INVALID_FIELD

A field failed validation.

Checked 2026-09-28

A field failed validation.

HTTP 400 · gRPC INVALID_ARGUMENT · the error body

#Returned by

Method	Scope	What it does
`access.orgs.list`	`access:read`	Lists orgs the caller can see.
`access.orgs.create`	`access:admin`	Creates an org. Access assigns the id.
`access.orgs.update`	`access:admin`	Updates an org.
`access.projects.list`	`access:read`	Lists projects in an org.
`access.projects.create`	`access:admin`	Creates a project. Access assigns the id.
`access.projects.update`	`access:admin`	Updates a project.
`access.envs.list`	`access:read`	Lists environments in a project.
`access.envs.create`	`access:admin`	Creates an environment. Access assigns the id.
`access.envs.update`	`access:admin`	Updates an environment.
`access.service_enablements.list`	`access:read`	Lists the service enablements of a project, one per service.
`access.service_enablements.update`	`access:admin`	Enables or disables a service on a project (`spec.enabled`).
`access.api_keys.list`	`access:read`	Lists API keys in an environment, or the org-wide keys of an org.
`access.api_keys.create`	`access:keys:write`	Creates an API key. Access assigns the id.
`access.api_keys.update`	`access:keys:write`	Updates an API key.
`agents.agents.capture_credential`	`agents:sessions`	Captures an existing grant for one session and purpose; never issues a key.
`agents.agents.rotate_credential`	`agents:sessions`	Rotates the captured value under the same handle with generation fencing.
`agents.agents.revoke_credential`	`agents:sessions`	Revokes one captured handle. Repeating the revocation is harmless.
`agents.agents.list`	`agents:read`	Lists agents.
`agents.agents.create`	`agents:write`	Creates an agent and its version 1.
`agents.agents.update`	`agents:write`	Updates an agent. A change to `spec` mints the next AgentVersion; sessions already started keep the version they pinned.
`agents.agents.run`	`agents:sessions`	Atomically admits a pinned task session, initial event and pending turn.
`agents.agent_versions.list`	`agents:read`	Lists an agent's versions, newest first.
`agents.agent_sessions.invoke_tool`	`agents:sessions`	Guest execution capability authentication, not an Access management key. Preserve any JSON tool result, including scalars and arrays.
`agents.agent_sessions.tool_catalog`	`agents:sessions`	The immutable pinned HTTP-tool catalog exposed to the guest's MCP bridge.
`agents.agent_sessions.create`	`agents:sessions`	Starts a session of an agent, pinned to its current version unless `agent_version` names another. Requires a secret key until end-user ownership is implemented. The session starts idle; `:send` starts its first turn.
`agents.agent_sessions.list`	`agents:sessions`	Lists sessions, newest first. With a publishable key, only the caller's end user's sessions.
`agents.agent_sessions.archive`	`agents:sessions`	Archives a session: the session and its event log stay readable, but no new turn may start and the session's captured credential handles are revoked. An idle or failed session archives at once; a running turn is refused with `INVALID_STATE` (interrupt it first). Repeating the call with the same `Idempotency-Key` returns the same session.
`agents.agent_sessions.send`	`agents:sessions`	Sends a user message. On an idle or failed session it starts a new turn; while a turn runs it is refused with `INVALID_STATE` (use `:steer`). The same `Idempotency-Key` returns the same event.
`agents.agent_sessions.steer`	`agents:sessions`	Sends a message into the running turn; the agent reads it at its next step. On an idle session it is the same as `:send`.
`agents.agent_sessions.interrupt`	`agents:sessions`	Stops the running turn at its current step. Calls already made keep their results; the session becomes idle. A no-op on an idle session.
`agents.agent_sessions.decide_approval`	`agents:sessions`	Answers a tool call waiting for approval; the turn continues.
`agents.agent_sessions.submit_tool_result`	`agents:sessions`	Returns the result of a client tool call; the turn continues.
`agents.session_events.list`	`agents:sessions`	Lists a session's events in sequence order. To follow a session, call again with the filter `sequence > N`, N the last sequence read; `wait` holds the call open until a newer event is appended or the wait ends.
`agents.memory_stores.list`	`agents:read`	Lists memory stores.
`agents.memory_stores.create`	`agents:write`	Creates a memory store.
`agents.memory_stores.update`	`agents:write`	Updates a memory store.
`agents.memories.list`	`agents:sessions`	Lists a store's memories, newest first. With a publishable key, only the caller's end user's memories.
`agents.memories.create`	`agents:write`	Writes a memory.
`agents.memories.update`	`agents:write`	Changes a memory's content.
`agents.memories.search`	`agents:sessions`	Recalls the memories that best match a query, by hybrid full-text and vector search. With a publishable key, only the caller's end user's memories. A read with a request body, like a query.
`agents.owner_pools.list`	`agents:read`	Lists owner pools, newest first.
`agents.owner_pools.create`	`agents:admin`	Creates an owner pool with no members. Its minimums and demotion rules are governance, so the caller needs `agents:admin`.
`agents.owner_pools.update`	`agents:admin`	Replaces an owner pool's spec (`agents:admin`). Members keep their standing; a changed suite or minimum applies from the next `:qualify`.
`agents.owner_pools.qualify`	`agents:qualify`	Records an admission suite result for an Agent version. The caller holds `agents:qualify` and is not the principal whose create or update minted the version (`PERMISSION_DENIED`). Every minimum met: the member is `QUALIFIED`. Any score missing or below its minimum: the member is recorded `REFUSED` with the reason. Each qualification is recorded with its suite, suite version, result and caller; a `result` already recorded for the member is refused with `INVALID_FIELD`, so a demoted member returns only with a new suite result. A read-only version is refused with `PERMISSION_DENIED`; a suite or suite version other than the pool's with `INVALID_FIELD`. Re-qualifying keeps the member's baseline: the baseline belongs to the version and its pinned model.
`agents.owner_pools.observe`	`agents:qualify`	Records a live-metric observation for a member and applies the pool's demotion rules (`agents:qualify`, refused to the version's authors as in `:qualify`). The platform computes each rule's baseline: the median of the member's first `baseline_observations` counted observations of the metric, set only when it is finite and positive. Values of a rule metric are lower-is-better and must not be negative. Once the baseline is set, a metric past `baseline * (1 + max_regression)` demotes a qualified member. Only `:qualify` brings a demoted member back.
`ai.ai_models.list`	`ai:read`	Lists the admitted catalog; filter by `brand`, `modality`, or `model`.
