DigitalOcean integrations and automation

People automate DigitalOcean for two reasons: to keep an eye on infrastructure without logging in, and to do routine operations on a timetable. The public API covers both. It can list Droplets, volumes, databases, Kubernetes clusters and load balancers with their status and tags; take and delete snapshots; resize or power-cycle a Droplet; manage DNS records and firewalls; and read account balance and invoices. Almost every resource can carry tags, and selecting by tag ("env:staging") is the way to keep a workflow aimed at the right machines as the fleet changes.

Rate limits are per token: DigitalOcean documents 5,000 requests per hour and 250 per minute, with headers showing the remaining allowance, and some endpoints such as CDN endpoints have tighter limits of their own. A nightly inventory across a few dozen resources is well inside that. Many write operations, like a snapshot or resize, return an action that runs in the background; the workflow should check the action status until it completes rather than assuming success because the request was accepted. List endpoints are paginated, so read every page before concluding that a Droplet has no snapshot.

Use a personal access token limited to the scopes the workflow needs. DigitalOcean offers read-only tokens and custom scopes per resource, such as droplet:read or billing:read, so a report needs no write access, while deleting old snapshots deserves a token that only that job uses and a rule in the brief about what is safe to remove. DigitalOcean also lets an action target every Droplet with a given tag in one request. Note that while one Droplet action is unfinished, the Droplet is locked and a new action on it fails with a 422, so run actions on a single Droplet one after another.

Whenever calls the API over the internet with your token. Services inside a VPC with no public address, such as a private database endpoint, are not reachable from the hosted runtime; the DigitalOcean API itself is.