Every plan, line by line

PlanDiffCI checkStored diffsApprovalsAPI
CLIyesyesnonono
Teamyesyes1 yearyesyes
Orgyesyes7 yearsyes, with rolesyes

The Team API

Diffs as records.

The CLI uploads each diff. The API reads and approves them.

  • POST/v1/diffs

    Upload a diff from the CLI or CI

  • GET/v1/diffs/{id}

    One diff, with its keys and reviews

  • POST/v1/diffs/{id}/approve

    Approve a diff for one environment

  • GET/v1/environments

    Each environment and its last deployed render

Team and Org only. Every route takes a Team key.

POST/v1/diffs/{id}/approveApprove one diff
Request
curl -X POST https://api.diffkeel.example/v1/diffs/df_8k2/approve \
  -H "Authorization: Bearer $DIFFKEEL_KEY" \
  -d '{ "env": "prod" }'
Response200 OK
{
  "id": "df_8k2",
  "env": "prod",
  "changes": 3,
  "approved": true,
  "check": "pass"
}

Questions

Before you choose.

Does the CLI send my config anywhere?

No. The CLI renders and diffs on your machine. On Team, it uploads the diff, with secrets already masked.

Who counts as a user?

Anyone who approves a diff. CI runs and agents never count.

Can I keep using the CLI alone?

Yes. Every command in the CLI stays free, with no account.