One-install CockroachDB Cloud front door over 4 bounded capability packs and 64 non-chat, uncached, read-only workflows. It reconciles all 144 official operations across 74 paths into 139 current callable capabilities and five exact provider-deprecated exclusions. The mutable latest OpenAPI and the official Cloud API guide are independently hash-locked. A single connection-owned Bearer secret stays pinned to cockroachlabs.cloud. The date-based Cc-Version header is fixed to 2024-09-16 only on /api/v1; SCIM v2 remains standards-shaped. Twenty-one collection operations paginate automatically. Role grants and two raw-body SCIM searches remain explicitly caller-paged where the current follower cannot merge without information loss. All 54 JSON bodies are required and sent verbatim, response integers are preserved exactly, and every mutation requires approval. The POST-shaped restore is explicitly destructive rather than falling through to generic administration. API-key creation is the only response that returns a full recoverable credential and, as a mutation, has no bundled workflow; the formatted connection-string read contains no password and Datadog returns only the last four key digits. No infrastructure, identity, or billing object is misrepresented as a task, note, or user-work project Source.