`artifacts.artifacts.list`	`artifacts:read`	Lists a project's artifacts; filter by `digest`, `kind`, or `subject`.
`artifacts.artifacts.create`	`artifacts:write`	Registers an artifact whose bytes were pushed by digest; verification runs after.
`artifacts.artifacts.prepare_upload`	`artifacts:write`	Mints one short-lived registry credential and the unique image reference for an upload of this project. The repository is derived from the caller's grant and this parent, never from the caller; the tag is unique per call, so uploads of the same project never collide. Push to the reference, then register the pushed digest with CreateArtifact.
`assets.assets.list`	`assets:read`	Lists assets. The filter is limited to `kind`, `state`, and `review_state`.
`assets.assets.export`	`assets:read`	Exports every servable variant in the environment as one flat, paged manifest, independent of the keys the code declares. Rejected and retired variants are left out unless `filter` asks for their `review_state`. The last page carries a digest a client checks to know it holds the whole set.
`assets.assets.generate`	`assets:write`	Records the recipes as assets and generates the variants that are missing. Each call is idempotent and works within a bounded time; call again until `pending` is 0.
`assets.assets.lock`	`assets:read`	Returns the `assets.lock` entries and canonical text for the keys the call names, and only those. A read with a request body, like a query.
`assets.assets.approve_variant`	`assets:write`	Approves one variant and records who approved it.
`assets.assets.reject_variant`	`assets:write`	Rejects one variant. Its slot is freed and the next `:generate` fills it; the rejected file keeps serving at its URL.
`assets.assets.retire_variant`	`assets:write`	Retires one variant. Its URL answers 404 from then on and its slot is freed.
`auth.auth_configs.update`	`auth:write`	Updates an auth config.
`auth.end_users.list`	`auth:read`	Lists end users.
`auth.end_users.create`	`auth:write`	Creates an end user.
`auth.end_users.update`	`auth:write`	Updates an end user.
`auth.end_users.suspend`	`auth:write`	Suspends an end user: sessions are revoked and sign-in is refused.
`auth.end_users.reactivate`	`auth:write`	Reactivates a suspended end user.
`auth.end_users.unlock`	`auth:write`	Clears an end user's sign-in lock (repeated failed sign-ins) now.
`auth.end_users.revoke_sessions`	`auth:write`	Revokes every session of an end user.
`auth.end_users.attach_external_id`	`auth:write`	Sets the customer's own id for an end user, once: an unset namespace is written, a set one is never rewritten, and a different value for a set namespace is refused. A namespace holds one id for the life of the user. Erasure removes the ids and remembers their hashes, so a value that belonged to an erased user is never handed to another one.
`auth.end_users.find`	`auth:read`	Finds the one end user of one of the customer's own ids. An id that belongs to no live user of this environment is `RESOURCE_NOT_FOUND`, the same answer a value erased with its user gives.
`auth.sessions.list`	`auth:read`	Lists sessions.
`auth.sessions.revoke`	`auth:write`	Revokes a session.
`auth.identities.list`	`auth:read`	Lists the identities an end user signs in with.
`auth.identities.move`	`auth:write`	Moves a federated or device identity from one end user to another, to fix a wrongly linked player. One transaction: the identity changes owner, the sessions of both end users are revoked, and nothing else about either moves (profile, memberships, data). Refused when it would leave the source with no sign-in, unless the source is suspended, and when the target already has an identity of the same provider. The reason is audited with the operator, both end users and the identity's fingerprint. An operator action: an end user's own session cannot call it.
`auth.customer_organizations.list`	`auth:read`	Lists customer organizations.
`auth.customer_organizations.create`	`auth:write`	Creates a customer organization.
`auth.customer_organizations.update`	`auth:write`	Updates a customer organization.
`auth.memberships.list`	`auth:read`	Lists memberships.
`auth.memberships.create`	`auth:write`	Creates a membership.
`auth.memberships.update`	`auth:write`	Updates a membership.
`auth.organization_roles.list`	`auth:read`	Lists organization roles.
`auth.organization_roles.create`	`auth:write`	Creates an organization role.
`auth.organization_roles.update`	`auth:write`	Updates an organization role.
`auth.invitations.list`	`auth:read`	Lists invitations.
`auth.invitations.create`	`auth:write`	Creates an invitation.
`auth.invitations.revoke`	`auth:write`	Revokes a pending invitation.
`auth.invitations.accept`	`auth:write`	Accepts a pending invitation for an end user whose verified email is the invited address, and creates the membership.
`auth.email_domains.list`	`auth:read`	Lists email domains.
`auth.email_domains.create`	`auth:write`	Creates an email domain; the answer names the TXT record to publish.
`auth.email_domains.verify`	`auth:write`	Looks up the domain's TXT record now; found, the domain is verified.
`auth.oauth_clients.list`	`auth:read`	Lists OAuth clients.
`auth.oauth_clients.create`	`auth:write`	Creates an OAuth client.
`auth.oauth_clients.update`	`auth:write`	Updates an OAuth client.
`auth.oauth_clients.roll_secret`	`auth:write`	Issues a new client secret, returned once; the old one verifies until `grace_period` ends.
`billing.meters.list`	`billing:read`	Lists meters. Anonymous-readable: the pricing page renders from it.
`billing.plans.list`	`billing:read`	Lists the plans the caller can see. Anonymous-readable: the pricing page renders from it.
`billing.billing_accounts.list`	`billing:read`	Lists an org's billing accounts: exactly one, `default`.
`billing.billing_accounts.update`	`billing:admin`	Updates a billing account: changes plan, spend limit, or billing email.
`billing.invoices.record_payment`	`billing:payments:record`	A seller operator records an externally verified full invoice payment. The platform-only scope cannot be granted by customer owners/admins. The invoice name identifies the customer, not the seller. References are immutable and idempotent per org and method; conflicting reuse is refused.
`billing.invoices.list`	`billing:read`	Lists an org's invoices.
`billing.usage_reports.list`	`billing:read`	Lists an org's usage reports, one per billing period.
`billing.usage_reports.query`	`billing:read`	Queries usage over any time range, bucketed and grouped: the usage summary the console charts. Reads rollups; never raw events.
`billing.budget_leases.list`	`billing:read`	Lists an org's budget leases.
`broker.trust_policies.list`	`broker:read`	Lists an org's trust policies.
`broker.trust_policies.create`	`broker:admin`	Creates a trust policy.
