Advanced features and configuration
Use this reference to distinguish available platform capabilities from planned capabilities when you design a service.
Access control (RBAC)
Assign Owner, Admin, User, or ReadOnly roles in Service Settings: Members. Granular per-service roles require the Business plan. Other plans apply access at the workspace level. The server limits each member to the services that their role grants.
Audit logging
Audit logs require the Team or Enterprise plan and the auditLogs entitlement. Without that entitlement, audit-log endpoints return 403 ENTITLEMENT_REQUIRED. See Error handling.
Compute tiers and scaling
Each compute tier bundles CPU, memory, and connection limits. Select a tier in Service Settings: Plan and add-ons. Changing the tier starts an orchestrated update of the Lambda, API Gateway, and database resources. If that update fails, Apso rolls back the resource change. Configure add-ons separately for each service.
Custom domains and deployment targets
- Custom domains require the
customDomainsentitlement. - External AWS and BYOC require the
externalAwsentitlement and the connected AWS account flow. - Environments: per-service environment configuration; see Environments.
Schema (advanced)
- Relationships:
OneToOne,OneToMany, andManyToMany(see Schema Editor). - Rich data types:
json,jsonb,array,enum,uuid, and the full PostgreSQL numeric/temporal set. - Field constraints: primary key, not-null, and unique.
The schema editor manages the schema definition. The deployment pipeline generates and applies migrations. Use apso migrate to preview and verify a migration locally.
AI token budget
Schema generation and chat use the workspace’s monthly AI token budget. When the budget is exhausted, the platform returns 429. See Error handling.
Unavailable capabilities
Plan for these platform limits:
- Deployment strategies: no blue-green or canary deployment, and no deployment hooks. Deploys are a single orchestrated pipeline (with automatic rollback on failure).
- Network security: no IP whitelisting/allow-lists and no user-configurable load balancing (AWS-managed).
- Custom authentication: The web app uses Better Auth with OAuth providers and email. It does not provide custom provider configuration.
- Logging configuration: no user-facing log-retention policy, log-level configuration, log aggregation, or log-export UI. Recent logs are viewable per service; retention is set by the platform.
- Usage predictions / capacity forecasting: not provided.