{ "openapi": "3.2.0", "info": { "title": "Nylorun Management API", "version": "0.32.0-beta", "x-nylorun-protocol": { "min": 16, "max": 18, "features": [ "studio-principal", "artifacts", "management-api", "resource-server", "model-inputs", "flat-manifest", "harness-boundary", "agents", "session-queue", "usage-by-kind", "tenant-fixture-model", "transcript-events", "subject-headers", "ag-ui-endpoint", "a2a-endpoint", "sandbox-pods", "trusted-issuers", "session-reads", "calls-export", "credential-coverage", "tool-calls", "environment-setup", "environment-disk-versions", "tool-policy", "traces", "artifact-reads", "gateway-credentials", "agent-folders" ] }, "description": "For operators: the Tenant's models, vaults, signing keys, settings and application keys, at `/v1/tenant/*` on the Tenant's URL, through `@nylorun/admin`. Every operation takes a management key, acting as itself: never for a subject and never from a browser. Management keys are issued only on the Tenant's machine (`nylorun tenant keys put --management`) or from `NYLORUN_MANAGEMENT_KEY_FILE`." }, "servers": [ { "url": "{origin}", "description": "A Runtime: a local Tenant (`nylorun start`), or where yours runs", "variables": { "origin": { "default": "http://localhost:8787" } } } ], "components": { "securitySchemes": { "applicationKey": { "type": "http", "scheme": "bearer", "description": "An application key of the Tenant (`PUT /v1/tenant/keys/{keyId}`), or Studio's key, derived from the admin key. With `Nylorun-Subject` and `Nylorun-Scopes`, it acts for that person, narrowed to those scopes. Never accepted from a browser (`Origin`)." }, "managementKey": { "type": "http", "scheme": "bearer", "description": "A management key of the Tenant (role `management`): it reaches the Management API (`/v1/tenant/*`) and `/v1/me`, as itself, never for a subject. Issued only on the Tenant's machine (`nylorun-operate keys put --role management`) or from `NYLORUN_MANAGEMENT_KEY_FILE`. Never accepted from a browser (`Origin`)." }, "issuerToken": { "type": "http", "scheme": "bearer", "bearerFormat": "JWT", "description": "A JWT from a trusted issuer of the Host's identity file (Host feature `trusted-issuers`): one person, with the issuer's scopes, agents and sandbox grants, until it expires. Accepted from servers and browsers alike; CORS is the operator's proxy's." } }, "schemas": { "Rejected": { "type": "object", "properties": { "status": { "type": "string", "enum": [ "rejected" ] }, "code": { "type": "string", "enum": [ "not_found", "credential_required", "credential_invalid", "protocol_unsupported", "host_rejected", "origin_rejected", "unsupported_media_type", "connection_missing", "incompatible_host", "subject_invalid", "scope_required", "key_role_mismatch", "token_expired", "limit_exceeded", "request_rejected", "invalid_request", "subject_required", "agent_not_granted", "session_busy", "queue_full", "trigger_expired", "trigger_paused", "memory_conflict", "agent_busy", "agent_unavailable", "placement_refused", "agent_lost", "agent_owner_mismatch", "harness_mismatch", "session_closed", "issuer_unavailable", "definition_files_missing", "credential_rejected", "mcp_preview_failed", "credential_conflict", "agent_fixed_field", "secret_not_in_manifest", "manifest_inconsistent", "manifest_not_found", "manifest_in_use", "manifest_changed", "folder_invalid", "internal_error" ] }, "message": { "type": "string" }, "details": {}, "activeTurnId": { "type": "string" }, "requestId": { "type": "string" } }, "required": [ "status", "code", "message" ] }, "ProtocolRejected": { "type": "object", "properties": { "status": { "type": "string", "enum": [ "rejected" ] }, "code": { "type": "string", "enum": [ "protocol_unsupported" ] }, "protocol": { "type": "object", "properties": { "min": { "type": "integer" }, "max": { "type": "integer" }, "features": { "type": "array", "items": { "type": "string" } } }, "required": [ "min", "max", "features" ], "additionalProperties": false } }, "required": [ "status", "code", "protocol" ], "additionalProperties": false }, "JsonValue": { "anyOf": [ { "type": "string" }, { "type": "number" }, { "type": "boolean" }, { "type": "null" }, { "type": "array", "items": { "oneOf": [ { "$ref": "#/components/schemas/JsonValue" }, { "type": "null" } ] } }, { "type": "object", "additionalProperties": { "oneOf": [ { "$ref": "#/components/schemas/JsonValue" }, { "type": "null" } ] } } ] }, "TenantSkillsView": { "type": "object", "properties": { "limits": { "type": "object", "properties": { "totalBytes": { "type": "integer" } }, "required": [ "totalBytes" ], "additionalProperties": false } }, "required": [ "limits" ], "additionalProperties": false }, "PutTenantSkillsRequest": { "type": "object", "properties": { "limits": { "type": "object", "properties": { "totalBytes": { "type": "integer", "exclusiveMinimum": 0 } }, "additionalProperties": false }, "requestId": { "type": "string", "minLength": 1 } }, "additionalProperties": false }, "TenantArtifactsView": { "type": "object", "properties": { "limits": { "type": "object", "properties": { "fileBytes": { "type": "integer" }, "totalBytes": { "type": "integer" } }, "required": [ "fileBytes", "totalBytes" ], "additionalProperties": false }, "usedBytes": { "type": "integer", "minimum": 0 } }, "required": [ "limits", "usedBytes" ], "additionalProperties": false }, "PutTenantArtifactsRequest": { "type": "object", "properties": { "limits": { "type": "object", "properties": { "fileBytes": { "type": "integer", "exclusiveMinimum": 0 }, "totalBytes": { "type": "integer", "exclusiveMinimum": 0 } }, "additionalProperties": false }, "requestId": { "type": "string", "minLength": 1 } }, "additionalProperties": false }, "TenantStatus": { "type": "object", "properties": { "tenant": { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "name": { "type": "string", "minLength": 1 }, "createdAt": { "type": "string", "minLength": 1 }, "updatedAt": { "type": "string", "minLength": 1 }, "schemaVersion": { "type": "integer" } }, "required": [ "id", "name", "createdAt", "updatedAt", "schemaVersion" ], "additionalProperties": false }, "path": { "type": "string", "minLength": 1 }, "checks": { "type": "object", "properties": { "store": { "type": "boolean" }, "scheduler": { "type": "boolean" }, "model": { "type": "boolean" }, "schema": { "type": "boolean" } }, "required": [ "store", "scheduler", "model", "schema" ], "additionalProperties": false }, "model": { "anyOf": [ { "type": "object", "properties": { "configured": { "type": "boolean", "enum": [ false ] } }, "required": [ "configured" ], "additionalProperties": false }, { "type": "object", "properties": { "configured": { "type": "boolean", "enum": [ true ] }, "provider": { "type": "string" }, "model": { "type": "string" }, "authType": { "type": "string", "enum": [ "api_key", "oauth", "workload" ] }, "baseUrl": { "type": "string" }, "settings": { "type": "object", "properties": { "contextWindow": { "type": "integer", "minimum": 1 }, "maxTokens": { "type": "integer", "minimum": 1 }, "reasoning": { "type": "boolean" }, "inputs": { "type": "array", "items": { "type": "string", "enum": [ "text", "image", "pdf", "office", "audio", "video" ] } }, "compat": { "type": "object", "additionalProperties": {} }, "headers": { "type": "object", "additionalProperties": { "type": "string", "minLength": 1 } }, "callHeaders": { "type": "object", "additionalProperties": { "oneOf": [ { "type": "object", "properties": { "from": { "type": "string", "enum": [ "agent.label" ] }, "key": { "type": "string", "minLength": 1 } }, "required": [ "from", "key" ], "additionalProperties": false }, { "type": "object", "properties": { "from": { "type": "string", "enum": [ "agent.id" ] } }, "required": [ "from" ], "additionalProperties": false }, { "type": "object", "properties": { "from": { "type": "string", "enum": [ "session.owner" ] } }, "required": [ "from" ], "additionalProperties": false } ] } } }, "additionalProperties": false } }, "required": [ "configured", "provider", "model", "authType" ], "additionalProperties": false } ] }, "agents": { "type": "array", "items": { "type": "object", "properties": { "agentId": { "type": "string" } }, "required": [ "agentId" ], "additionalProperties": false } }, "counts": { "type": "object", "properties": { "sessions": { "type": "integer", "minimum": 0 }, "runningSessions": { "type": "integer", "minimum": 0 }, "uncertainEffects": { "type": "integer", "minimum": 0 } }, "required": [ "sessions", "runningSessions", "uncertainEffects" ], "additionalProperties": false }, "sandbox": { "type": "object", "properties": { "backend": { "type": [ "string", "null" ] }, "retained": { "type": "integer", "minimum": 0 } }, "required": [ "backend", "retained" ], "additionalProperties": false }, "harness": { "type": "object", "properties": { "mode": { "type": "string", "enum": [ "in-process", "remote" ] }, "connected": { "type": "integer", "minimum": 0 }, "workspace": { "type": "boolean" } }, "required": [ "mode", "connected", "workspace" ], "additionalProperties": false }, "execution": { "type": "object", "properties": { "stuckInvocations": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "status": { "type": "string" }, "service": { "type": "string" }, "handler": { "type": "string" }, "key": { "type": "string" }, "retryCount": { "type": "integer", "minimum": 0 }, "lastFailure": { "type": "string" }, "modifiedAt": { "type": "string" } }, "required": [ "id", "status", "service", "handler", "key", "retryCount" ], "additionalProperties": false } }, "error": { "type": "string" } }, "required": [ "stuckInvocations" ], "additionalProperties": false }, "streams": { "type": "object", "properties": { "reachable": { "type": "boolean" }, "basin": { "type": "object", "properties": { "ready": { "type": "boolean" }, "failures": { "type": "integer", "minimum": 0 }, "lastError": { "type": [ "string", "null" ] } }, "required": [ "ready", "failures", "lastError" ], "additionalProperties": false }, "generation": { "type": "integer", "minimum": 0 }, "relay": { "type": [ "object", "null" ], "properties": { "active": { "type": "boolean" }, "pendingTxs": { "type": "integer", "minimum": 0 }, "pendingRows": { "type": "integer", "minimum": 0 }, "confirmed": { "type": [ "string", "null" ] }, "reconciliations": { "type": "integer", "minimum": 0 }, "lastError": { "type": [ "string", "null" ] }, "lagBytes": { "type": "number", "minimum": 0 } }, "required": [ "active", "pendingTxs", "pendingRows", "confirmed", "reconciliations", "lastError" ], "additionalProperties": false } }, "required": [ "reachable", "basin", "generation", "relay" ], "additionalProperties": false } }, "required": [ "tenant", "path", "checks", "model", "agents", "counts", "sandbox" ], "additionalProperties": false }, "ResetTenantResponse": { "type": "object", "properties": { "ok": { "type": "boolean", "enum": [ true ] } }, "required": [ "ok" ], "additionalProperties": false }, "ResetTenantRequest": { "type": "object", "properties": { "requestId": { "type": "string", "minLength": 1 }, "scope": { "type": "string", "enum": [ "sessions", "agents", "all" ] }, "activeWork": { "type": "string", "enum": [ "drain", "cancel" ] } }, "required": [ "requestId", "scope", "activeWork" ], "additionalProperties": false }, "SeedTenantConfigResponse": { "type": "object", "properties": { "applied": { "type": "array", "items": { "type": "string" } }, "kept": { "type": "array", "items": { "type": "string" } } }, "required": [ "applied", "kept" ], "additionalProperties": false }, "SeedTenantConfigRequest": { "type": "object", "properties": { "requestId": { "type": "string", "minLength": 1 }, "sandbox": { "type": "object", "properties": { "backend": { "type": "string", "enum": [ "auto", "virtual" ] }, "config": { "type": "object", "properties": { "limits": { "type": "object", "properties": { "network": { "type": "array", "items": { "type": "string" } }, "resources": { "type": "object", "properties": { "cpus": { "type": "integer", "minimum": 1 }, "memory": { "type": "string" } }, "additionalProperties": false }, "defaultResources": { "type": "object", "properties": { "cpus": { "type": "integer", "minimum": 1 }, "memory": { "type": "string" } }, "additionalProperties": false }, "idle": { "type": "string" }, "environments": { "type": "integer", "minimum": 0 } }, "additionalProperties": false }, "lifecycle": { "type": "object", "properties": { "stopGrace": { "type": "string" } }, "additionalProperties": false }, "placement": { "type": "object", "additionalProperties": { "type": "object", "properties": { "hosts": { "type": "array", "items": { "type": "string", "enum": [ "harness-container", "sandbox" ] } } }, "required": [ "hosts" ], "additionalProperties": false } } }, "additionalProperties": false } }, "additionalProperties": false }, "model": { "type": "object", "properties": { "provider": { "type": "string", "minLength": 1 }, "model": { "type": "string", "minLength": 1 }, "baseUrl": { "type": "string", "minLength": 1 }, "settings": { "type": "object", "properties": { "contextWindow": { "type": "integer", "minimum": 1 }, "maxTokens": { "type": "integer", "minimum": 1 }, "reasoning": { "type": "boolean" }, "inputs": { "type": "array", "items": { "type": "string", "enum": [ "text", "image", "pdf", "office", "audio", "video" ] } }, "compat": { "type": "object", "additionalProperties": {} }, "headers": { "type": "object", "additionalProperties": { "type": "string", "minLength": 1 } }, "callHeaders": { "type": "object", "additionalProperties": { "oneOf": [ { "type": "object", "properties": { "from": { "type": "string", "enum": [ "agent.label" ] }, "key": { "type": "string", "minLength": 1 } }, "required": [ "from", "key" ], "additionalProperties": false }, { "type": "object", "properties": { "from": { "type": "string", "enum": [ "agent.id" ] } }, "required": [ "from" ], "additionalProperties": false }, { "type": "object", "properties": { "from": { "type": "string", "enum": [ "session.owner" ] } }, "required": [ "from" ], "additionalProperties": false } ] } } }, "additionalProperties": false }, "auth": { "oneOf": [ { "type": "object", "properties": { "type": { "type": "string", "enum": [ "api_key" ] }, "key": { "type": "string", "minLength": 1 }, "env": { "type": "object", "additionalProperties": { "type": "string" } } }, "required": [ "type", "key" ], "additionalProperties": false }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "oauth" ] }, "refresh": { "type": "string", "minLength": 1 }, "access": { "type": "string", "minLength": 1 }, "expires": { "type": "number" } }, "required": [ "type", "refresh", "access", "expires" ], "additionalProperties": {} }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "workload" ] } }, "required": [ "type" ], "additionalProperties": false } ] } }, "required": [ "provider", "model", "auth" ], "additionalProperties": false }, "fixtureModel": { "type": "boolean", "enum": [ true ] } }, "required": [ "requestId" ], "additionalProperties": false }, "HostModelCatalog": { "type": "object", "properties": { "providers": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "models": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "inputs": { "type": "array", "items": { "type": "string", "enum": [ "text", "image", "pdf", "office", "audio", "video" ] } }, "addableInputs": { "type": "array", "items": { "type": "string", "enum": [ "text", "image", "pdf", "office", "audio", "video" ] } } }, "required": [ "id", "name", "inputs", "addableInputs" ], "additionalProperties": false } } }, "required": [ "id", "name", "models" ], "additionalProperties": false } } }, "required": [ "providers" ], "additionalProperties": false }, "ModelInputsView": { "type": "object", "properties": { "provider": { "type": "string" }, "model": { "type": "string" }, "inputs": { "type": "array", "items": { "type": "string", "enum": [ "text", "image", "pdf", "office", "audio", "video" ] } } }, "required": [ "provider", "model", "inputs" ], "additionalProperties": false }, "PutModelInputsRequest": { "type": "object", "properties": { "requestId": { "type": "string", "minLength": 1 }, "provider": { "type": "string", "minLength": 1 }, "model": { "type": "string", "minLength": 1 }, "inputs": { "type": "array", "items": { "type": "string", "enum": [ "text", "image", "pdf", "office", "audio", "video" ] } } }, "required": [ "provider", "model", "inputs" ], "additionalProperties": false }, "TenantLimitsView": { "type": "object", "properties": { "limits": { "type": "object", "properties": { "recordEntryBytes": { "type": "integer", "exclusiveMinimum": 0 }, "modelCallBytes": { "type": "integer", "exclusiveMinimum": 0 }, "modelFileBytes": { "type": "integer", "exclusiveMinimum": 0 }, "toolAnswerBytes": { "type": "integer", "exclusiveMinimum": 0 }, "harnessStateBytes": { "type": "integer", "exclusiveMinimum": 0 }, "chunkBytes": { "type": "integer", "exclusiveMinimum": 0 }, "folderEntries": { "type": "integer", "exclusiveMinimum": 0 }, "requestBodyBytes": { "type": "integer", "exclusiveMinimum": 0 }, "messageParts": { "type": "integer", "exclusiveMinimum": 0 }, "pageItems": { "type": "integer", "exclusiveMinimum": 0 }, "exportPageItems": { "type": "integer", "exclusiveMinimum": 0 }, "environmentEventItems": { "type": "integer", "exclusiveMinimum": 0 }, "inlineFileBytes": { "type": "integer", "exclusiveMinimum": 0 }, "a2aWaitMs": { "type": "integer", "exclusiveMinimum": 0 }, "errorExcerptChars": { "type": "integer", "exclusiveMinimum": 0 }, "traceContentBytes": { "type": "integer", "exclusiveMinimum": 0 }, "environmentLabels": { "type": "integer", "exclusiveMinimum": 0 }, "artifactLabels": { "type": "integer", "exclusiveMinimum": 0 }, "labelKeyChars": { "type": "integer", "exclusiveMinimum": 0 }, "labelValueChars": { "type": "integer", "exclusiveMinimum": 0 }, "environmentSetupCommands": { "type": "integer", "exclusiveMinimum": 0 }, "environmentFiles": { "type": "integer", "exclusiveMinimum": 0 }, "environmentFilesPerEntry": { "type": "integer", "exclusiveMinimum": 0 }, "environmentSecretSlots": { "type": "integer", "exclusiveMinimum": 0 }, "setupCommandChars": { "type": "integer", "exclusiveMinimum": 0 }, "setupCommandMs": { "type": "integer", "exclusiveMinimum": 0 }, "setupOutputChars": { "type": "integer", "exclusiveMinimum": 0 }, "setupReasonChars": { "type": "integer", "exclusiveMinimum": 0 }, "setupCommandExcerptChars": { "type": "integer", "exclusiveMinimum": 0 }, "manifestDescriptionChars": { "type": "integer", "exclusiveMinimum": 0 }, "secretDescriptionChars": { "type": "integer", "exclusiveMinimum": 0 }, "secretValueChars": { "type": "integer", "exclusiveMinimum": 0 }, "secretHosts": { "type": "integer", "exclusiveMinimum": 0 }, "diskVersionEntries": { "type": "integer", "exclusiveMinimum": 0 }, "diskVersionBytes": { "type": "integer", "exclusiveMinimum": 0 }, "diskLeaseMs": { "type": "integer", "exclusiveMinimum": 0 }, "diskPodWaitMs": { "type": "integer", "exclusiveMinimum": 0 }, "modelRequestMs": { "type": "integer", "exclusiveMinimum": 0 }, "modelIdleMs": { "type": "integer", "exclusiveMinimum": 0 }, "modelAttempts": { "type": "integer", "exclusiveMinimum": 0 }, "modelRetryDelayMs": { "type": "integer", "exclusiveMinimum": 0 }, "modelProviderRetries": { "type": "integer", "minimum": 0 }, "modelRetryDelayMaxMs": { "type": "integer", "exclusiveMinimum": 0 }, "toolAttempts": { "type": "integer", "exclusiveMinimum": 0 }, "httpToolTimeoutMs": { "type": "integer", "exclusiveMinimum": 0 }, "mcpSnapshotBytes": { "type": "integer", "exclusiveMinimum": 0 }, "mcpPreviewMs": { "type": "integer", "exclusiveMinimum": 0 }, "mcpMetadataBytes": { "type": "integer", "exclusiveMinimum": 0 }, "toolRules": { "type": "integer", "exclusiveMinimum": 0 }, "toolRuleFieldChars": { "type": "integer", "exclusiveMinimum": 0 }, "toolRuleTextChars": { "type": "integer", "exclusiveMinimum": 0 }, "modelBudgets": { "type": "integer", "exclusiveMinimum": 0 }, "triggersPerAgent": { "type": "integer", "exclusiveMinimum": 0 }, "triggerMinIntervalMs": { "type": "integer", "exclusiveMinimum": 0 }, "triggerRunsPerHour": { "type": "integer", "exclusiveMinimum": 0 }, "triggerJitterPercent": { "type": "integer", "minimum": 0 }, "triggerJitterMaxMs": { "type": "integer", "minimum": 0 }, "triggerPromptChars": { "type": "integer", "exclusiveMinimum": 0 }, "triggerRunRetentionMs": { "type": "integer", "exclusiveMinimum": 0 }, "webhookBodyBytes": { "type": "integer", "exclusiveMinimum": 0 }, "wakeMaxAheadMs": { "type": "integer", "exclusiveMinimum": 0 }, "wakeNoteChars": { "type": "integer", "exclusiveMinimum": 0 }, "memoryBytes": { "type": "integer", "exclusiveMinimum": 0 }, "memoriesPerAgent": { "type": "integer", "exclusiveMinimum": 0 }, "memoryIndexLines": { "type": "integer", "exclusiveMinimum": 0 }, "memoryIndexBytes": { "type": "integer", "exclusiveMinimum": 0 }, "sessionQueuedMessages": { "type": "integer", "exclusiveMinimum": 0 }, "flowConcurrency": { "type": "integer", "exclusiveMinimum": 0 }, "flowMapItems": { "type": "integer", "exclusiveMinimum": 0 }, "flowLoopIterations": { "type": "integer", "exclusiveMinimum": 0 }, "folderFiles": { "type": "integer", "exclusiveMinimum": 0 }, "folderBytes": { "type": "integer", "exclusiveMinimum": 0 }, "folderTextFileBytes": { "type": "integer", "exclusiveMinimum": 0 } }, "required": [ "recordEntryBytes", "modelCallBytes", "modelFileBytes", "toolAnswerBytes", "harnessStateBytes", "chunkBytes", "folderEntries", "requestBodyBytes", "messageParts", "pageItems", "exportPageItems", "environmentEventItems", "inlineFileBytes", "a2aWaitMs", "errorExcerptChars", "traceContentBytes", "environmentLabels", "artifactLabels", "labelKeyChars", "labelValueChars", "environmentSetupCommands", "environmentFiles", "environmentFilesPerEntry", "environmentSecretSlots", "setupCommandChars", "setupCommandMs", "setupOutputChars", "setupReasonChars", "setupCommandExcerptChars", "manifestDescriptionChars", "secretDescriptionChars", "secretValueChars", "secretHosts", "diskVersionEntries", "diskVersionBytes", "diskLeaseMs", "diskPodWaitMs", "modelRequestMs", "modelIdleMs", "modelAttempts", "modelRetryDelayMs", "modelProviderRetries", "modelRetryDelayMaxMs", "toolAttempts", "httpToolTimeoutMs", "mcpSnapshotBytes", "mcpPreviewMs", "mcpMetadataBytes", "toolRules", "toolRuleFieldChars", "toolRuleTextChars", "modelBudgets", "triggersPerAgent", "triggerMinIntervalMs", "triggerRunsPerHour", "triggerJitterPercent", "triggerJitterMaxMs", "triggerPromptChars", "triggerRunRetentionMs", "webhookBodyBytes", "wakeMaxAheadMs", "wakeNoteChars", "memoryBytes", "memoriesPerAgent", "memoryIndexLines", "memoryIndexBytes", "sessionQueuedMessages", "flowConcurrency", "flowMapItems", "flowLoopIterations", "folderFiles", "folderBytes", "folderTextFileBytes" ], "additionalProperties": false } }, "required": [ "limits" ], "additionalProperties": false }, "PutTenantLimitsRequest": { "type": "object", "properties": { "limits": { "type": "object", "properties": { "recordEntryBytes": { "type": "integer", "exclusiveMinimum": 0 }, "modelCallBytes": { "type": "integer", "exclusiveMinimum": 0 }, "modelFileBytes": { "type": "integer", "exclusiveMinimum": 0 }, "toolAnswerBytes": { "type": "integer", "exclusiveMinimum": 0 }, "harnessStateBytes": { "type": "integer", "exclusiveMinimum": 0 }, "chunkBytes": { "type": "integer", "exclusiveMinimum": 0 }, "folderEntries": { "type": "integer", "exclusiveMinimum": 0 }, "requestBodyBytes": { "type": "integer", "exclusiveMinimum": 0 }, "messageParts": { "type": "integer", "exclusiveMinimum": 0 }, "pageItems": { "type": "integer", "exclusiveMinimum": 0 }, "exportPageItems": { "type": "integer", "exclusiveMinimum": 0 }, "environmentEventItems": { "type": "integer", "exclusiveMinimum": 0 }, "inlineFileBytes": { "type": "integer", "exclusiveMinimum": 0 }, "a2aWaitMs": { "type": "integer", "exclusiveMinimum": 0 }, "errorExcerptChars": { "type": "integer", "exclusiveMinimum": 0 }, "traceContentBytes": { "type": "integer", "exclusiveMinimum": 0 }, "environmentLabels": { "type": "integer", "exclusiveMinimum": 0 }, "artifactLabels": { "type": "integer", "exclusiveMinimum": 0 }, "labelKeyChars": { "type": "integer", "exclusiveMinimum": 0 }, "labelValueChars": { "type": "integer", "exclusiveMinimum": 0 }, "environmentSetupCommands": { "type": "integer", "exclusiveMinimum": 0 }, "environmentFiles": { "type": "integer", "exclusiveMinimum": 0 }, "environmentFilesPerEntry": { "type": "integer", "exclusiveMinimum": 0 }, "environmentSecretSlots": { "type": "integer", "exclusiveMinimum": 0 }, "setupCommandChars": { "type": "integer", "exclusiveMinimum": 0 }, "setupCommandMs": { "type": "integer", "exclusiveMinimum": 0 }, "setupOutputChars": { "type": "integer", "exclusiveMinimum": 0 }, "setupReasonChars": { "type": "integer", "exclusiveMinimum": 0 }, "setupCommandExcerptChars": { "type": "integer", "exclusiveMinimum": 0 }, "manifestDescriptionChars": { "type": "integer", "exclusiveMinimum": 0 }, "secretDescriptionChars": { "type": "integer", "exclusiveMinimum": 0 }, "secretValueChars": { "type": "integer", "exclusiveMinimum": 0 }, "secretHosts": { "type": "integer", "exclusiveMinimum": 0 }, "diskVersionEntries": { "type": "integer", "exclusiveMinimum": 0 }, "diskVersionBytes": { "type": "integer", "exclusiveMinimum": 0 }, "diskLeaseMs": { "type": "integer", "exclusiveMinimum": 0 }, "diskPodWaitMs": { "type": "integer", "exclusiveMinimum": 0 }, "modelRequestMs": { "type": "integer", "exclusiveMinimum": 0 }, "modelIdleMs": { "type": "integer", "exclusiveMinimum": 0 }, "modelAttempts": { "type": "integer", "exclusiveMinimum": 0 }, "modelRetryDelayMs": { "type": "integer", "exclusiveMinimum": 0 }, "modelProviderRetries": { "type": "integer", "minimum": 0 }, "modelRetryDelayMaxMs": { "type": "integer", "exclusiveMinimum": 0 }, "toolAttempts": { "type": "integer", "exclusiveMinimum": 0 }, "httpToolTimeoutMs": { "type": "integer", "exclusiveMinimum": 0 }, "mcpSnapshotBytes": { "type": "integer", "exclusiveMinimum": 0 }, "mcpPreviewMs": { "type": "integer", "exclusiveMinimum": 0 }, "mcpMetadataBytes": { "type": "integer", "exclusiveMinimum": 0 }, "toolRules": { "type": "integer", "exclusiveMinimum": 0 }, "toolRuleFieldChars": { "type": "integer", "exclusiveMinimum": 0 }, "toolRuleTextChars": { "type": "integer", "exclusiveMinimum": 0 }, "modelBudgets": { "type": "integer", "exclusiveMinimum": 0 }, "triggersPerAgent": { "type": "integer", "exclusiveMinimum": 0 }, "triggerMinIntervalMs": { "type": "integer", "exclusiveMinimum": 0 }, "triggerRunsPerHour": { "type": "integer", "exclusiveMinimum": 0 }, "triggerJitterPercent": { "type": "integer", "minimum": 0 }, "triggerJitterMaxMs": { "type": "integer", "minimum": 0 }, "triggerPromptChars": { "type": "integer", "exclusiveMinimum": 0 }, "triggerRunRetentionMs": { "type": "integer", "exclusiveMinimum": 0 }, "webhookBodyBytes": { "type": "integer", "exclusiveMinimum": 0 }, "wakeMaxAheadMs": { "type": "integer", "exclusiveMinimum": 0 }, "wakeNoteChars": { "type": "integer", "exclusiveMinimum": 0 }, "memoryBytes": { "type": "integer", "exclusiveMinimum": 0 }, "memoriesPerAgent": { "type": "integer", "exclusiveMinimum": 0 }, "memoryIndexLines": { "type": "integer", "exclusiveMinimum": 0 }, "memoryIndexBytes": { "type": "integer", "exclusiveMinimum": 0 }, "sessionQueuedMessages": { "type": "integer", "exclusiveMinimum": 0 }, "flowConcurrency": { "type": "integer", "exclusiveMinimum": 0 }, "flowMapItems": { "type": "integer", "exclusiveMinimum": 0 }, "flowLoopIterations": { "type": "integer", "exclusiveMinimum": 0 }, "folderFiles": { "type": "integer", "exclusiveMinimum": 0 }, "folderBytes": { "type": "integer", "exclusiveMinimum": 0 }, "folderTextFileBytes": { "type": "integer", "exclusiveMinimum": 0 } }, "additionalProperties": false }, "requestId": { "type": "string", "minLength": 1 } }, "additionalProperties": false }, "TenantSandboxView": { "type": "object", "properties": { "preference": { "anyOf": [ { "type": "string", "enum": [ "auto" ] }, { "type": "string", "enum": [ "virtual", "local" ] } ] }, "backend": { "type": [ "string", "null" ], "enum": [ "virtual", "local", null ] }, "isolation": { "type": [ "string", "null" ], "enum": [ "process", "container", null ] }, "reason": { "type": "string" }, "probes": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string", "enum": [ "virtual", "local" ] }, "available": { "type": "boolean" }, "isolation": { "type": "string", "enum": [ "process", "container" ] }, "reason": { "type": "string" }, "version": { "type": "string" } }, "required": [ "name", "available", "isolation" ], "additionalProperties": false } }, "defaultImage": { "type": "string" }, "config": { "type": "object", "properties": { "limits": { "type": "object", "properties": { "network": { "type": "array", "items": { "type": "string" } }, "resources": { "type": "object", "properties": { "cpus": { "type": "number" }, "memoryMiB": { "type": "number" } }, "required": [ "cpus", "memoryMiB" ], "additionalProperties": false }, "defaultResources": { "type": "object", "properties": { "cpus": { "type": "number" }, "memoryMiB": { "type": "number" } }, "required": [ "cpus", "memoryMiB" ], "additionalProperties": false }, "idle": { "type": "string" }, "environments": { "type": "integer", "minimum": 0 } }, "required": [ "network", "resources", "defaultResources", "idle" ], "additionalProperties": false }, "lifecycle": { "type": "object", "properties": { "stopGrace": { "type": "string" } }, "required": [ "stopGrace" ], "additionalProperties": false }, "placement": { "type": "object", "additionalProperties": { "type": "object", "properties": { "hosts": { "type": "array", "items": { "type": "string", "enum": [ "harness-container", "sandbox" ] } } }, "required": [ "hosts" ], "additionalProperties": false } } }, "required": [ "limits" ], "additionalProperties": false }, "cluster": { "type": [ "object", "null" ], "properties": { "namespace": { "type": "string" }, "context": { "type": "string" }, "ready": { "type": "boolean" }, "controllerVersion": { "type": "string" }, "networkPolicy": { "type": "object", "properties": { "enforced": { "type": "boolean" }, "probedAt": { "type": "string" } }, "required": [ "enforced" ] } }, "required": [ "namespace", "context", "ready" ] } }, "required": [ "preference", "backend", "isolation", "reason", "probes", "defaultImage", "config" ], "additionalProperties": false }, "PutTenantEnvironmentsRequest": { "type": "object", "properties": { "limits": { "type": "object", "properties": { "network": { "type": "array", "items": { "type": "string" } }, "resources": { "type": "object", "properties": { "cpus": { "type": "integer", "minimum": 1 }, "memory": { "type": "string" } }, "additionalProperties": false }, "defaultResources": { "type": "object", "properties": { "cpus": { "type": "integer", "minimum": 1 }, "memory": { "type": "string" } }, "additionalProperties": false }, "idle": { "type": "string" }, "environments": { "type": "integer", "minimum": 0 } }, "additionalProperties": false }, "lifecycle": { "type": "object", "properties": { "stopGrace": { "type": "string" } }, "additionalProperties": false }, "placement": { "type": "object", "additionalProperties": { "type": "object", "properties": { "hosts": { "type": "array", "items": { "type": "string", "enum": [ "harness-container", "sandbox" ] } } }, "required": [ "hosts" ], "additionalProperties": false } }, "requestId": { "type": "string", "minLength": 1 } }, "additionalProperties": false }, "ModelUsageTotals": { "type": "object", "properties": { "scope": { "type": "string", "enum": [ "tenant", "manifest", "turn" ] }, "id": { "type": "string" }, "period": { "type": "string", "enum": [ "day", "month", "total" ] }, "since": { "type": "string" }, "calls": { "type": "integer", "minimum": 0 }, "tokens": { "type": "integer", "minimum": 0 }, "costUsd": { "type": "number", "minimum": 0 } }, "required": [ "scope", "period", "calls", "tokens", "costUsd" ], "additionalProperties": false }, "ModelBudgets": { "type": "object", "properties": { "budgets": { "type": "array", "items": { "type": "object", "properties": { "scope": { "type": "string", "enum": [ "tenant", "manifest", "turn" ] }, "id": { "type": "string", "minLength": 1 }, "period": { "type": "string", "enum": [ "day", "month" ] }, "limitUsd": { "type": "number", "exclusiveMinimum": 0 }, "limitTokens": { "type": "integer", "exclusiveMinimum": 0 } }, "required": [ "scope" ], "additionalProperties": false } } }, "required": [ "budgets" ], "additionalProperties": false }, "PutModelBudgetsRequest": { "type": "object", "properties": { "requestId": { "type": "string", "minLength": 1 }, "budgets": { "type": "array", "items": { "type": "object", "properties": { "scope": { "type": "string", "enum": [ "tenant", "manifest", "turn" ] }, "id": { "type": "string", "minLength": 1 }, "period": { "type": "string", "enum": [ "day", "month" ] }, "limitUsd": { "type": "number", "exclusiveMinimum": 0 }, "limitTokens": { "type": "integer", "exclusiveMinimum": 0 } }, "required": [ "scope" ], "additionalProperties": false } } }, "required": [ "budgets" ], "additionalProperties": false }, "ToolPolicy": { "type": "object", "properties": { "rules": { "type": "array", "items": { "type": "object", "properties": { "effect": { "type": "string", "enum": [ "allow", "ask", "deny" ] }, "tool": { "type": "string", "minLength": 1, "description": "The tool's identity: an MCP tool's own name on its `server`, or an HTTP tool's declared name, never the name the model calls it by. `*` matches any run of characters; a name with `__` in it is refused" }, "server": { "type": "string", "minLength": 1, "description": "An MCP server's name; `*` matches any run of characters" }, "kind": { "type": "string", "enum": [ "mcp", "http" ] }, "agent": { "type": "string", "minLength": 1, "description": "The agent that calls the tool: the agent manifest's name, or the id of an agent used as a tool or of a flow's agent, never an Agent's id. `*` matches any run of characters" }, "when": { "type": "object", "additionalProperties": { "type": "object", "properties": { "equals": { "$ref": "#/components/schemas/JsonValue" }, "in": { "type": "array", "items": { "$ref": "#/components/schemas/JsonValue" }, "minItems": 1 }, "gt": { "type": "number" }, "gte": { "type": "number" }, "lt": { "type": "number" }, "lte": { "type": "number" }, "matches": { "type": "string", "minLength": 1 } }, "additionalProperties": false }, "description": "Fields of the call's input by dotted path, each tested by every test its condition sets" }, "reason": { "type": "string", "minLength": 1 } }, "required": [ "effect" ], "additionalProperties": false } }, "updatedAt": { "type": [ "string", "null" ] } }, "required": [ "rules", "updatedAt" ], "additionalProperties": false }, "PutToolPolicyRequest": { "type": "object", "properties": { "requestId": { "type": "string", "minLength": 1 }, "rules": { "type": "array", "items": { "type": "object", "properties": { "effect": { "type": "string", "enum": [ "allow", "ask", "deny" ] }, "tool": { "type": "string", "minLength": 1, "description": "The tool's identity: an MCP tool's own name on its `server`, or an HTTP tool's declared name, never the name the model calls it by. `*` matches any run of characters; a name with `__` in it is refused" }, "server": { "type": "string", "minLength": 1, "description": "An MCP server's name; `*` matches any run of characters" }, "kind": { "type": "string", "enum": [ "mcp", "http" ] }, "agent": { "type": "string", "minLength": 1, "description": "The agent that calls the tool: the agent manifest's name, or the id of an agent used as a tool or of a flow's agent, never an Agent's id. `*` matches any run of characters" }, "when": { "type": "object", "additionalProperties": { "type": "object", "properties": { "equals": { "$ref": "#/components/schemas/JsonValue" }, "in": { "type": "array", "items": { "$ref": "#/components/schemas/JsonValue" }, "minItems": 1 }, "gt": { "type": "number" }, "gte": { "type": "number" }, "lt": { "type": "number" }, "lte": { "type": "number" }, "matches": { "type": "string", "minLength": 1 } }, "additionalProperties": false }, "description": "Fields of the call's input by dotted path, each tested by every test its condition sets" }, "reason": { "type": "string", "minLength": 1 } }, "required": [ "effect" ], "additionalProperties": false } } }, "required": [ "rules" ], "additionalProperties": false }, "ListProvidersResponse": { "type": "object", "properties": { "providers": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "model": { "type": "string" }, "authType": { "type": "string", "enum": [ "api_key", "oauth", "workload" ] }, "baseUrl": { "type": "string" }, "settings": { "type": "object", "properties": { "contextWindow": { "type": "integer", "minimum": 1 }, "maxTokens": { "type": "integer", "minimum": 1 }, "reasoning": { "type": "boolean" }, "inputs": { "type": "array", "items": { "type": "string", "enum": [ "text", "image", "pdf", "office", "audio", "video" ] } }, "compat": { "type": "object", "additionalProperties": {} }, "headers": { "type": "object", "additionalProperties": { "type": "string", "minLength": 1 } }, "callHeaders": { "type": "object", "additionalProperties": { "oneOf": [ { "type": "object", "properties": { "from": { "type": "string", "enum": [ "agent.label" ] }, "key": { "type": "string", "minLength": 1 } }, "required": [ "from", "key" ], "additionalProperties": false }, { "type": "object", "properties": { "from": { "type": "string", "enum": [ "agent.id" ] } }, "required": [ "from" ], "additionalProperties": false }, { "type": "object", "properties": { "from": { "type": "string", "enum": [ "session.owner" ] } }, "required": [ "from" ], "additionalProperties": false } ] } } }, "additionalProperties": false }, "inputs": { "type": "array", "items": { "type": "string", "enum": [ "text", "image", "pdf", "office", "audio", "video" ] } }, "lastUpdated": { "type": "string" }, "active": { "type": "boolean" } }, "required": [ "id", "name", "model", "authType", "lastUpdated", "active" ], "additionalProperties": false } } }, "required": [ "providers" ], "additionalProperties": false }, "HostModelView": { "anyOf": [ { "type": "object", "properties": { "configured": { "type": "boolean", "enum": [ false ] } }, "required": [ "configured" ], "additionalProperties": false }, { "type": "object", "properties": { "configured": { "type": "boolean", "enum": [ true ] }, "provider": { "type": "string" }, "model": { "type": "string" }, "authType": { "type": "string", "enum": [ "api_key", "oauth", "workload" ] }, "baseUrl": { "type": "string" }, "settings": { "type": "object", "properties": { "contextWindow": { "type": "integer", "minimum": 1 }, "maxTokens": { "type": "integer", "minimum": 1 }, "reasoning": { "type": "boolean" }, "inputs": { "type": "array", "items": { "type": "string", "enum": [ "text", "image", "pdf", "office", "audio", "video" ] } }, "compat": { "type": "object", "additionalProperties": {} }, "headers": { "type": "object", "additionalProperties": { "type": "string", "minLength": 1 } }, "callHeaders": { "type": "object", "additionalProperties": { "oneOf": [ { "type": "object", "properties": { "from": { "type": "string", "enum": [ "agent.label" ] }, "key": { "type": "string", "minLength": 1 } }, "required": [ "from", "key" ], "additionalProperties": false }, { "type": "object", "properties": { "from": { "type": "string", "enum": [ "agent.id" ] } }, "required": [ "from" ], "additionalProperties": false }, { "type": "object", "properties": { "from": { "type": "string", "enum": [ "session.owner" ] } }, "required": [ "from" ], "additionalProperties": false } ] } } }, "additionalProperties": false } }, "required": [ "configured", "provider", "model", "authType" ], "additionalProperties": false } ] }, "PutHostModelRequest": { "type": "object", "properties": { "requestId": { "type": "string", "minLength": 1 }, "idempotencyKey": { "type": "string", "minLength": 1, "maxLength": 256 }, "provider": { "type": "string", "minLength": 1 }, "model": { "type": "string", "minLength": 1 }, "baseUrl": { "type": "string", "minLength": 1 }, "settings": { "type": "object", "properties": { "contextWindow": { "type": "integer", "minimum": 1 }, "maxTokens": { "type": "integer", "minimum": 1 }, "reasoning": { "type": "boolean" }, "inputs": { "type": "array", "items": { "type": "string", "enum": [ "text", "image", "pdf", "office", "audio", "video" ] } }, "compat": { "type": "object", "additionalProperties": {} }, "headers": { "type": "object", "additionalProperties": { "type": "string", "minLength": 1 } }, "callHeaders": { "type": "object", "additionalProperties": { "oneOf": [ { "type": "object", "properties": { "from": { "type": "string", "enum": [ "agent.label" ] }, "key": { "type": "string", "minLength": 1 } }, "required": [ "from", "key" ], "additionalProperties": false }, { "type": "object", "properties": { "from": { "type": "string", "enum": [ "agent.id" ] } }, "required": [ "from" ], "additionalProperties": false }, { "type": "object", "properties": { "from": { "type": "string", "enum": [ "session.owner" ] } }, "required": [ "from" ], "additionalProperties": false } ] } } }, "additionalProperties": false }, "auth": { "oneOf": [ { "type": "object", "properties": { "type": { "type": "string", "enum": [ "api_key" ] }, "key": { "type": "string", "minLength": 1 }, "env": { "type": "object", "additionalProperties": { "type": "string" } } }, "required": [ "type", "key" ], "additionalProperties": false }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "oauth" ] }, "refresh": { "type": "string", "minLength": 1 }, "access": { "type": "string", "minLength": 1 }, "expires": { "type": "number" } }, "required": [ "type", "refresh", "access", "expires" ], "additionalProperties": {} }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "workload" ] } }, "required": [ "type" ], "additionalProperties": false } ] } }, "required": [ "requestId", "idempotencyKey", "provider", "model", "auth" ], "additionalProperties": false }, "SelectHostModelRequest": { "type": "object", "properties": { "requestId": { "type": "string", "minLength": 1 }, "idempotencyKey": { "type": "string", "minLength": 1, "maxLength": 256 }, "provider": { "type": "string", "minLength": 1 }, "model": { "type": "string", "minLength": 1 }, "baseUrl": { "type": "string", "minLength": 1 } }, "required": [ "requestId", "idempotencyKey", "provider", "model" ], "additionalProperties": false }, "ListOperatorKeysResponse": { "type": "object", "properties": { "keys": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "role": { "type": "string", "minLength": 1 }, "createdAt": { "type": "string", "minLength": 1 } }, "required": [ "id", "role", "createdAt" ], "additionalProperties": false } } }, "required": [ "keys" ], "additionalProperties": false }, "PutOperatorKeyResponse": { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "role": { "type": "string", "minLength": 1 }, "createdAt": { "type": "string", "minLength": 1 }, "key": { "type": "string", "pattern": "^[0-9a-f]{64}$" }, "rotated": { "type": "boolean" } }, "required": [ "id", "role", "createdAt", "key", "rotated" ], "additionalProperties": false }, "DeleteOperatorKeyResponse": { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "deleted": { "type": "boolean", "enum": [ true ] } }, "required": [ "id", "deleted" ], "additionalProperties": false }, "CredentialCoverage": { "type": "object", "properties": { "agentId": { "type": "string" }, "complete": { "type": "boolean" }, "entries": { "type": "array", "items": { "type": "object", "properties": { "kind": { "type": "string", "enum": [ "mcp", "http" ] }, "agentId": { "type": "string" }, "stage": { "type": "string" }, "name": { "type": "string" }, "serverName": { "type": "string" }, "url": { "type": "string" }, "required": { "type": "boolean" }, "status": { "type": "string", "enum": [ "covered", "missing" ] }, "credential": { "type": "object", "properties": { "agentId": { "type": "string" }, "name": { "type": "string" }, "via": { "type": "string" } }, "required": [ "agentId", "name" ], "additionalProperties": false }, "message": { "type": "string" } }, "required": [ "kind", "name", "serverName", "url", "required", "status", "message" ], "additionalProperties": false } } }, "required": [ "agentId", "complete", "entries" ], "additionalProperties": false }, "CredentialCoverageRequest": { "type": "object", "properties": { "requestId": { "type": "string", "minLength": 1 }, "agentId": { "type": "string", "description": "An Agent id, such as `triage` or `users/alice/triage`" } }, "required": [ "agentId" ], "additionalProperties": false }, "McpPreview": { "type": "object", "properties": { "name": { "type": "string" }, "url": { "type": "string" }, "type": { "type": "string", "enum": [ "streamable-http", "sse" ] }, "credentialSent": { "type": "boolean" }, "serverInfo": { "type": "object", "additionalProperties": {} }, "instructions": { "type": "string" }, "tools": { "type": "array", "items": { "type": "object", "properties": { "serverToolName": { "type": "string" }, "modelName": { "type": "string" }, "description": { "type": "string" }, "annotations": { "type": "object", "additionalProperties": {} }, "schemaBytes": { "type": "integer", "minimum": 0 } }, "required": [ "serverToolName", "schemaBytes" ], "additionalProperties": false } }, "renamed": { "type": "array", "items": { "type": "object", "properties": { "serverToolName": { "type": "string" }, "name": { "type": "string" } }, "required": [ "serverToolName", "name" ], "additionalProperties": false } }, "authRequired": { "type": "object", "properties": { "resourceMetadataUrl": { "type": "string" }, "resourceMetadata": { "type": "object", "additionalProperties": {} } }, "additionalProperties": false } }, "required": [ "name", "url", "type", "credentialSent", "tools", "renamed" ], "additionalProperties": false }, "McpPreviewRequest": { "type": "object", "properties": { "requestId": { "type": "string", "minLength": 1 }, "url": { "type": "string", "minLength": 1 }, "type": { "type": "string", "enum": [ "streamable-http", "sse" ] }, "name": { "type": "string", "pattern": "^[A-Za-z0-9_-]{1,64}$" }, "agentId": { "type": "string", "description": "An Agent id, such as `triage` or `users/alice/triage`" } }, "required": [ "url" ], "additionalProperties": false }, "SigningKeyList": { "type": "object", "properties": { "keys": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "state": { "type": "string", "enum": [ "standby", "current", "previous", "revoked" ] }, "alg": { "type": "string", "enum": [ "ES256" ] }, "publicKey": { "type": "object", "properties": { "kty": { "type": "string", "enum": [ "EC" ] }, "crv": { "type": "string", "enum": [ "P-256" ] }, "x": { "type": "string" }, "y": { "type": "string" }, "kid": { "type": "string" }, "alg": { "type": "string", "enum": [ "ES256" ] }, "use": { "type": "string", "enum": [ "sig" ] } }, "required": [ "kty", "crv", "x", "y", "kid", "alg", "use" ], "additionalProperties": false }, "createdAt": { "type": "string" }, "activatedAt": { "type": [ "string", "null" ] }, "retiredAt": { "type": [ "string", "null" ] }, "revokedAt": { "type": [ "string", "null" ] } }, "required": [ "id", "state", "alg", "publicKey", "createdAt", "activatedAt", "retiredAt", "revokedAt" ], "additionalProperties": false } } }, "required": [ "keys" ], "additionalProperties": false }, "RotateSigningKeysRequest": { "type": "object", "properties": { "requestId": { "type": "string", "minLength": 1 }, "force": { "type": "boolean" } }, "required": [ "requestId" ], "additionalProperties": false }, "SigningKeyView": { "type": "object", "properties": { "id": { "type": "string" }, "state": { "type": "string", "enum": [ "standby", "current", "previous", "revoked" ] }, "alg": { "type": "string", "enum": [ "ES256" ] }, "publicKey": { "type": "object", "properties": { "kty": { "type": "string", "enum": [ "EC" ] }, "crv": { "type": "string", "enum": [ "P-256" ] }, "x": { "type": "string" }, "y": { "type": "string" }, "kid": { "type": "string" }, "alg": { "type": "string", "enum": [ "ES256" ] }, "use": { "type": "string", "enum": [ "sig" ] } }, "required": [ "kty", "crv", "x", "y", "kid", "alg", "use" ], "additionalProperties": false }, "createdAt": { "type": "string" }, "activatedAt": { "type": [ "string", "null" ] }, "retiredAt": { "type": [ "string", "null" ] }, "revokedAt": { "type": [ "string", "null" ] } }, "required": [ "id", "state", "alg", "publicKey", "createdAt", "activatedAt", "retiredAt", "revokedAt" ], "additionalProperties": false }, "RevokeSigningKeyRequest": { "type": "object", "properties": { "requestId": { "type": "string", "minLength": 1 } }, "required": [ "requestId" ], "additionalProperties": false }, "MeResponse": { "type": "object", "properties": { "subject": { "type": "string", "description": "The person the request acts for; absent for an application key alone" }, "scopes": { "type": "array", "items": { "type": "string", "enum": [ "agents:read", "agents:write", "sessions:own", "agent-manifests:write", "studio" ] } }, "agents": { "anyOf": [ { "type": "string", "enum": [ "*" ] }, { "type": "array", "items": { "type": "string", "minLength": 1 } } ] }, "via": { "type": "string", "description": "How the caller authenticated: `application:`, `management:`, `subject` or `issuer:`" } }, "required": [ "scopes", "agents", "via" ], "additionalProperties": false }, "ModelCall": { "type": "object", "properties": { "id": { "type": "string" }, "effectId": { "type": "string" }, "sessionId": { "type": "string" }, "turnId": { "type": "string" }, "manifestName": { "type": "string" }, "provider": { "type": [ "string", "null" ] }, "model": { "type": [ "string", "null" ] }, "at": { "type": "string" }, "startedAt": { "type": [ "string", "null" ] }, "endedAt": { "type": [ "string", "null" ] }, "outcome": { "type": "string", "enum": [ "completed", "failed" ] }, "usage": { "type": [ "object", "null" ], "properties": { "inputTokens": { "type": "integer", "minimum": 0 }, "outputTokens": { "type": "integer", "minimum": 0 }, "totalTokens": { "type": "integer", "minimum": 0 }, "cachedTokens": { "type": "integer", "minimum": 0 }, "cacheWriteTokens": { "type": "integer", "minimum": 0 }, "reasoningTokens": { "type": "integer", "minimum": 0 }, "costUsd": { "type": "number", "minimum": 0 }, "duplicate": { "type": "boolean" }, "tokensReported": { "type": [ "boolean", "null" ] }, "costKnown": { "type": [ "boolean", "null" ] }, "costSplit": { "type": [ "object", "null" ], "properties": { "input": { "type": "number", "minimum": 0 }, "cacheRead": { "type": "number", "minimum": 0 }, "cacheWrite": { "type": "number", "minimum": 0 }, "output": { "type": "number", "minimum": 0 } }, "required": [ "input", "cacheRead", "cacheWrite", "output" ], "additionalProperties": false } }, "required": [ "inputTokens", "outputTokens", "totalTokens", "cachedTokens", "cacheWriteTokens", "reasoningTokens", "costUsd", "duplicate", "tokensReported", "costKnown", "costSplit" ], "additionalProperties": false } }, "required": [ "id", "effectId", "sessionId", "turnId", "manifestName", "provider", "model", "at", "startedAt", "endedAt", "outcome", "usage" ], "additionalProperties": false }, "ModelCallExportPage": { "type": "object", "properties": { "calls": { "type": "array", "items": { "$ref": "#/components/schemas/ModelCall" } }, "next": { "type": [ "string", "null" ] }, "caughtUp": { "type": "boolean" }, "asOf": { "type": "string" } }, "required": [ "calls", "next", "caughtUp", "asOf" ], "additionalProperties": false } }, "parameters": {} }, "paths": { "/v1/tenant": { "get": { "tags": [ "Tenant" ], "summary": "Get the Tenant's status", "security": [ { "managementKey": [] } ], "x-nylorun-credentials": [ "management" ], "x-nylorun-scopes": "never", "parameters": [ { "schema": { "type": "string", "description": "The protocol version, `18`" }, "required": true, "description": "The protocol version, `18`", "name": "Nylorun-Protocol", "in": "header" } ], "responses": { "200": { "description": "Readiness, model, sandboxes, streams and counts", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TenantStatus" } } } }, "400": { "description": "Invalid headers, path, body or cursor", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "401": { "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "403": { "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "404": { "description": "Not found (`not_found`)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "426": { "description": "`Nylorun-Protocol` missing or unsupported", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolRejected" } } } }, "503": { "description": "The Tenant's storage or streams are unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } } } } }, "/v1/tenant/config/seed": { "put": { "tags": [ "Tenant" ], "summary": "Seed the Tenant's configuration", "description": "Sets each setting the Tenant does not have yet; keeps the ones it has.", "security": [ { "managementKey": [] } ], "x-nylorun-credentials": [ "management" ], "x-nylorun-scopes": "never", "parameters": [ { "schema": { "type": "string", "description": "The protocol version, `18`" }, "required": true, "description": "The protocol version, `18`", "name": "Nylorun-Protocol", "in": "header" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SeedTenantConfigRequest" } } } }, "responses": { "200": { "description": "What was set, and what was kept", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SeedTenantConfigResponse" } } } }, "400": { "description": "Invalid headers, path, body or cursor", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "401": { "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "403": { "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "404": { "description": "Not found (`not_found`)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "426": { "description": "`Nylorun-Protocol` missing or unsupported", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolRejected" } } } }, "503": { "description": "The Tenant's storage or streams are unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } } } } }, "/v1/tenant/reset": { "post": { "tags": [ "Tenant" ], "summary": "Reset the Tenant", "description": "Deletes its sessions, its Agents (with their vaults), or both, after draining or cancelling the turns in progress. The Tenant stays open.", "security": [ { "managementKey": [] } ], "x-nylorun-credentials": [ "management" ], "x-nylorun-scopes": "never", "parameters": [ { "schema": { "type": "string", "description": "The protocol version, `18`" }, "required": true, "description": "The protocol version, `18`", "name": "Nylorun-Protocol", "in": "header" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ResetTenantRequest" } } } }, "responses": { "200": { "description": "Reset", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ResetTenantResponse" } } } }, "400": { "description": "Invalid headers, path, body or cursor", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "401": { "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "403": { "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "404": { "description": "Not found (`not_found`)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "426": { "description": "`Nylorun-Protocol` missing or unsupported", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolRejected" } } } }, "503": { "description": "The Tenant's storage or streams are unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } } } } }, "/v1/me": { "get": { "tags": [ "Tenant" ], "summary": "Get who the caller is", "description": "The subject, scopes and Agent grants of the credential that sends it: an application key (alone or acting for a subject), a management key (`via: management:`, no scopes, no agents), or a trusted issuer's token (`via: issuer:`).", "security": [ { "applicationKey": [] }, { "managementKey": [] }, { "issuerToken": [] } ], "x-nylorun-credentials": [ "application", "subject", "management", "token" ], "x-nylorun-scopes": "any", "parameters": [ { "schema": { "type": "string", "description": "The protocol version, `18`" }, "required": true, "description": "The protocol version, `18`", "name": "Nylorun-Protocol", "in": "header" }, { "schema": { "type": "string", "description": "The person an application key acts for" }, "required": false, "description": "The person an application key acts for", "name": "Nylorun-Subject", "in": "header" }, { "schema": { "type": "string", "description": "The subject's space-separated scopes; required with a subject" }, "required": false, "description": "The subject's space-separated scopes; required with a subject", "name": "Nylorun-Scopes", "in": "header" } ], "responses": { "200": { "description": "The caller", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MeResponse" } } } }, "400": { "description": "Invalid headers, path, body or cursor", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "401": { "description": "No credential (`credential_required`), one the Tenant does not accept (`credential_invalid`), a token that expired (`token_expired`), or a token whose issuer's keys cannot be fetched now (`issuer_unavailable`). `WWW-Authenticate: Bearer` names the protected resource metadata (`resource_metadata`)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "403": { "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "404": { "description": "Not found (`not_found`)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "426": { "description": "`Nylorun-Protocol` missing or unsupported", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolRejected" } } } }, "503": { "description": "The Tenant's storage or streams are unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } } } } }, "/openapi/management.json": { "get": { "tags": [ "Tenant" ], "summary": "Get the Management API's document", "responses": { "200": { "description": "The Management API's OpenAPI document" } } } }, "/v1/tenant/keys": { "get": { "tags": [ "Application keys" ], "summary": "List the Tenant's keys", "description": "Every key of the Tenant by name, with its role (`application`, `management` or `studio`) and when it was issued. Keys themselves are never shown again.", "security": [ { "managementKey": [] } ], "x-nylorun-credentials": [ "management" ], "x-nylorun-scopes": "never", "parameters": [ { "schema": { "type": "string", "description": "The protocol version, `18`" }, "required": true, "description": "The protocol version, `18`", "name": "Nylorun-Protocol", "in": "header" } ], "responses": { "200": { "description": "The keys, by id", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ListOperatorKeysResponse" } } } }, "400": { "description": "Invalid headers, path, body or cursor", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "401": { "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "403": { "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "404": { "description": "Not found (`not_found`)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "426": { "description": "`Nylorun-Protocol` missing or unsupported", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolRejected" } } } }, "503": { "description": "The Tenant's storage or streams are unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } } } } }, "/v1/tenant/keys/{keyId}": { "put": { "tags": [ "Application keys" ], "summary": "Create or rotate an application key", "description": "Issues a new application key named `keyId` and returns it this once. An application key of that name is replaced: the old one stops authenticating at once. A management key, `studio` and `bootstrap` are refused.", "security": [ { "managementKey": [] } ], "x-nylorun-credentials": [ "management" ], "x-nylorun-scopes": "never", "parameters": [ { "schema": { "type": "string", "description": "The key's name: `^[a-z][a-z0-9-]{0,31}$`, never `studio` or `bootstrap`" }, "required": true, "description": "The key's name: `^[a-z][a-z0-9-]{0,31}$`, never `studio` or `bootstrap`", "name": "keyId", "in": "path" }, { "schema": { "type": "string", "description": "The protocol version, `18`" }, "required": true, "description": "The protocol version, `18`", "name": "Nylorun-Protocol", "in": "header" } ], "responses": { "200": { "description": "The new key, shown once", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PutOperatorKeyResponse" } } } }, "400": { "description": "Not a key name, a reserved name, or a management key's name" }, "401": { "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "403": { "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "404": { "description": "Not found (`not_found`)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "426": { "description": "`Nylorun-Protocol` missing or unsupported", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolRejected" } } } }, "503": { "description": "The