`broker.trust_policies.update`	`broker:admin`	Updates a trust policy.
`broker.trust_policies.exchange_token`	`broker:exchange`	Exchanges the caller's Access grant for a short-lived provider credential under a trust policy (RFC 8693 token exchange): a GitHub App installation token for exactly one of the policy's repositories, narrowed to the requested permissions. The grant's principal (for a delegated grant, its accountable principal) must be a policy subject, its actor must match the policy's actors, and it must hold `broker:exchange` on this policy. Every call writes one TokenExchange record. A permission the Connection lacks is PERMISSION_DENIED with reason `CapabilityMissing`, never an outage.
`broker.token_exchanges.list`	`broker:read`	Lists the credentials issued under a trust policy, newest first.
`build.builds.list`	`build:read`	Lists builds in a project.
`build.builds.create`	`build:run`	Creates a build: one command or one image over a commit or a tree. The Operation is done when the build reaches a final state. `run` and `image` are the short forms.
`build.builds.run`	`build:run`	Runs one command over an uploaded tree and settles with its exit code, like the local command. A caller that gets a failure before the command started (BUILD_FAILURE_SETUP_FAILED, NO_CAPACITY) may build locally.
`build.builds.build_image`	`build:run`	Builds an image, with an SBOM and signed provenance, from a commit or an uploaded tree.
`build.build_caches.list`	`build:read`	Lists build caches in a project.
`build.build_caches.update`	`build:write`	Updates a build cache.
`build.build_caches.mint_env`	`build:run`	Mints the settings a build that runs elsewhere (a laptop, a CI runner) uses to reach the cache: the sccache, Turbo and crates mirror doors and a short-lived token, as environment variables.
`config.config_flags.list`	`config:read`	Lists config flags in an environment.
`config.config_flags.create`	`config:write`	Creates a config flag; the Operation is done when every cell serves it.
`config.config_flags.update`	`config:write`	Updates a config flag; the change rolls out in waves and the Operation is done when every cell serves it.
`config.config_flags.evaluate`	`config:evaluate`	Evaluates config flags of an environment for one evaluation context: each flag's value, and why. Browsers and mobile apps call it with a publishable key holding `config:evaluate`, which reads values, never rules.
`config.config_segments.list`	`config:read`	Lists config segments in an environment.
`config.config_segments.create`	`config:write`	Creates a config segment.
`config.config_segments.update`	`config:write`	Updates a config segment; every flag naming it follows.
`config.config_changes.list`	`config:read`	Lists config changes in an environment.
`connections.connection_providers.begin_registration`	`connections:admin`	Begins an expiring, one-use GitHub manifest registration ceremony. Open registration_url to POST the bound, prefilled manifest to GitHub. github_organization selects organization ownership. The state-authorized callback is GET /v1/connections/github-manifest:callback?state=...&code=... and returns only provider metadata and an installation URL.
`connections.connection_providers.list`	`connections:read`	Lists an org's connection providers.
`connections.connection_providers.update`	`connections:admin`	Updates a connection provider.
`connections.connections.list`	`connections:read`	Lists an org's connections.
`connections.connections.create`	`connections:write`	Records an installation; the controller confirms it with the provider.
`connections.connections.update`	`connections:write`	Updates a connection's metadata.
`data.objects.put`	`data:write`	Writes an object's bytes, replacing the current version. `body` is the base64 of the bytes.
`data.objects.list`	`data:read`	Lists a bucket's objects in key order.
`data.kv.put`	`data:write`	Writes a value. Without `ttl_seconds` the namespace default applies; zero means no expiry.
`data.kv.list`	`data:read`	Lists a namespace's values in key order.
`data.kv.increment`	`data:write`	Adds `delta` (default 1) to an integer value, creating it at zero.
`data.kv.get_many`	`data:read`	Reads up to 1000 keys at once (MGET). Answers one entry per key, in order; an absent or expired key keeps its key and has no `value`.
`data.kv.hash_set`	`data:write`	Sets fields of a hash (HSET), creating it.
`data.kv.hash_get`	`data:read`	Reads one field of a hash (HGET); an absent field has no `value`.
`data.kv.hash_get_all`	`data:read`	Reads every field of a hash (HGETALL).
`data.kv.hash_get_many`	`data:read`	Reads several fields of a hash (HMGET), one per field, in order; an absent field has no `value`.
`data.kv.list_push`	`data:write`	Pushes values onto the head of a list (LPUSH), creating it.
`data.kv.list_range`	`data:read`	Reads a range of a list (LRANGE); negative indexes count from the end.
`data.kv.list_pop`	`data:write`	Pops values from the head of a list (LPOP); an emptied list is removed.
`data.kv.list_length`	`data:read`	Reads the length of a list (LLEN); an absent key has length zero.
`data.kv.zset_add`	`data:write`	Adds members to a sorted set or updates their scores (ZADD), creating it.
`data.kv.zset_range`	`data:read`	Reads a range of a sorted set by rank, lowest score first (ZRANGE); negative indexes count from the end.
`data.kv.zset_score`	`data:read`	Reads a member's score (ZSCORE); an absent member has no `score`.
`data.kv.zset_length`	`data:read`	Reads the size of a sorted set (ZCARD); an absent key has size zero.
`data.kv.scan`	`data:read`	Walks a namespace's keys that match a glob (SCAN). Call again with the returned `cursor` until it is empty.
`data.kv.expire`	`data:write`	Sets a key's time to live (EXPIRE) without rewriting its value; zero makes it persistent.
`data.documents.put`	`data:write`	Writes a document to a search index, replacing the current version.
`data.documents.patch`	`data:write`	Changes some fields of a document and keeps the rest: a JSON merge patch (RFC 7396). The version goes up by one.
`data.search.query`	`data:read`	Searches an index by text, by vector, or both, best match first, with filters and paging.
`data.search.multi`	`data:read`	Runs several searches of one index in one request, 1 to 10, and answers each in request order.
`data.databases.list`	`data:read`	Lists databases in a environment.
`data.databases.create`	`data:write`	Creates a database. The Operation is done when the controller settles it.
`data.databases.update`	`data:write`	Updates a database.
`data.kv_namespaces.list`	`data:read`	Lists kv namespaces in a environment.
`data.kv_namespaces.create`	`data:write`	Creates a kv namespace. The Operation is done when the controller settles it.
`data.kv_namespaces.update`	`data:write`	Updates a kv namespace.
`data.buckets.list`	`data:read`	Lists buckets in a environment.
