Render services, deploys, custom domains, disks, dedicated IPs, response headers, routes, jobs, cron runs, and events. Generated from the current hash-pinned official Render OpenAPI document. Reads are uncached; sensitive reads are marked sensitive-read and require approval unless session-granted, while ordinary reads remain unheld. Every mutation is grant-off and approval-gated, and administrative or destructive changes require approval every run.