Tenant's storage or streams are unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } } } }, "delete": { "tags": [ "Application keys" ], "summary": "Delete an application key", "description": "The key stops authenticating at once. A management key, `studio` and `bootstrap` are refused.", "security": [ { "managementKey": [] } ], "x-nylorun-credentials": [ "management" ], "x-nylorun-scopes": "never", "parameters": [ { "schema": { "type": "string", "description": "The key's name: `^[a-z][a-z0-9-]{0,31}$`, never `studio` or `bootstrap`" }, "required": true, "description": "The key's name: `^[a-z][a-z0-9-]{0,31}$`, never `studio` or `bootstrap`", "name": "keyId", "in": "path" }, { "schema": { "type": "string", "description": "The protocol version, `18`" }, "required": true, "description": "The protocol version, `18`", "name": "Nylorun-Protocol", "in": "header" } ], "responses": { "200": { "description": "The key is deleted", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DeleteOperatorKeyResponse" } } } }, "400": { "description": "Not a key name, a reserved name, or a management key's name" }, "401": { "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "403": { "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "404": { "description": "Not found (`not_found`)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "426": { "description": "`Nylorun-Protocol` missing or unsupported", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolRejected" } } } }, "503": { "description": "The Tenant's storage or streams are unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } } } } }, "/v1/tenant/models": { "get": { "tags": [ "Models" ], "summary": "List model providers and models", "description": "Each model says what it reads (`inputs`: its catalog's inputs and those the operator added) and what may be added (`addableInputs`).", "security": [ { "managementKey": [] } ], "x-nylorun-credentials": [ "management" ], "x-nylorun-scopes": "never", "parameters": [ { "schema": { "type": "string", "description": "The protocol version, `18`" }, "required": true, "description": "The protocol version, `18`", "name": "Nylorun-Protocol", "in": "header" } ], "responses": { "200": { "description": "Provider and model names, and their inputs", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostModelCatalog" } } } }, "400": { "description": "Invalid headers, path, body or cursor", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "401": { "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "403": { "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "404": { "description": "Not found (`not_found`)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "426": { "description": "`Nylorun-Protocol` missing or unsupported", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolRejected" } } } }, "503": { "description": "The Tenant's storage or streams are unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } } } } }, "/v1/tenant/models/inputs": { "put": { "tags": [ "Models" ], "summary": "Set what a catalog model reads", "description": "Replaces the inputs the operator added to one catalog model (Tenant setting `model.inputs`): only those in its `addableInputs`, which its provider API carries. Its catalog's own inputs always stay; an empty list removes the additions. The agent's harness learns them in `turn.start.model` and decides how each file reaches the model. A custom endpoint sets `settings.inputs` on `PUT /v1/tenant/model` instead.", "security": [ { "managementKey": [] } ], "x-nylorun-credentials": [ "management" ], "x-nylorun-scopes": "never", "parameters": [ { "schema": { "type": "string", "description": "The protocol version, `18`" }, "required": true, "description": "The protocol version, `18`", "name": "Nylorun-Protocol", "in": "header" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PutModelInputsRequest" } } } }, "responses": { "200": { "description": "What the model reads now", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ModelInputsView" } } } }, "400": { "description": "Invalid headers, path, body or cursor", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "401": { "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "403": { "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "404": { "description": "Not found (`not_found`)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "426": { "description": "`Nylorun-Protocol` missing or unsupported", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolRejected" } } } }, "503": { "description": "The Tenant's storage or streams are unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } } } } }, "/v1/tenant/providers": { "get": { "tags": [ "Models" ], "summary": "List the model providers the Tenant has credentials for", "security": [ { "managementKey": [] } ], "x-nylorun-credentials": [ "management" ], "x-nylorun-scopes": "never", "parameters": [ { "schema": { "type": "string", "description": "The protocol version, `18`" }, "required": true, "description": "The protocol version, `18`", "name": "Nylorun-Protocol", "in": "header" } ], "responses": { "200": { "description": "The providers", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ListProvidersResponse" } } } }, "400": { "description": "Invalid headers, path, body or cursor", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "401": { "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "403": { "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "404": { "description": "Not found (`not_found`)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "426": { "description": "`Nylorun-Protocol` missing or unsupported", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolRejected" } } } }, "503": { "description": "The Tenant's storage or streams are unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } } } } }, "/v1/tenant/model": { "get": { "tags": [ "Models" ], "summary": "Get the Tenant's model", "security": [ { "managementKey": [] } ], "x-nylorun-credentials": [ "management" ], "x-nylorun-scopes": "never", "parameters": [ { "schema": { "type": "string", "description": "The protocol version, `18`" }, "required": true, "description": "The protocol version, `18`", "name": "Nylorun-Protocol", "in": "header" } ], "responses": { "200": { "description": "The model its sessions call", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostModelView" } } } }, "400": { "description": "Invalid headers, path, body or cursor", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "401": { "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "403": { "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "404": { "description": "Not found (`not_found`)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "426": { "description": "`Nylorun-Protocol` missing or unsupported", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolRejected" } } } }, "503": { "description": "The Tenant's storage or streams are unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } } } }, "put": { "tags": [ "Models" ], "summary": "Set a model provider's credentials", "security": [ { "managementKey": [] } ], "x-nylorun-credentials": [ "management" ], "x-nylorun-scopes": "never", "parameters": [ { "schema": { "type": "string", "description": "The protocol version, `18`" }, "required": true, "description": "The protocol version, `18`", "name": "Nylorun-Protocol", "in": "header" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PutHostModelRequest" } } } }, "responses": { "200": { "description": "The model now in force", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostModelView" } } } }, "400": { "description": "Invalid headers, path, body or cursor", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "401": { "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "403": { "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "404": { "description": "Not found (`not_found`)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "426": { "description": "`Nylorun-Protocol` missing or unsupported", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolRejected" } } } }, "503": { "description": "The Tenant's storage or streams are unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } } } } }, "/v1/tenant/model/selection": { "put": { "tags": [ "Models" ], "summary": "Choose the provider and model", "security": [ { "managementKey": [] } ], "x-nylorun-credentials": [ "management" ], "x-nylorun-scopes": "never", "parameters": [ { "schema": { "type": "string", "description": "The protocol version, `18`" }, "required": true, "description": "The protocol version, `18`", "name": "Nylorun-Protocol", "in": "header" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SelectHostModelRequest" } } } }, "responses": { "200": { "description": "The model now in force", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostModelView" } } } }, "400": { "description": "Invalid headers, path, body or cursor", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "401": { "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "403": { "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "404": { "description": "Not found (`not_found`)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "426": { "description": "`Nylorun-Protocol` missing or unsupported", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolRejected" } } } }, "503": { "description": "The Tenant's storage or streams are unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } } } } }, "/v1/tenant/usage": { "get": { "tags": [ "Models" ], "summary": "Get what the Tenant's model calls used", "description": "Totals from the model usage ledger, which the model gate writes once per call: for the Tenant, one agent or one turn, over the current UTC day or month, or all time.", "security": [ { "managementKey": [] } ], "x-nylorun-credentials": [ "management" ], "x-nylorun-scopes": "never", "parameters": [ { "schema": { "type": "string", "enum": [ "tenant", "manifest", "turn" ], "default": "tenant" }, "required": false, "name": "scope", "in": "query" }, { "schema": { "type": "string", "minLength": 1 }, "required": false, "name": "id", "in": "query" }, { "schema": { "type": "string", "enum": [ "day", "month", "total" ], "default": "total" }, "required": false, "name": "period", "in": "query" }, { "schema": { "type": "string", "description": "The protocol version, `18`" }, "required": true, "description": "The protocol version, `18`", "name": "Nylorun-Protocol", "in": "header" } ], "responses": { "200": { "description": "The calls, tokens and cost", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ModelUsageTotals" } } } }, "400": { "description": "Invalid headers, path, body or cursor", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "401": { "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "403": { "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "404": { "description": "Not found (`not_found`)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "426": { "description": "`Nylorun-Protocol` missing or unsupported", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolRejected" } } } }, "503": { "description": "The Tenant's storage or streams are unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } } } } }, "/v1/tenant/calls/model": { "get": { "tags": [ "Models" ], "summary": "Export committed model calls in safe transaction order", "security": [ { "managementKey": [] } ], "x-nylorun-credentials": [ "management" ], "x-nylorun-scopes": "never", "parameters": [ { "schema": { "type": "string" }, "required": false, "name": "after", "in": "query" }, { "schema": { "type": "integer", "minimum": 1, "description": "A page holds at most the Tenant's Runtime limit `exportPageItems` (default 1000); a larger limit gets that many. Default 200, or that limit when it is lower" }, "required": false, "description": "A page holds at most the Tenant's Runtime limit `exportPageItems` (default 1000); a larger limit gets that many. Default 200, or that limit when it is lower", "name": "limit", "in": "query" }, { "schema": { "type": "string", "description": "The protocol version, `18`" }, "required": true, "description": "The protocol version, `18`", "name": "Nylorun-Protocol", "in": "header" } ], "responses": { "200": { "description": "An unfiltered resumable ledger page", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ModelCallExportPage" } } } }, "400": { "description": "Invalid headers, path, body or cursor", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "401": { "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "403": { "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "404": { "description": "Not found (`not_found`)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "426": { "description": "`Nylorun-Protocol` missing or unsupported", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolRejected" } } } }, "503": { "description": "The Tenant's storage or streams are unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } } } } }, "/v1/tenant/budgets": { "get": { "tags": [ "Models" ], "summary": "Get the Tenant's model budgets", "security": [ { "managementKey": [] } ], "x-nylorun-credentials": [ "management" ], "x-nylorun-scopes": "never", "parameters": [ { "schema": { "type": "string", "description": "The protocol version, `18`" }, "required": true, "description": "The protocol version, `18`", "name": "Nylorun-Protocol", "in": "header" } ], "responses": { "200": { "description": "The hard caps on model spend", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ModelBudgets" } } } }, "400": { "description": "Invalid headers, path, body or cursor", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "401": { "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "403": { "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "404": { "description": "Not found (`not_found`)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "426": { "description": "`Nylorun-Protocol` missing or unsupported", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolRejected" } } } }, "503": { "description": "The Tenant's storage or streams are unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } } } }, "put": { "tags": [ "Models" ], "summary": "Set the Tenant's model budgets", "description": "Replaces every budget. Before each model call the gate checks the scope's spend against its cap; once a cap is reached the call fails with `budget_exhausted` and the turn with `model.budget_exhausted`. An empty list removes every cap.", "security": [ { "managementKey": [] } ], "x-nylorun-credentials": [ "management" ], "x-nylorun-scopes": "never", "parameters": [ { "schema": { "type": "string", "description": "The protocol version, `18`" }, "required": true, "description": "The protocol version, `18`", "name": "Nylorun-Protocol", "in": "header" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PutModelBudgetsRequest" } } } }, "responses": { "200": { "description": "The budgets now in force", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ModelBudgets" } } } }, "400": { "description": "Invalid headers, path, body or