`data.buckets.create`	`data:write`	Creates a bucket. The Operation is done when the controller settles it.
`data.buckets.update`	`data:write`	Updates a bucket.
`data.search_indexes.list`	`data:read`	Lists search indexs in a environment.
`data.search_indexes.create`	`data:write`	Creates a search index. The Operation is done when the controller settles it.
`data.search_indexes.update`	`data:write`	Updates a search index.
`entitlement.entitlements.list`	`entitlement:read`	Lists an org's entitlements: exactly one, `default`.
`events.topics.list`	`events:read`	Lists topics.
`events.topics.create`	`events:write`	Creates a topic.
`events.topics.update`	`events:write`	Updates a topic.
`events.topics.publish`	`events:publish`	Publishes CloudEvents into a Topic, atomically. Replaying the same `source` + `id` with the same payload returns the stored event; a different payload fails with RESOURCE_ALREADY_EXISTS.
`events.events.list`	`events:read`	Lists events.
`events.connectors.list`	`events:read`	Lists connectors.
`events.subscriptions.list`	`events:read`	Lists subscriptions.
`events.subscriptions.create`	`events:write`	Creates a subscription.
`events.subscriptions.update`	`events:write`	Updates a subscription.
`events.queues.list`	`events:read`	Lists queues.
`events.queues.create`	`events:write`	Creates a queue.
`events.queues.update`	`events:write`	Updates a queue.
`events.queues.send`	`events:publish`	Enqueues messages directly, without a Subscription.
`events.queues.lease`	`events:write`	Leases up to `max_messages` ready messages for the visibility timeout.
`events.queues.ack`	`events:write`	Acknowledges leased messages; each is removed. A lease that is stale (expired or superseded) is reported, not applied.
`events.queues.nack`	`events:write`	Returns leased messages to the Queue after `delay`; each nack counts as a delivery.
`events.queues.replay`	`events:write`	Moves dead-lettered messages, optionally bounded by dead-letter time, back to ready.
`events.webhook_endpoints.list`	`events:read`	Lists webhook endpoints.
`events.webhook_endpoints.create`	`events:write`	Creates a webhook endpoint.
`events.webhook_endpoints.update`	`events:write`	Updates a webhook endpoint.
`events.webhook_endpoints.replay`	`events:write`	Redelivers every dead-lettered delivery to the endpoint created in a time range, each as a new attempt.
`events.webhook_deliveries.list`	`events:read`	Lists webhook deliveries.
`events.webhook_deliveries.replay`	`events:write`	Redelivers one delivery now, as a new attempt.
`events.inbound_endpoints.list`	`events:read`	Lists inbound endpoints.
`events.inbound_endpoints.create`	`events:write`	Creates an inbound endpoint.
`events.inbound_endpoints.update`	`events:write`	Updates an inbound endpoint.
`events.realtime_channels.list`	`events:read`	Lists realtime channels.
`events.realtime_channels.create`	`events:write`	Creates a realtime channel.
`events.realtime_channels.update`	`events:write`	Updates a realtime channel.
`events.realtime_channels.publish`	`events:publish`	Publishes one message to the channel: it is appended to the channel's history and pushed to every connected client. A retry with the same Idempotency-Key returns the first message.
`events.realtime_channels.issue_token`	`events:publish`	Mints a subscribe token (`rtt_…`) for this channel alone, at most an hour long, for a browser or device that holds no key. A token that names a client id enters the channel's presence while it is connected.
`events.realtime_messages.list`	`events:read`	Lists a channel's retained messages, oldest first.
`events.realtime_members.list`	`events:read`	Lists the clients present in a channel now.
`hosting.services.list`	`hosting:read`	Lists services in a environment.
`hosting.services.create`	`hosting:write`	Creates a service. The Operation is done when the controller settles it.
`hosting.services.update`	`hosting:write`	Updates a service.
`hosting.service_rollouts.list`	`hosting:read`	Lists rollouts in a service.
`hosting.service_rollouts.create`	`hosting:write`	Creates a rollout.
`hosting.previews.list`	`hosting:read`	Lists previews in a environment.
`hosting.previews.create`	`hosting:write`	Creates a preview. The Operation is done when the controller settles it.
`hosting.source_links.list`	`hosting:read`	Lists source links in a project.
`hosting.source_links.create`	`hosting:write`	Creates a source link. The Operation is done when the controller settles it.
`hosting.source_links.update`	`hosting:write`	Updates a source link.
`keys.keys.list`	`keys:read`	Lists keys in an environment.
`keys.keys.create`	`keys:write`	Creates a key; the signer generates its first version.
`keys.keys.update`	`keys:write`	Updates a key's rotation period, deletion protection, or metadata.
`keys.keys.sign`	`keys:sign`	Signs data or a digest with a SIGN key. Every use is audited.
`keys.keys.verify`	`keys:verify`	Verifies a signature made by a SIGN key.
`keys.keys.encrypt`	`keys:encrypt`	Encrypts data with an ENCRYPT key.
`keys.keys.decrypt`	`keys:decrypt`	Decrypts a ciphertext made by Encrypt with this key.
`keys.keys.mac_sign`	`keys:sign`	Computes a MAC of data with a MAC key.
`keys.keys.mac_verify`	`keys:verify`	Verifies a MAC made by a MAC key, in constant time.
`keys.key_versions.list`	`keys:read`	Lists a key's versions.
`knowledge.spaces.list`	`knowledge:read`	Lists spaces.
`knowledge.spaces.create`	`knowledge:write`	Creates a space.
`knowledge.spaces.update`	`knowledge:write`	Updates a space.
`knowledge.knowledge_schemas.list`	`knowledge:read`	Lists knowledge schemas.
`knowledge.knowledge_schemas.create`	`knowledge:write`	Creates a knowledge schema.
`knowledge.knowledge_schemas.update`	`knowledge:write`	Updates a knowledge schema. An accepted update publishes a new revision; a change that would invalidate existing records is refused with `INVALID_FIELD`.
`knowledge.episodes.list`	`knowledge:read`	Lists a space's episodes, newest first. The filter is limited to `kind` and `extraction`.
`knowledge.episodes.create`	`knowledge:write`	Records an episode and returns at once (`remember`); extraction reads it afterwards.
`knowledge.entities.list`	`knowledge:read`	Lists the entities the caller may see. The filter is limited to `entity_type` and `lifecycle`.
`knowledge.entities.create`	`knowledge:write`	Creates an entity in a space. An entity whose external id already names one in the graph is refused with `RESOURCE_ALREADY_EXISTS`, which names it; use Update with `allow_missing` to upsert.
