# a-app data API

A project owns its own named KV namespaces, D1 databases and R2 buckets, and
a Durable Object namespace, isolated from every other project. Authenticate
every call with one of the project's API keys:

  Authorization: Bearer cfs_...

- GET /v1/resources lists the project's resources by name
- REST: /v1/kv/{resource}, /v1/d1/{resource}, /v1/r2/{resource}, /v1/do/{name}
  — described at /openapi.json

Scopes: kv:read, kv:write, d1:write, r2:read, r2:write, do:read, do:write. A :write scope includes :read. A key may
also be limited to some of the project's resources.