cursor", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "401": { "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "403": { "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "404": { "description": "Not found (`not_found`)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "426": { "description": "`Nylorun-Protocol` missing or unsupported", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolRejected" } } } }, "503": { "description": "The Tenant's storage or streams are unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } } } } }, "/v1/tenant/tool-policy": { "get": { "tags": [ "Tool policy" ], "summary": "Get the Tenant's tool policy", "security": [ { "managementKey": [] } ], "x-nylorun-credentials": [ "management" ], "x-nylorun-scopes": "never", "parameters": [ { "schema": { "type": "string", "description": "The protocol version, `18`" }, "required": true, "description": "The protocol version, `18`", "name": "Nylorun-Protocol", "in": "header" } ], "responses": { "200": { "description": "The rules the Tool Gate applies to every MCP and HTTP tool call", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ToolPolicy" } } } }, "400": { "description": "Invalid headers, path, body or cursor", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "401": { "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "403": { "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "404": { "description": "Not found (`not_found`)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "409": { "description": "A stored rule names an MCP tool by its model-facing `server__tool` name: every call is refused until the policy is set again" }, "426": { "description": "`Nylorun-Protocol` missing or unsupported", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolRejected" } } } }, "503": { "description": "The Tenant's storage or streams are unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } } } }, "put": { "tags": [ "Tool policy" ], "summary": "Set the Tenant's tool policy", "description": "Replaces every rule. The Tool Gate applies them to each MCP and HTTP tool call of every harness, before it sends the call: the strictest rule that matches decides. `deny` refuses the call (the model gets `tool.denied`), `ask` holds it and pauses the turn until a person answers it with an `approve` command on the session, `allow` runs it. A call no rule matches runs. A rule matches when every selector it sets matches: `tool` (the tool's identity: an MCP tool's own name on its `server`, or an HTTP tool's declared name, never the name the model calls it by; `*` matches any run of characters), `server` (an MCP server's name), `kind` (`mcp` or `http`), `agent` (the agent that calls it: the agent manifest's name, or the id of an agent used as a tool or of a flow's agent, never an Agent's id) and `when` (fields of the call's input by dotted path, each tested with `equals`, `in`, `gt`, `gte`, `lt`, `lte` or `matches`). A `tool` with `__` in it, a model-facing `server__tool` name, is refused (`400`): name an MCP tool by `server` and `tool`. A stored policy with such a rule refuses every call until it is set again. Sandbox tools never cross the gate. An empty list allows every call.", "security": [ { "managementKey": [] } ], "x-nylorun-credentials": [ "management" ], "x-nylorun-scopes": "never", "parameters": [ { "schema": { "type": "string", "description": "The protocol version, `18`" }, "required": true, "description": "The protocol version, `18`", "name": "Nylorun-Protocol", "in": "header" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PutToolPolicyRequest" } } } }, "responses": { "200": { "description": "The policy now in force", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ToolPolicy" } } } }, "400": { "description": "Invalid headers, path, body or cursor", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "401": { "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "403": { "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "404": { "description": "Not found (`not_found`)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "426": { "description": "`Nylorun-Protocol` missing or unsupported", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolRejected" } } } }, "503": { "description": "The Tenant's storage or streams are unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } } } } }, "/v1/tenant/credential-coverage": { "post": { "tags": [ "Credential coverage" ], "summary": "Check an Agent's credentials", "description": "For each remote MCP server and each HTTP tool with a `credential` that Agent `agentId`'s manifest version declares (its own, its agents used as tools' and a flow's), the credential its sessions would send: the Agent's secret bound to the URL (`covered`), or none (`missing`). No secret is read and no server is called.", "security": [ { "managementKey": [] } ], "x-nylorun-credentials": [ "management" ], "x-nylorun-scopes": "never", "parameters": [ { "schema": { "type": "string", "description": "The protocol version, `18`" }, "required": true, "description": "The protocol version, `18`", "name": "Nylorun-Protocol", "in": "header" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialCoverageRequest" } } } }, "responses": { "200": { "description": "One entry per declared URL", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CredentialCoverage" } } } }, "400": { "description": "Invalid headers, path, body or cursor", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "401": { "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "403": { "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "404": { "description": "No such Agent", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "426": { "description": "`Nylorun-Protocol` missing or unsupported", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolRejected" } } } }, "503": { "description": "The Tenant's storage or streams are unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } } } } }, "/v1/tenant/mcp/preview": { "post": { "tags": [ "MCP servers" ], "summary": "Preview an MCP server's tools", "description": "Connects to the remote MCP server at `url` with the credential for that URL in the vault of the Agent `agentId`, if given (its headers and `via`; never an identity header), under the Host's address policy, lists its tools within 15 s and closes the connection. It never calls a tool. Each tool comes with the name the model would call it (`modelName`, made with `name`), its annotations and its input schema's size. A server that answers `401` is `authRequired`, with its RFC 9728 protected-resource metadata when it publishes any: it needs a person's sign-in, so reach it through a gateway (`via`), or with a key. No credential value is in the answer.", "security": [ { "managementKey": [] } ], "x-nylorun-credentials": [ "management" ], "x-nylorun-scopes": "never", "parameters": [ { "schema": { "type": "string", "description": "The protocol version, `18`" }, "required": true, "description": "The protocol version, `18`", "name": "Nylorun-Protocol", "in": "header" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/McpPreviewRequest" } } } }, "responses": { "200": { "description": "The server's tools, or that it needs a credential (`authRequired`)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/McpPreview" } } } }, "400": { "description": "Invalid headers, path, body or cursor", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "401": { "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "403": { "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "404": { "description": "Not found (`not_found`)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "409": { "description": "The Agent's credential for the URL cannot be used", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "426": { "description": "`Nylorun-Protocol` missing or unsupported", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolRejected" } } } }, "502": { "description": "The server could not be listed (`mcp_preview_failed`): `details.failure` is the code a tool call would have failed with, such as `mcp.unreachable` for an address the Host refuses", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "503": { "description": "The Tenant's storage or streams are unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } } } } }, "/v1/tenant/signing-keys": { "get": { "tags": [ "Signing keys" ], "summary": "List signing keys", "security": [ { "managementKey": [] } ], "x-nylorun-credentials": [ "management" ], "x-nylorun-scopes": "never", "parameters": [ { "schema": { "type": "string", "description": "The protocol version, `18`" }, "required": true, "description": "The protocol version, `18`", "name": "Nylorun-Protocol", "in": "header" } ], "responses": { "200": { "description": "Standby, current, previous and revoked keys", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SigningKeyList" } } } }, "400": { "description": "Invalid headers, path, body or cursor", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "401": { "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "403": { "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "404": { "description": "Not found (`not_found`)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "426": { "description": "`Nylorun-Protocol` missing or unsupported", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolRejected" } } } }, "503": { "description": "The Tenant's storage or streams are unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } } } } }, "/v1/tenant/signing-keys/rotate": { "post": { "tags": [ "Signing keys" ], "summary": "Rotate the signing keys", "description": "The standby key signs from now on; the current one still verifies tokens it signed. `force` also ends every outstanding capability link and run token.", "security": [ { "managementKey": [] } ], "x-nylorun-credentials": [ "management" ], "x-nylorun-scopes": "never", "parameters": [ { "schema": { "type": "string", "description": "The protocol version, `18`" }, "required": true, "description": "The protocol version, `18`", "name": "Nylorun-Protocol", "in": "header" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RotateSigningKeysRequest" } } } }, "responses": { "200": { "description": "The keys after rotation", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SigningKeyList" } } } }, "400": { "description": "Invalid headers, path, body or cursor", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "401": { "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "403": { "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "404": { "description": "Not found (`not_found`)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "409": { "description": "The previous key may still verify outstanding tokens" }, "426": { "description": "`Nylorun-Protocol` missing or unsupported", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolRejected" } } } }, "503": { "description": "The Tenant's storage or streams are unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } } } } }, "/v1/tenant/signing-keys/{kid}/revoke": { "post": { "tags": [ "Signing keys" ], "summary": "Revoke a signing key", "security": [ { "managementKey": [] } ], "x-nylorun-credentials": [ "management" ], "x-nylorun-scopes": "never", "parameters": [ { "schema": { "type": "string" }, "required": true, "name": "kid", "in": "path" }, { "schema": { "type": "string", "description": "The protocol version, `18`" }, "required": true, "description": "The protocol version, `18`", "name": "Nylorun-Protocol", "in": "header" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RevokeSigningKeyRequest" } } } }, "responses": { "200": { "description": "The key, revoked", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SigningKeyView" } } } }, "400": { "description": "Invalid headers, path, body or cursor", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "401": { "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "403": { "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "404": { "description": "Not found (`not_found`)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "409": { "description": "Rotate before revoking the current key" }, "426": { "description": "`Nylorun-Protocol` missing or unsupported", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolRejected" } } } }, "503": { "description": "The Tenant's storage or streams are unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } } } } }, "/v1/tenant/sandbox": { "get": { "tags": [ "Settings" ], "summary": "Get the Tenant's sandbox backend and Agent compute settings", "security": [ { "managementKey": [] } ], "x-nylorun-credentials": [ "management" ], "x-nylorun-scopes": "never", "parameters": [ { "schema": { "type": "string", "description": "The protocol version, `18`" }, "required": true, "description": "The protocol version, `18`", "name": "Nylorun-Protocol", "in": "header" } ], "responses": { "200": { "description": "The backend in use and the configuration in force", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TenantSandboxView" } } } }, "400": { "description": "Invalid headers, path, body or cursor", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "401": { "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "403": { "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "404": { "description": "Not found (`not_found`)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "426": { "description": "`Nylorun-Protocol` missing or unsupported", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolRejected" } } } }, "503": { "description": "The Tenant's storage or streams are unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } } } }, "put": { "tags": [ "Settings" ], "summary": "Set the Tenant's Agent compute settings", "description": "The limits every Agent's runtime must fit, the pods' stop grace and where harnesses may run (Tenant setting `environments.config`).", "security": [ { "managementKey": [] } ], "x-nylorun-credentials": [ "management" ], "x-nylorun-scopes": "never", "parameters": [ { "schema": { "type": "string", "description": "The protocol version, `18`" }, "required": true, "description": "The protocol version, `18`", "name": "Nylorun-Protocol", "in": "header" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PutTenantEnvironmentsRequest" } } } }, "responses": { "200": { "description": "The configuration now in force", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TenantSandboxView" } } } }, "400": { "description": "Invalid headers, path, body or cursor", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "401": { "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "403": { "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "404": { "description": "Not found (`not_found`)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "426": { "description": "`Nylorun-Protocol` missing or unsupported", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolRejected" } } } }, "503": { "description": "The Tenant's storage or streams are unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } } } } }, "/v1/tenant/artifacts": { "get": { "tags": [ "Settings" ], "summary": "Get the Tenant's artifact limits", "security": [ { "managementKey": [] } ], "x-nylorun-credentials": [ "management" ], "x-nylorun-scopes": "never", "parameters": [ { "schema": { "type": "string", "description": "The protocol version, `18`" }, "required": true, "description": "The protocol version, `18`", "name": "Nylorun-Protocol", "in": "header" } ], "responses": { "200": { "description": "The limits in force and the bytes used", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TenantArtifactsView" } } } }, "400": { "description": "Invalid headers, path, body or cursor", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "401": { "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "403": { "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "404": { "description": "Not found (`not_found`)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "426": { "description": "`Nylorun-Protocol` missing or unsupported", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolRejected" } } } }, "503": { "description": "The Tenant's storage or streams are unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } } } }, "put": { "tags": [ "Settings" ], "summary": "Set the Tenant's artifact limits", "description": "The largest file one upload may store, and the most bytes all artifacts may hold. Unset limits take the defaults (100 MiB and 10 GiB).", "security": [ { "managementKey": [] } ], "x-nylorun-credentials": [ "management" ], "x-nylorun-scopes": "never", "parameters": [ { "schema": { "type": "string", "description": "The protocol version, `18`" }, "required": true, "description": "The protocol version, `18`", "name": "Nylorun-Protocol", "in": "header" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PutTenantArtifactsRequest" } } } }, "responses": { "200": { "description": "The limits now in force", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TenantArtifactsView" } } } }, "400": { "description": "Invalid headers, path, body or cursor", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "401": { "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "403": { "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "404": { "description": "Not found (`not_found`)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "426": { "description": "`Nylorun-Protocol` missing or unsupported", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolRejected" } } } }, "503": { "description": "The Tenant's storage or streams are unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } } } } }, "/v1/tenant/skills": { "get": { "tags": [ "Settings" ], "summary": "Get the Tenant's skill limit", "security": [ { "managementKey": [] } ], "x-nylorun-credentials": [ "management" ], "x-nylorun-scopes": "never", "parameters": [ { "schema": { "type": "string", "description": "The protocol version, `18`" }, "required": true, "description": "The protocol version, `18`", "name": "Nylorun-Protocol", "in": "header" } ], "responses": { "200": { "description": "The limit in force", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TenantSkillsView" } } } }, "400": { "description": "Invalid headers, path, body or cursor", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "401": { "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "403": { "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "404": { "description": "Not found (`not_found`)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "426": { "description": "`Nylorun-Protocol` missing or unsupported", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolRejected" } } } }, "503": { "description": "The Tenant's storage or streams are unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } } } }, "put": { "tags": [ "Settings" ], "summary": "Set the Tenant's skill limit", "description": "The most bytes one skill's files may hold together, for every agent manifest the Tenant stores, whose runtime section may set a lower one (`limits.skills`). Unset, the limit takes the default (2 GiB). Manifests already saved keep their skills; a session opens only while its Agent's skills fit.", "security": [ { "managementKey": [] } ], "x-nylorun-credentials": [ "management" ], "x-nylorun-scopes": "never", "parameters": [ { "schema": { "type": "string", "description": "The protocol version, `18`" }, "required": true, "description": "The protocol version, `18`", "name": "Nylorun-Protocol", "in": "header" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PutTenantSkillsRequest" } } } }, "responses": { "200": { "description": "The limit now in force", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TenantSkillsView" } } } }, "400": { "description": "Invalid headers, path, body or cursor", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "401": { "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "403": { "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "404": { "description": "Not found (`not_found`)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "426": { "description": "`Nylorun-Protocol` missing or unsupported", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolRejected" } } } }, "503": { "description": "The Tenant's storage or streams are unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } } } } }, "/v1/tenant/limits": { "get": { "tags": [ "Settings" ], "summary": "Get the Tenant's Runtime limits", "description": "The sizes, counts and deadlines the Runtime holds what crosses it to: the Tenant's (Tenant setting `limits.config`), with the default for each it leaves out. Harnesses get the ones they must respect in `turn.start.limits` (record entry, model call, model file, tool answer, custom harness state, Harness API chunk, folder entries). Defaults and ceilings: `recordEntryBytes` 983040 bytes, at most 983040 (S2 takes records of at most 1048576 bytes, and an event's envelope needs 65536 beside its payload); `modelCallBytes` 33554432 bytes, at most 536870888 (the Model Gate reads a call's body as one string, of at most 536870888 characters); `modelFileBytes` 8388608 bytes, at most 402653166 (a file goes to the provider as one base64 string, of at most 536870888 characters); `toolAnswerBytes` 8388608 bytes, at most 33554432 (a harness reports the answer to core in one Harness API frame (67108864 bytes), as JSON, whose escapes may double it); `harnessStateBytes` 262144 bytes, at most 33554432 (the state crosses in one Harness API frame (67108864 bytes) with the rest of its output or turn.start); `chunkBytes` 16777216 bytes, at most 50266112 (a chunk crosses in base64 in one Harness API frame (67108864 bytes), with room for the frame's own JSON); `folderEntries` 10000 entries, at most 4628197 (a folder's manifest is read as one string, of at most 536870888 characters, and each entry takes at least 116); `requestBodyBytes` 1048576 bytes, at most 536870888 (a body is read as one string, of at most 536870888 characters); `messageParts` 32 entries, at most 19884106 (parts arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 27); `pageItems` 200 entries, at most 178956962 (a page's items go in one response body, written as one string of at most 536870888 characters, and each takes at least 3); `exportPageItems` 1000 entries, at most 178956962 (a page's calls go in one response body, written as one string of at most 536870888 characters, and each takes at least 3); `environmentEventItems` 1000 entries, at most 178956962 (the events go in one response body, written as one string of at most 536870888 characters, and each takes at least 3); `inlineFileBytes` 20971520 bytes, at most 402653166 (a file sent inline arrives in base64 in a body read as one string, of at most 536870888 characters); `a2aWaitMs` 300000 milliseconds, at most 2147483647 (the wait is timed with a JavaScript timer, which waits at most 2147483647 ms); `errorExcerptChars` 2000 characters, at most 163840 (the excerpt is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `traceContentBytes` 8192 bytes, at most 983040 (span content is cut from one record entry, which holds at most 983040 bytes); `environmentLabels` 32 entries, at most 59652320 (labels arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 9); `artifactLabels` 32 entries, at most 59652320 (labels arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 9); `labelKeyChars` 63 characters, at most 536870888 (a label key arrives in one request body, read as one string of at most 536870888 characters); `labelValueChars` 256 characters, at most 536870888 (a label value arrives in one request body, read as one string of at most 536870888 characters); `environmentSetupCommands` 16 entries, at most 33554430 (setup commands arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 16); `environmentFiles` 16 entries, at most 16268814 (input file entries arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 33); `environmentFilesPerEntry` 1000 entries, at most 6710886 (the files of an entry arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 80); `environmentSecretSlots` 64 entries, at most 14128181 (secret slots arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 38); `setupCommandChars` 4096 characters, at most 43690 (a command runs as one argument of /bin/sh -c, which Linux takes up to 131072 bytes long (MAX_ARG_STRLEN, with its NUL), and UTF-8 may take 3 bytes for a character); `setupCommandMs` 1800000 milliseconds, at most 2147483647 (the engine times a command with a JavaScript timer, which waits at most 2147483647 ms); `setupOutputChars` 4096 characters, at most 163840 (the output is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `setupReasonChars` 500 characters, at most 163840 (the reason is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `setupCommandExcerptChars` 80 characters, at most 163840 (the reason is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `manifestDescriptionChars` 1024 characters, at most 536870888 (a description arrives in one request body, read as one string of at most 536870888 characters); `secretDescriptionChars` 500 characters, at most 536870888 (a description arrives in one request body, read as one string of at most 536870888 characters); `secretValueChars` 8192 characters, at most 536870888 (a value arrives in one request body, read as one string of at most 536870888 characters); `secretHosts` 32 entries, at most 89478481 (hosts arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 6); `diskVersionEntries` 200000 entries, at most 1917396 (a disk is listed in one Harness API frame (67108864 bytes, each entry at least 35), and a version's manifest is read as one string of at most 536870888 characters); `diskVersionBytes` 10737418240 bytes, at most 9007199254740991 (the files' sizes are added up in a JavaScript number, exact up to 9007199254740991); `diskLeaseMs` 120000 milliseconds, at most 2147483647 (the lease is renewed with a JavaScript timer, which waits at most 2147483647 ms); `diskPodWaitMs` 60000 milliseconds, at most 9007199254740991 (the deadline is reckoned from the clock in a JavaScript number, exact up to 9007199254740991); `modelRequestMs` 600000 milliseconds, at most 2147483647 (the provider's SDK times the request with a JavaScript timer, which waits at most 2147483647 ms); `modelIdleMs` 300000 milliseconds, at most 2147483647 (the stream's silence is timed with a JavaScript timer, which waits at most 2147483647 ms); `modelAttempts` 3 attempts, at most 9007199254740991 (attempts are counted in a JavaScript number, exact up to 9007199254740991); `modelRetryDelayMs` 2000 milliseconds, at most 2147483647 (the delay is waited with a JavaScript timer, which waits at most 2147483647 ms); `modelProviderRetries` 2 retries, at most 9007199254740991 (retries are counted in a JavaScript number, exact up to 9007199254740991); `modelRetryDelayMaxMs` 60000 milliseconds, at most 2147483647 (the delay is waited with a JavaScript timer, which waits at most 2147483647 ms); `toolAttempts` 3 attempts, at most 9007199254740991 (sends are counted in a JavaScript number, exact up to 9007199254740991); `httpToolTimeoutMs` 300000 milliseconds, at most 2147483647 (the call is timed with a JavaScript timer, which waits at most 2147483647 ms); `mcpSnapshotBytes` 4194304 bytes, at most 16777216 (the facts cross in turn.start, one Harness API frame (67108864 bytes), beside the harness's state (at most half of it) and the rest); `mcpPreviewMs` 15000 milliseconds, at most 2147483647 (the preview is timed with a JavaScript timer, which waits at most 2147483647 ms); `mcpMetadataBytes` 65536 bytes, at most 536870888 (the document is read as one string, of at most 536870888 characters); `toolRules` 200 entries, at most 28256362 (rules arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 19); `toolRuleFieldChars` 200 characters, at most 536870888 (a selector arrives in one request body, read as one string of at most 536870888 characters); `toolRuleTextChars` 500 characters, at most 536870888 (a text arrives in one request body, read as one string of at most 536870888 characters); `modelBudgets` 100 entries, at most 28256362 (budgets arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 19); `triggersPerAgent` 20 entries, at most 8521760 (triggers arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 63); `triggerMinIntervalMs` 60000 milliseconds, at most 9007199254740991 (the gap is reckoned from the clock in a JavaScript number, exact up to 9007199254740991); `triggerRunsPerHour` 60 runs, at most 9007199254740991 (runs are counted in a JavaScript number, exact up to 9007199254740991); `triggerJitterPercent` 10 percent, at most 50 (an offset past half the interval could move a run past the next one); `triggerJitterMaxMs` 300000 milliseconds, at most 2147483647 (the offset is waited with a JavaScript timer, which waits at most 2147483647 ms); `triggerPromptChars` 8000 characters, at most 163840 (the prompt is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `triggerRunRetentionMs` 2592000000 milliseconds, at most 9007199254740991 (the age is reckoned from the clock in a JavaScript number, exact up to 9007199254740991); `wakeMaxAheadMs` 2592000000 milliseconds, at most 9007199254740991 (the time is reckoned from the clock in a JavaScript number, exact up to 9007199254740991); `wakeNoteChars` 2000 characters, at most 163840 (the note is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `memoryBytes` 102400 bytes, at most 33554432 (a memory reaches a harness in one Harness API frame (67108864 bytes), as JSON, whose escapes may double it); `memoriesPerAgent` 10000 entries, at most 9007199254740991 (memories are counted in a JavaScript number, exact up to 9007199254740991); `memoryIndexLines` 200 entries, at most 9007199254740991 (the lines are counted in a JavaScript number, exact up to 9007199254740991); `memoryIndexBytes` 25600 bytes, at most 16777216 (the index crosses in turn.start, one Harness API frame (67108864 bytes), beside the harness's state and the rest); `webhookBodyBytes` 262144 bytes, at most 983040 (the payload goes into one record entry, which holds at most 983040 bytes); `sessionQueuedMessages` 100 entries, at most 9007199254740991 (queued messages are counted in a JavaScript number, exact up to 9007199254740991); `flowConcurrency` 8 effects, at most 9007199254740991 (running effects are counted in a