`knowledge.entities.update`	`knowledge:write`	Updates an entity. With `allow_missing` it is the structured upsert (`upsert_entity`): an entity matched by `external_ids` is updated, otherwise one is created.
`knowledge.entities.merge`	`knowledge:write`	Merges other entities into this one: their facts and external ids resolve to it. The merge is recorded and reversible with `:split`; it is never a silent rewrite.
`knowledge.entities.split`	`knowledge:write`	Splits a merged entity back out of this one, with the facts and external ids it brought.
`knowledge.entities.profile`	`knowledge:read`	Returns one entity's profile in one call (`entity`): the entity, its current facts in both directions, the entities they name and the recent episodes about it, trimmed to what the caller may see. A read with a request body.
`knowledge.entities.recall`	`knowledge:read`	Searches the graph (`recall`): hybrid lexical and semantic search over episodes and facts, fused by reciprocal rank, then at most two hops of expansion from the top entities. Returns a context pack with citations, built only from records the caller may see.
`knowledge.entities.ask`	`knowledge:read`	Answers a question through Sylphx AI (`ask`), from a context pack built only from records the caller may see, with citations to its episodes.
`knowledge.relations.list`	`knowledge:read`	Lists a space's facts. The filter is limited to `subject`, `predicate`, `object` and `provenance.channel`; superseded facts are listed only with `show_superseded`.
`knowledge.relations.create`	`knowledge:write`	Records a fact in a space (`relate`). A fact that contradicts a current one with the same subject and a single-valued predicate closes the older fact; nothing is overwritten.
`knowledge.relations.close`	`knowledge:write`	Closes a fact (`close_fact`): it stopped holding in the world at `valid_end_time`. The fact stays readable for questions about the time before the close.
`localization.catalogs.list`	`localization:read`	Lists catalogs.
`localization.catalogs.create`	`localization:write`	Creates a catalog.
`localization.catalogs.update`	`localization:write`	Updates a catalog.
`localization.catalogs.sync`	`localization:write`	Reads the source files and the committed translations into the catalog, then translates what is new or stale. Each call is idempotent and works within a bounded time; call again until `pending` is 0.
`localization.catalogs.export`	`localization:read`	Returns the catalog's files per locale in the requested format, with the QA report. A read with a request body, like a query.
`localization.entries.list`	`localization:read`	Lists catalog entries. The filter is limited to `state`, `locale`, and `qa_state`.
`localization.entries.pin_translation`	`localization:write`	Sets the text of one locale as a human override that AI never overwrites. QA runs on the text first; a text with a QA error is rejected with `INVALID_FIELD`, and the problem lists the findings.
`localization.entries.unpin_translation`	`localization:write`	Removes the human override of one locale; the next sync may translate it again.
`localization.glossaries.list`	`localization:read`	Lists glossarys.
`localization.glossaries.create`	`localization:write`	Creates a glossary.
`localization.glossaries.update`	`localization:write`	Updates a glossary.
`money.price_catalogs.update`	`billing:write`	Updates the environment's catalog: its features and products, whole.
`money.checkout_policies.update`	`billing:write`	Updates the environment's checkout policy, whole.
`money.store_connections.list`	`billing:read`	Lists store connections.
`money.store_connections.create`	`billing:write`	Creates a store connection; its credential is sealed and never returned.
`money.store_connections.update`	`billing:write`	Updates a store connection; a new credential replaces the stored one.
`money.store_purchases.verify`	`billing:write`	Verifies a store purchase with the store, binds it to the subject, and returns its record and a signed grant. Re-verifying returns the same record and grant. Called from the app's server with a secret key that holds `billing:write`; a publishable key cannot call it.
`money.store_purchases.client_verify`	`billing:client`	Verifies a store purchase for an app with no server: called with the environment's publishable key (`billing:client`), the subject is an install id (`inst_` and a UUID), and Money completes the purchase with the store (acknowledges or consumes it) so the app never calls the store's server API. Works only on store connections that set `client_verify`. Re-calling returns the same record and grant.
`money.store_purchases.list`	`billing:read`	Lists store purchases, newest first.
`money.customer_subscriptions.list`	`billing:read`	Lists customer subscriptions, newest first.
`money.customer_subscriptions.update_quantity`	`billing:write`	Changes the seat quantity of a web subscription, now, and syncs the processor's subscription item to it. A retry with the same `Idempotency-Key` (required) and the same request changes nothing twice.
`money.customer_subscriptions.change_plan`	`billing:write`	Move a web subscription onto another recurring catalog plan.
`money.entitlement_grants.list`	`billing:read`	Lists entitlement grants.
`money.entitlement_grants.check`	`billing:read`	Answers whether a subject holds a feature now, and how much of it.
`money.entitlement_grants.create`	`billing:credits.approve`	Creates a manual entitlement grant (support, comp, grace). Append-only; needs the approval-class scope. The approver recorded is the key's principal.
`money.merchant_accounts.list`	`billing:read`	Lists merchant accounts.
`money.merchant_accounts.connect`	`billing:write`	Starts connecting a Stripe account: returns the processor's authorisation URL for an org owner to open, which the processor's redirect completes. With a restricted key in the request the account connects at once instead, and the connected merchant account comes back in the response.
`money.merchant_accounts.update`	`billing:write`	Updates the merchant account's own settings: the fields named in `update_mask`.
`money.checkout_sessions.create`	`billing:write`	Creates a hosted checkout for a subject.
`money.tax_threshold_statuses.list`	`billing:read`	Lists where the environment's consumer sales stand against each jurisdiction's digital-services tax registration threshold, per its own window. EU and UK have no threshold and are not tracked.
`money.portal_sessions.create`	`billing:write`	Creates a customer portal session for a subject.
`money.licence_keys.generate`	`billing:licence_keys.approve`	Generates a licence key: Money creates the Ed25519 key, seals it, and never returns the private half. Needs the approval-class scope, which the developer role does not hold.
`money.licence_keys.import`	`billing:licence_keys.approve`	Imports an existing Ed25519 key (PKCS8), for a key already pinned in shipped clients. Refused unless the expected public key is the imported key's public half.
`money.licence_tokens.list`	`billing:read`	Lists a subject's unexpired offline licence tokens of paid orders, for support. Re-derived from the frozen terms: the same bytes as at purchase.
`money.usage_settings.update`	`billing:write`	Updates the usage settings, the enforcement switch included. A change is recorded with who made it.
