never count as absence. Self changes are refused, including restoration, to avoid self-demotion. Neon enforces organization-admin authorization and organization role availability.

The engine persists the adoption snapshot before reconciliation. Supply resolved IDs and role values on first deployment; an unresolved first deployment fails before mutation because this engine has no provider checkpoint API. Keep the state: a lost baseline cannot be reconstructed from desired props. An ambiguous interrupted write fails closed and requires operator reconciliation of state. Role mutations have no compare-and-swap API; do not edit the same role concurrently.

OrganizationMemberRole: Manage an existing member

const role = yield* Neon.OrganizationMemberRole("DeveloperRole", {
  orgId: "org-example",
  memberId: authorizedMemberId,
  role: "editor",
}).pipe(Alchemy.adopt(true));

OrganizationSpendingLimit

Source: src/Neon/OrganizationSpendingLimit.ts

Manage an ALERT-ONLY monthly spending threshold on an existing organization. Neon emails at 80% and 100%; reaching the threshold NEVER stops compute or enforces a hard budget. Requires an organization admin on Launch or Scale. This resource does not create or delete organizations.

Existing thresholds require explicit, preferably resource-scoped adoption. The engine durably captures the original threshold, including an absent (null) threshold, before the first write; destroy restores it. A newly created threshold is removed on destroy. All initial props must resolve during planning so that this snapshot can be persisted before reconciliation. Initial unresolved props or missing snapshots fail safely without mutation; first deploy with resolved values, then update using dependent values. Restore and remove this control before targeting another organization. Replacement generations without a snapshot also fail safely; use a new logical ID to plan a baseline for another organization before managing it. Cleanup refuses external drift rather than overwriting somebody else’s policy. Keep the state store: losing it loses the ownership and restoration record. The API has no conditional writes; serialize management of each organization.

OrganizationSpendingLimit: Set a billing alert

const alert = yield* Neon.OrganizationSpendingLimit("BillingAlert", {
  orgId: "org-example-12345678",
  spendingLimitCents: 10000,
}).pipe(Alchemy.adopt(true));

OrganizationVPCEndpoint

Source: src/Neon/OrganizationVPCEndpoint.ts

Register an EXISTING AWS PrivateLink endpoint with a Neon organization. Requires an entitled organization admin and a supported AWS region matching the endpoint and client. Azure is unsupported. Neon allows at most ten private networking configurations per AWS region. This neither provisions the AWS endpoint nor configures its DNS, and does not block public connections.

Existing registrations require explicit resource-scoped adoption. Their label is durably captured before mutation and restored on destroy, without revoking the registration. New registrations are unregistered on destroy only if their label is still managed and no projects restrict access through them. IMPORTANT: Neon permanently prevents re-registering a removed endpoint in the same organization. Replacement cleans up the old scope first; use a fresh AWS endpoint when necessary. External drift blocks cleanup. Preserve the state store and serialize writers: Neon exposes no conditional association writes.

OrganizationVPCEndpoint: Register private networking

const network = yield* Neon.OrganizationVPCEndpoint("PrivateNetwork", {
  orgId: "org-example-12345678",
  regionId: "aws-us-east-2",
  vpcEndpointId: "vpce-0123456789abcdef0",
  label: "Application network",
});