JavaScript number, exact up to 9007199254740991); `flowMapItems` 1000 entries, at most 9007199254740991 (items are counted in a JavaScript number, exact up to 9007199254740991); `flowLoopIterations` 100 iterations, at most 9007199254740991 (iterations are counted in a JavaScript number, exact up to 9007199254740991); `folderFiles` 2000 entries, at most 5478274 (a folder's files arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 98); `folderBytes` 52428800 bytes, at most 9007199254740991 (the files' sizes are added up in a JavaScript number, exact up to 9007199254740991); `folderTextFileBytes` 1048576 bytes, at most 536870888 (the compiler reads a file as one string, of at most 536870888 characters).", "security": [ { "managementKey": [] } ], "x-nylorun-credentials": [ "management" ], "x-nylorun-scopes": "never", "parameters": [ { "schema": { "type": "string", "description": "The protocol version, `18`" }, "required": true, "description": "The protocol version, `18`", "name": "Nylorun-Protocol", "in": "header" } ], "responses": { "200": { "description": "The limits in force", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TenantLimitsView" } } } }, "400": { "description": "Invalid headers, path, body or cursor", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "401": { "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "403": { "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "404": { "description": "Not found (`not_found`)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "426": { "description": "`Nylorun-Protocol` missing or unsupported", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolRejected" } } } }, "503": { "description": "The Tenant's storage or streams are unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } } } }, "put": { "tags": [ "Settings" ], "summary": "Set the Tenant's Runtime limits", "description": "Replaces the Tenant's Runtime limits: a limit left out takes its default. A limit above its ceiling, which a dependency sets, is `400` naming the ceiling, and nothing is written. Each is read where it is checked, so a new value holds for the next request, write, call or segment. Defaults and ceilings: `recordEntryBytes` 983040 bytes, at most 983040 (S2 takes records of at most 1048576 bytes, and an event's envelope needs 65536 beside its payload); `modelCallBytes` 33554432 bytes, at most 536870888 (the Model Gate reads a call's body as one string, of at most 536870888 characters); `modelFileBytes` 8388608 bytes, at most 402653166 (a file goes to the provider as one base64 string, of at most 536870888 characters); `toolAnswerBytes` 8388608 bytes, at most 33554432 (a harness reports the answer to core in one Harness API frame (67108864 bytes), as JSON, whose escapes may double it); `harnessStateBytes` 262144 bytes, at most 33554432 (the state crosses in one Harness API frame (67108864 bytes) with the rest of its output or turn.start); `chunkBytes` 16777216 bytes, at most 50266112 (a chunk crosses in base64 in one Harness API frame (67108864 bytes), with room for the frame's own JSON); `folderEntries` 10000 entries, at most 4628197 (a folder's manifest is read as one string, of at most 536870888 characters, and each entry takes at least 116); `requestBodyBytes` 1048576 bytes, at most 536870888 (a body is read as one string, of at most 536870888 characters); `messageParts` 32 entries, at most 19884106 (parts arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 27); `pageItems` 200 entries, at most 178956962 (a page's items go in one response body, written as one string of at most 536870888 characters, and each takes at least 3); `exportPageItems` 1000 entries, at most 178956962 (a page's calls go in one response body, written as one string of at most 536870888 characters, and each takes at least 3); `environmentEventItems` 1000 entries, at most 178956962 (the events go in one response body, written as one string of at most 536870888 characters, and each takes at least 3); `inlineFileBytes` 20971520 bytes, at most 402653166 (a file sent inline arrives in base64 in a body read as one string, of at most 536870888 characters); `a2aWaitMs` 300000 milliseconds, at most 2147483647 (the wait is timed with a JavaScript timer, which waits at most 2147483647 ms); `errorExcerptChars` 2000 characters, at most 163840 (the excerpt is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `traceContentBytes` 8192 bytes, at most 983040 (span content is cut from one record entry, which holds at most 983040 bytes); `environmentLabels` 32 entries, at most 59652320 (labels arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 9); `artifactLabels` 32 entries, at most 59652320 (labels arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 9); `labelKeyChars` 63 characters, at most 536870888 (a label key arrives in one request body, read as one string of at most 536870888 characters); `labelValueChars` 256 characters, at most 536870888 (a label value arrives in one request body, read as one string of at most 536870888 characters); `environmentSetupCommands` 16 entries, at most 33554430 (setup commands arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 16); `environmentFiles` 16 entries, at most 16268814 (input file entries arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 33); `environmentFilesPerEntry` 1000 entries, at most 6710886 (the files of an entry arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 80); `environmentSecretSlots` 64 entries, at most 14128181 (secret slots arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 38); `setupCommandChars` 4096 characters, at most 43690 (a command runs as one argument of /bin/sh -c, which Linux takes up to 131072 bytes long (MAX_ARG_STRLEN, with its NUL), and UTF-8 may take 3 bytes for a character); `setupCommandMs` 1800000 milliseconds, at most 2147483647 (the engine times a command with a JavaScript timer, which waits at most 2147483647 ms); `setupOutputChars` 4096 characters, at most 163840 (the output is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `setupReasonChars` 500 characters, at most 163840 (the reason is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `setupCommandExcerptChars` 80 characters, at most 163840 (the reason is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `manifestDescriptionChars` 1024 characters, at most 536870888 (a description arrives in one request body, read as one string of at most 536870888 characters); `secretDescriptionChars` 500 characters, at most 536870888 (a description arrives in one request body, read as one string of at most 536870888 characters); `secretValueChars` 8192 characters, at most 536870888 (a value arrives in one request body, read as one string of at most 536870888 characters); `secretHosts` 32 entries, at most 89478481 (hosts arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 6); `diskVersionEntries` 200000 entries, at most 1917396 (a disk is listed in one Harness API frame (67108864 bytes, each entry at least 35), and a version's manifest is read as one string of at most 536870888 characters); `diskVersionBytes` 10737418240 bytes, at most 9007199254740991 (the files' sizes are added up in a JavaScript number, exact up to 9007199254740991); `diskLeaseMs` 120000 milliseconds, at most 2147483647 (the lease is renewed with a JavaScript timer, which waits at most 2147483647 ms); `diskPodWaitMs` 60000 milliseconds, at most 9007199254740991 (the deadline is reckoned from the clock in a JavaScript number, exact up to 9007199254740991); `modelRequestMs` 600000 milliseconds, at most 2147483647 (the provider's SDK times the request with a JavaScript timer, which waits at most 2147483647 ms); `modelIdleMs` 300000 milliseconds, at most 2147483647 (the stream's silence is timed with a JavaScript timer, which waits at most 2147483647 ms); `modelAttempts` 3 attempts, at most 9007199254740991 (attempts are counted in a JavaScript number, exact up to 9007199254740991); `modelRetryDelayMs` 2000 milliseconds, at most 2147483647 (the delay is waited with a JavaScript timer, which waits at most 2147483647 ms); `modelProviderRetries` 2 retries, at most 9007199254740991 (retries are counted in a JavaScript number, exact up to 9007199254740991); `modelRetryDelayMaxMs` 60000 milliseconds, at most 2147483647 (the delay is waited with a JavaScript timer, which waits at most 2147483647 ms); `toolAttempts` 3 attempts, at most 9007199254740991 (sends are counted in a JavaScript number, exact up to 9007199254740991); `httpToolTimeoutMs` 300000 milliseconds, at most 2147483647 (the call is timed with a JavaScript timer, which waits at most 2147483647 ms); `mcpSnapshotBytes` 4194304 bytes, at most 16777216 (the facts cross in turn.start, one Harness API frame (67108864 bytes), beside the harness's state (at most half of it) and the rest); `mcpPreviewMs` 15000 milliseconds, at most 2147483647 (the preview is timed with a JavaScript timer, which waits at most 2147483647 ms); `mcpMetadataBytes` 65536 bytes, at most 536870888 (the document is read as one string, of at most 536870888 characters); `toolRules` 200 entries, at most 28256362 (rules arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 19); `toolRuleFieldChars` 200 characters, at most 536870888 (a selector arrives in one request body, read as one string of at most 536870888 characters); `toolRuleTextChars` 500 characters, at most 536870888 (a text arrives in one request body, read as one string of at most 536870888 characters); `modelBudgets` 100 entries, at most 28256362 (budgets arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 19); `triggersPerAgent` 20 entries, at most 8521760 (triggers arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 63); `triggerMinIntervalMs` 60000 milliseconds, at most 9007199254740991 (the gap is reckoned from the clock in a JavaScript number, exact up to 9007199254740991); `triggerRunsPerHour` 60 runs, at most 9007199254740991 (runs are counted in a JavaScript number, exact up to 9007199254740991); `triggerJitterPercent` 10 percent, at most 50 (an offset past half the interval could move a run past the next one); `triggerJitterMaxMs` 300000 milliseconds, at most 2147483647 (the offset is waited with a JavaScript timer, which waits at most 2147483647 ms); `triggerPromptChars` 8000 characters, at most 163840 (the prompt is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `triggerRunRetentionMs` 2592000000 milliseconds, at most 9007199254740991 (the age is reckoned from the clock in a JavaScript number, exact up to 9007199254740991); `wakeMaxAheadMs` 2592000000 milliseconds, at most 9007199254740991 (the time is reckoned from the clock in a JavaScript number, exact up to 9007199254740991); `wakeNoteChars` 2000 characters, at most 163840 (the note is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `memoryBytes` 102400 bytes, at most 33554432 (a memory reaches a harness in one Harness API frame (67108864 bytes), as JSON, whose escapes may double it); `memoriesPerAgent` 10000 entries, at most 9007199254740991 (memories are counted in a JavaScript number, exact up to 9007199254740991); `memoryIndexLines` 200 entries, at most 9007199254740991 (the lines are counted in a JavaScript number, exact up to 9007199254740991); `memoryIndexBytes` 25600 bytes, at most 16777216 (the index crosses in turn.start, one Harness API frame (67108864 bytes), beside the harness's state and the rest); `webhookBodyBytes` 262144 bytes, at most 983040 (the payload goes into one record entry, which holds at most 983040 bytes); `sessionQueuedMessages` 100 entries, at most 9007199254740991 (queued messages are counted in a JavaScript number, exact up to 9007199254740991); `flowConcurrency` 8 effects, at most 9007199254740991 (running effects are counted in a JavaScript number, exact up to 9007199254740991); `flowMapItems` 1000 entries, at most 9007199254740991 (items are counted in a JavaScript number, exact up to 9007199254740991); `flowLoopIterations` 100 iterations, at most 9007199254740991 (iterations are counted in a JavaScript number, exact up to 9007199254740991); `folderFiles` 2000 entries, at most 5478274 (a folder's files arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 98); `folderBytes` 52428800 bytes, at most 9007199254740991 (the files' sizes are added up in a JavaScript number, exact up to 9007199254740991); `folderTextFileBytes` 1048576 bytes, at most 536870888 (the compiler reads a file as one string, of at most 536870888 characters).", "security": [ { "managementKey": [] } ], "x-nylorun-credentials": [ "management" ], "x-nylorun-scopes": "never", "parameters": [ { "schema": { "type": "string", "description": "The protocol version, `18`" }, "required": true, "description": "The protocol version, `18`", "name": "Nylorun-Protocol", "in": "header" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PutTenantLimitsRequest" } } } }, "responses": { "200": { "description": "The limits now in force", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TenantLimitsView" } } } }, "400": { "description": "A limit above its ceiling" }, "401": { "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "403": { "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "404": { "description": "Not found (`not_found`)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } }, "426": { "description": "`Nylorun-Protocol` missing or unsupported", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProtocolRejected" } } } }, "503": { "description": "The Tenant's storage or streams are unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rejected" } } } } } } } }, "webhooks": {}, "tags": [ { "name": "Tenant", "description": "The Tenant's status, and seeding or resetting it. `admin.tenant` in `@nylorun/admin`." }, { "name": "Application keys", "description": "The keys app servers call the Runtime API with: create, rotate, list and delete them. Management keys come only from the Tenant's machine. `admin.keys`." }, { "name": "Models", "description": "Model providers, their credentials, the model the Tenant uses, what each model reads, what it spent, every model call for export, and the budgets that cap it. `admin.models`." }, { "name": "Tool policy", "description": "The rules the Tool Gate applies to every MCP and HTTP tool call of every harness: refuse it, hold it for a person's approval, or run it. `admin.toolPolicy`." }, { "name": "Credential coverage", "description": "Which secret of an Agent's vault each of its manifest's MCP servers and HTTP tools would get, before a session opens. The secrets themselves are written on the Runtime API. `admin.coverage`." }, { "name": "MCP servers", "description": "See a remote MCP server's tools before an agent names it, with an Agent's credential for its URL: their model names, sizes and annotations, or that it needs a person's sign-in. `admin.mcp`." }, { "name": "Signing keys", "description": "The keys the Runtime signs capability links and run tokens with; their public halves are the Runtime API's JWKS. `admin.signingKeys`." }, { "name": "Settings", "description": "The Tenant's sandbox backend, Agent compute, artifact and skill settings, and its Runtime limits. `admin.settings`." } ] }