Lately i've been using Railway's GraphQL public API, and find out that there’s currently a limitation with project tokens: they can create, update, and delete volumes, but they can’t rename one. The volumeUpdate operation only takes a volumeId and doesn’t include the environment needed to validate the project token's scope against, so the request fails with Not Authorized.

This creates a real problem for IaC and CI/CD. Project tokens are the right least-privilege credential for pipelines, but any configuration that needs to rename a volume can’t be applied with them. The only workaround is to use a more privileged workspace- or account-level token, which defeats the purpose of using a scoped project token in the first place.