`money.usage_tiers.list`	`billing:read`	Lists usage tiers.
`money.usage_tiers.update`	`billing:write`	Creates or updates a usage tier.
`money.usage_reservations.create`	`billing:metering:write`	Reserves usage before the work starts. Refused with PLAN_LIMIT_REACHED (spend limit, no payment method) or INVALID_STATE (suspended) only while enforcement is on; while it is dark the reservation is granted and the refusal is recorded.
`money.usage_reservations.settle`	`billing:metering:write`	Settles a reservation with what was used; the unused part returns to headroom. A settle after expiry still records the usage.
`money.usage_events.create`	`billing:metering:write`	Records usage directly, only for a meter the merchant marked reservation-optional.
`money.usage_events.batch_ingest`	`billing:metering:ingest`	Records a batch of already-incurred usage from the merchant's own servers (Stripe's meter-event model): the caller is a key of the merchant's own org holding the exact grant `billing:metering:ingest`, which no wildcard covers, and each event names its subject with no subject proof. Each event is keyed by its project, meter, meter version and event id: a replay is a no-op (`duplicate`), and the same key with different content is a `conflict` and never counted. One result per event, in request order.
`money.usage_events.list`	`billing:read`	Lists usage events, newest first.
`money.usage_events.check_standing`	`billing:read`	Reads a subject's standing: active, past due or suspended, whether a payment method is on file, headroom and the threshold.
`money.credit_grants.create`	`billing:credits.approve`	Gives a subject credit. Append-only: a change is a new grant that supersedes the old. Refused with INVALID_STATE (`tax_treatment_unsupported`) for `post_tax_settlement` while the merchant has automatic tax on.
`money.credit_grants.list`	`billing:read`	Lists credit grants.
`money.usage_invoices.list`	`billing:read`	Lists usage invoices, newest first.
`money.usage_invoices.release_collection`	`billing:credits.approve`	Releases a held invoice for collection, audited with who and why. Grant expiry or replacement never does.
`money.usage_meters.list`	`billing:read`	Lists usage meters.
`money.usage_meters.update`	`billing:write`	Creates or updates a usage meter. The unit cannot change once it has recorded usage.
`money.usage_meter_prices.create`	`billing:write`	Appends a price to a meter's history. It applies from its effective time on and never rewrites usage already rated.
`money.usage_meter_prices.list`	`billing:read`	Lists meter prices, newest first; filter by `meter`.
`money.revenue_sources.list`	`revenue:read`	Lists the org's revenue sources, with their freshness.
`money.revenue_sources.create`	`revenue:write`	Registers a revenue source. The `money` source is implicit and never created here.
`money.revenue_sources.update`	`revenue:write`	Renames, pauses or resumes a revenue source, or changes its settings.
`money.revenue_sources.run`	`revenue:write`	Syncs a revenue source now, or backfills a period. A `money` source fills any booked fact its environment's ledger holds and the facts lack; a paused source, or one whose connector has not shipped yet, is refused (`INVALID_STATE`).
`money.revenue.get`	`revenue:read`	Gets the org's revenue over a period: totals by day or month, split by source or product, gross or net, in one reporting currency, with the basis of each bucket, the sources that report late, and what has no rate yet. Reads only the daily roll-up, bounded by a 5 second statement timeout. For example `sylphx money revenue summary --period mtd --split source`.
`money.revenue_facts.list`	`revenue:read`	Lists the org's revenue facts, newest day first, for audit and export.
`money.exchange_rates.list`	`revenue:read`	Lists the exchange rates Money converts at (units per US dollar by day), for any reader that converts revenue.
`network.domains.list`	`network:read`	Lists domains in a project.
`network.domains.create`	`network:write`	Creates a domain. The Operation is done when the controller settles it.
`network.domains.update`	`network:write`	Updates a domain.
`network.certificates.list`	`network:read`	Lists certificates in a project.
`network.routes.list`	`network:read`	Lists routes in a environment.
`network.routes.create`	`network:write`	Creates a route. The Operation is done when the controller settles it.
`network.routes.update`	`network:write`	Updates a route.
`network.egress_identities.list`	`network:read`	Lists egress identitys in a project.
`network.egress_identities.create`	`network:write`	Creates an egress identity. The Operation is done when the controller settles it.
`network.egress_identities.update`	`network:write`	Updates an egress identity.
`network.private_links.list`	`network:read`	Lists private links in a environment.
`network.private_links.create`	`network:write`	Creates a private link. The Operation is done when the controller settles it.
`network.private_links.update`	`network:write`	Updates a private link.
`notify.mail_domains.list`	`notify:read`	Lists email domains.
`notify.mail_domains.create`	`notify:write`	Creates an email domain.
`notify.mail_domains.update`	`notify:write`	Updates an email domain.
`notify.mail_routes.list`	`notify:read`	Lists an email domain's routes.
`notify.mail_routes.create`	`notify:write`	Creates a route.
`notify.mail_routes.update`	`notify:write`	Updates a route.
`notify.senders.list`	`notify:read`	Lists senders.
`notify.senders.create`	`notify:write`	Creates a sender.
`notify.senders.update`	`notify:write`	Updates a sender.
`notify.recipients.list`	`notify:read`	Lists recipients.
`notify.recipients.create`	`notify:write`	Creates a recipient.
`notify.recipients.update`	`notify:write`	Updates a recipient.
`notify.preferences.list`	`notify:read`	Lists preferences.
`notify.preferences.update`	`notify:write`	Updates a preference.
`notify.suppressions.list`	`notify:read`	Lists suppressions.
`notify.suppressions.create`	`notify:write`	Creates a suppression.
`notify.templates.list`	`notify:read`	Lists templates.
`notify.templates.create`	`notify:write`	Creates a template.
`notify.templates.update`	`notify:write`	Updates a template.
`notify.messages.list`	`notify:read`	Lists messages.
`notify.messages.create`	`notify:send`	Sends a Message.
`notify.messages.cancel`	`notify:send`	Cancels a Message whose deliveries have not been handed off.
`notify.mailboxes.list`	`notify:read`	Lists mailboxes.
`notify.mailboxes.create`	`notify:write`	Creates a mailbox.
`notify.mailboxes.update`	`notify:write`	Updates a mailbox.
`notify.mailboxes.erase_address`	`notify:write`	Removes an address's personal data from every inbound email of the mailbox that it sent or that names it, keeping the dedupe keys so a poll never brings the mail back.
