Returns every registered target server. There's no single-server detail endpoint -- this list is the only way to read a target server's fields back....

Registers a new SQL Server as a target -- nothing can be pointed at a server (a job's target, a step's target, a credential's scope) until it...

Turns a target server on or off. A deactivated server is refused at run time -- any job or ad-hoc step run resolving to it is blocked. This is the only life...

Returns every stored credential -- name, type, principal, active/elevated flags, and any elevated-role findings from the last scan. The secret itself is nev...

Stores a new credential (a Windows account, a SQL login, an SMTP auth account, or an Azure service principal) that jobs and steps can then be pointed at. Th...

Replaces a credential's name, type, principal, and/or secret. Renaming or re-pointing the principal doesn't require a new secret -- leave Secret bla...

Flags (or unflags) a credential as elevated, without touching its name, type, principal, or secret. IsElevated is what an elevated role scan reports finding...

Kicks off a fleet-wide scan that checks which credentials actually hold elevated roles (like sysadmin) on their target servers, and lets you check when that...

Returns every role in the system, built-in and custom. IsBuiltIn roles can't be deleted (see Create / Delete a Role). BypassesSecurity marks a "Fle...

Creates a new custom role, or deletes one. There's no rename -- pick the name carefully at creation, or delete and recreate. A role starts with no permi...