Methods and apparatus for a tree-oriented configuration service are disclosed. A system includes computing devices that generate a tree-structured representation of a plurality of configuration elements of a distributed application. The devices implement a programmatic interface allowing a client to request an operation on a configuration element via a network request that indicates a path from a root node of the tree to one or more nodes corresponding to the configuration element. In response to (a) a network request received via the programmatic interface to perform a particular operation on a configuration element associated with a specified node and (b) a determination that authorization information associated with the specified node permits the requested operation, the operation is performed.