`notify.mailbox_oauth_apps.list`	`notify:read`	Lists mailbox OAuth apps.
`notify.mailbox_oauth_apps.create`	`notify:write`	Creates a mailbox OAuth app.
`notify.mailbox_oauth_apps.update`	`notify:write`	Updates a mailbox OAuth app.
`notify.mailbox_connect_links.list`	`notify:read`	Lists mailbox connect links.
`notify.mailbox_connect_links.create`	`notify:write`	Mints a mailbox connect link for one end user; the response carries its `url`, which no later call returns.
`notify.inbound_emails.list`	`notify:read`	Lists a mailbox's inbound email in feed order, oldest first.
`notify.inbox_items.list`	`notify:read`	Lists inbox items.
`notify.inbox_items.mark_read`	`notify:write`	Marks an inbox item read.
`notify.inbox_items.mark_unread`	`notify:write`	Marks an inbox item unread.
`notify.inbox_items.archive`	`notify:write`	Archives an inbox item.
`notify.broadcasts.list`	`notify:read`	Lists broadcasts.
`notify.broadcasts.create`	`notify:write`	Creates a broadcast.
`notify.broadcasts.update`	`notify:write`	Updates a broadcast.
`notify.broadcasts.send`	`notify:send`	Sends a Broadcast now.
`notify.broadcasts.cancel`	`notify:send`	Cancels a Broadcast; messages already admitted still deliver.
`observability.log_entries.write`	`observability:ingest`	Ingests a batch of log entries atomically. The same `Idempotency-Key` and digest replays the same batch; a different digest under the key conflicts.
`observability.log_entries.query`	`observability:read`	Queries the environment's log entries over a bounded interval; follow a trace with `trace_id = "..."`.
`observability.traces.write_spans`	`observability:ingest`	Ingests a batch of spans atomically; a span's parent and time invariants are validated. Replay rules are those of WriteLogEntries.
`observability.traces.query`	`observability:read`	Queries the environment's traces over a bounded interval, returning summaries without spans.
`observability.generations.list`	`observability:read`	Lists the environment's Sylphx AI calls, newest first, within the trace retention; filter by `request_model`, `outcome`, `api_key`, `start_time`, `tags.<key>` and the other filterable fields.
`observability.error_groups.list`	`observability:read`	Lists error groups; filter by `state`, `service_name`, and `last_seen_time`.
`observability.error_groups.capture`	`observability:ingest`	Captures one error occurrence. It is grouped by `fingerprint` when the caller sets one, else by exception type and the symbolicated in-app stack; release is never part of the group. A new occurrence reopens a resolved group. Secrets and personal data are scrubbed by the environment's Scrubbing Policy before storage. A fingerprint-equal replay bills no second new-error unit. Under quota pressure the response says what to sample. Browsers call it with a publishable key that holds `observability:ingest` (CORS allowed, rate-limited per environment).
`observability.error_groups.acknowledge`	`observability:write`	Acknowledges an error group.
`observability.error_groups.resolve`	`observability:write`	Resolves an error group; a new occurrence reopens it.
`observability.error_groups.reopen`	`observability:write`	Reopens a resolved or acknowledged error group.
`observability.error_events.list`	`observability:read`	Lists error events.
`observability.source_maps.create`	`observability:write`	Uploads a source map for one release and minified file. Uploading the same release and file again replaces it.
`observability.source_maps.list`	`observability:read`	Lists source maps, newest first; filter by `release`.
`observability.scrubbing_policies.update`	`observability:write`	Updates the environment's scrubbing policy.
`realtime.namespaces.put`	`realtime:write`	Creates or replaces a namespace's rules. Existing channels follow the new rules from their next message; shortening history trims at the next publish.
`realtime.namespaces.list`	`realtime:read`	Lists the environment's namespaces.
`realtime.channels.publish`	`realtime:publish`	Publishes a message to a channel. The namespace must exist. The server publishes regardless of `client_publish`. A repeated Sylphx-Effect-Id publishes once.
`realtime.channels.history`	`realtime:read`	Lists a channel's messages after a cursor, oldest first. With `wait_seconds`, an empty result waits up to that long for the first new message and answers as soon as one arrives: this is how an agent subscribes.
`realtime.channels.presence`	`realtime:read`	Lists who is present on a channel.
`realtime.tokens.issue`	`realtime:token`	Mints a connection or channel token for an end user. The customer's server calls it with the secret key after authenticating the user, and hands the token to the client.
`realtime.bindings.create`	`realtime:write`	Binds a bus Subscription's matching events to a channel: each event the Subscription matches is published to the channel, with the event's CloudEvents `type` as the message event and its `data` as the payload. The Subscription itself is an Events Resource (`sylphx.events.v1`); this call only names the channel it feeds, and replaces the Subscription's earlier binding.
`release.releases.list`	`release:read`	Lists releases in an environment, newest first by default.
`release.releases.create`	`release:write`	Creates a release: admits it and rolls it out in waves. The Operation is done when the release is live or halted.
`release.rollouts.list`	`release:read`	Lists rollouts in an environment.
`runners.scale_sets.list`	`runners:read`	Lists scale sets in a org.
`runners.scale_sets.create`	`runners:write`	Creates a scale set. The Operation is done when the controller settles it.
`runners.scale_sets.update`	`runners:write`	Updates a scale set.
`runners.runners.list`	`runners:read`	Lists runners in a scale set.
`sandboxes.sandbox_shapes.list`	`sandboxes:read`	Lists shapes.
`sandboxes.pools.list`	`sandboxes:read`	Lists pools in a environment.
`sandboxes.pools.create`	`sandboxes:write`	Creates a pool. The Operation is done when the controller settles it.
`sandboxes.pools.update`	`sandboxes:write`	Updates a pool.
`sandboxes.leases.list`	`sandboxes:read`	Lists leases in a environment. Filter on `meta.labels` (for example `labels.agent = "a_123"`), `status.state`, and `spec.kind`.
`sandboxes.leases.create`	`sandboxes:write`	Creates a lease: granted now and returned READY (or GRANTED when `wait_ready` is false), or refused with a typed error. There is no queue.
`sandboxes.leases.set_network`	`sandboxes:write`	Replaces a running lease's outbound policy. The generation does not change; the new policy applies before the call returns.
`sandboxes.leases.act`	`sandboxes:exec`	Performs computer actions on a DESKTOP, BROWSER, or ANDROID lease, in order, and returns each action's result and, when `screenshot` is set, the screenshot taken after the last action. The actions are the Anthropic computer tool's and OpenAI computer use's, one-to-one. Refused CONTROL_HELD_BY_HUMAN while a human holds control.
`sandboxes.leases.acquire_control`	`sandboxes:exec`	Takes exclusive input control of a lease's display. A HUMAN acquire preempts an AGENT holder and returns a controller stream; an AGENT acquire is refused CONTROL_HELD_BY_HUMAN while a human holds control. Control lapses at `ttl`, which the platform caps at 30 minutes.
`sandboxes.lease_events.list`	`sandboxes:read`	Lists a lease's events in order. With `wait`, blocks up to that long for an event after `page_token` (long poll).
`sandboxes.volumes.list`	`sandboxes:read`	Lists volumes in a environment.
`sandboxes.volumes.create`	`sandboxes:write`	Creates a volume.
`sandboxes.volumes.update`	`sandboxes:write`	Updates a volume: grows `spec.size_gib` and edits metadata.
`sandboxes.snapshots.list`	`sandboxes:read`	Lists snapshots in a environment.
`sandboxes.snapshots.create`	`sandboxes:write`	Captures a running lease's disk as a snapshot.
`secrets.secrets.list`	`secrets:read`	Lists secrets in an environment.
`secrets.secrets.create`	`secrets:write`	Creates a secret, without a value; add one with CreateSecretVersion.
`secrets.secrets.update`	`secrets:write`	Updates a secret.
`secrets.secret_versions.list`	`secrets:read`	Lists a secret's versions.
`secrets.secret_versions.create`	`secrets:write`	Adds a value to a secret as its newest version. The value is never returned.
`secrets.secret_bindings.list`	`secrets:read`	Lists secret bindings in an environment.
`secrets.secret_bindings.create`	`secrets:write`	Creates a secret binding.
`secrets.secret_bindings.update`	`secrets:write`	Updates a secret binding.
`secrets.profiles.list`	`secrets:read`	Lists the profiles of an environment.
`secrets.profiles.create`	`secrets:write`	Creates an empty profile; its first version is written by a write-back mount (`:open` with WRITE_BACK, then `:commit`).
`secrets.profiles.update`	`secrets:write`	Updates a profile's grants or declared paths. Granting a mount is this call: nothing else adds a grant.
`secrets.profiles.open`	`secrets:mount`	Mounts a profile for one session: returns the state of one version and, for WRITE_BACK, an attachment that `:commit` writes through until it expires. Every call is audited with the caller's context; the caller's principal needs a grant of at least the requested mode.
`secrets.profiles.commit`	`secrets:mount`	Writes a mounted profile back as a new version, by compare-and-set on the version the attachment was opened at (or last committed). When another write landed first, nothing is lost: the result is still a new version, merged site by site with the newer write winning, and marked as a conflict.
`secrets.profile_versions.list`	`secrets:read`	Lists a profile's versions, newest first.
`workflows.workflows.list`	`workflows:read`	Lists workflows.
`workflows.workflows.create`	`workflows:write`	Creates a workflow.
`workflows.workflows.update`	`workflows:write`	Updates a workflow.
`workflows.schedules.list`	`workflows:read`	Lists schedules.
`workflows.schedules.create`	`workflows:write`	Creates a schedule.
`workflows.schedules.update`	`workflows:write`	Updates a schedule; with `allow_missing` it creates the schedule when it does not exist, so its short name `schedule` is an upsert by name.
`workflows.schedules.pause`	`workflows:write`	Pauses a Schedule: no fire starts a Run until it is resumed.
`workflows.schedules.resume`	`workflows:write`	Resumes a paused Schedule; missed fires follow `catchup_window`.
`workflows.runs.list`	`workflows:read`	Lists runs.
`workflows.runs.create`	`workflows:run`	Starts a Run of a Workflow, now or after `start_delay` or at `schedule_time`. `run_id` is the caller's key: the same key and intent return the same Run, a changed intent is refused. An end user's session may call it on a Workflow whose `callers` is `USERS` when the session holds the Workflow's `permission`.
`workflows.runs.start_batch`	`workflows:run`	Starts a batch: a parent Run that fans out one child Run per item, each with a stable index and count.
`workflows.runs.signal`	`workflows:run`	Sends a named signal to a running Run; a `wait` op for that name resumes with its payload. A signal to a closed Run fails with INVALID_STATE. An end user's session may call it on a Workflow whose `callers` is `USERS` when the session holds the Workflow's `permission`.
`workflows.runs.cancel`	`workflows:run`	Requests cancellation. Timers and waits stop; a running invocation is not interrupted: the handler receives one final invocation with `cancel: true`, and the Run ends `cancelled` when it answers. An end user's session may call it on a Workflow whose `callers` is `USERS` when the session holds the Workflow's `permission`.
`workflows.runs.read_history`	`workflows:read`	Reads a page of the Run's immutable history, projected to Sylphx events.
`workflows.jobs.list`	`workflows:read`	Lists jobs.
`workflows.jobs.create`	`workflows:write`	Creates a job.
`workflows.jobs.update`	`workflows:write`	Updates a job. Runs already started keep the generation they pinned.
`workflows.job_runs.create`	`workflows:run`	Starts a run of a Job now. The same `Idempotency-Key` returns the same run for 24h; a Schedule fire uses `{job}:{intended time}`. With concurrency `forbid`, a start while a run is active fails with INVALID_STATE.
`workflows.job_runs.list`	`workflows:read`	Lists a job's runs, newest first.
`workflows.distributed_jobs.list`	`workflows:read`	Lists distributed jobs.
`workflows.distributed_jobs.create`	`workflows:write`	Creates a distributed job.
`workflows.distributed_jobs.update`	`workflows:write`	Updates a distributed job. Runs already started keep the generation they pinned.
`workflows.distributed_runs.create`	`workflows:run`	Starts a run of a distributed job. The same `Idempotency-Key` returns the same run for 24h.
`workflows.distributed_runs.list`	`workflows:read`	Lists a distributed job's runs, newest first.
`workflows.distributed_runs.add_shards`	`workflows:run`	Appends shards to a run started with an open manifest; `close` ends the manifest, and the run ends once those shards are done.
`workflows.distributed_runs.read_shards`	`workflows:read`	Reads a page of the run's shards, in queue order.
`workflows.distributed_runs.read_workers`	`workflows:read`	Reads a page of the run's workers.

Was this page helpful?

Tell us what is missing, wrong, or unclear — this opens a real inbox.

Send feedback

Platform links