UNKNOWN_FIELD

The request has a field the schema does not know.

Checked 2026-09-28

The request has a field the schema does not know.

HTTP 400 · gRPC INVALID_ARGUMENT · the error body

#Returned by

Method	Scope	What it does
`access.orgs.create`	`access:admin`	Creates an org. Access assigns the id.
`access.orgs.update`	`access:admin`	Updates an org.
`access.projects.create`	`access:admin`	Creates a project. Access assigns the id.
`access.projects.update`	`access:admin`	Updates a project.
`access.envs.create`	`access:admin`	Creates an environment. Access assigns the id.
`access.envs.update`	`access:admin`	Updates an environment.
`access.service_enablements.update`	`access:admin`	Enables or disables a service on a project (`spec.enabled`).
`access.api_keys.create`	`access:keys:write`	Creates an API key. Access assigns the id.
`access.api_keys.update`	`access:keys:write`	Updates an API key.
`agents.agents.create`	`agents:write`	Creates an agent and its version 1.
`agents.agents.update`	`agents:write`	Updates an agent. A change to `spec` mints the next AgentVersion; sessions already started keep the version they pinned.
`agents.agent_sessions.create`	`agents:sessions`	Starts a session of an agent, pinned to its current version unless `agent_version` names another. Requires a secret key until end-user ownership is implemented. The session starts idle; `:send` starts its first turn.
`agents.memory_stores.create`	`agents:write`	Creates a memory store.
`agents.memory_stores.update`	`agents:write`	Updates a memory store.
`agents.memories.create`	`agents:write`	Writes a memory.
`agents.memories.update`	`agents:write`	Changes a memory's content.
`artifacts.artifacts.create`	`artifacts:write`	Registers an artifact whose bytes were pushed by digest; verification runs after.
`auth.auth_configs.update`	`auth:write`	Updates an auth config.
`auth.end_users.create`	`auth:write`	Creates an end user.
`auth.end_users.update`	`auth:write`	Updates an end user.
`auth.customer_organizations.create`	`auth:write`	Creates a customer organization.
`auth.customer_organizations.update`	`auth:write`	Updates a customer organization.
`auth.memberships.create`	`auth:write`	Creates a membership.
`auth.memberships.update`	`auth:write`	Updates a membership.
`auth.organization_roles.create`	`auth:write`	Creates an organization role.
`auth.organization_roles.update`	`auth:write`	Updates an organization role.
`auth.invitations.create`	`auth:write`	Creates an invitation.
`auth.email_domains.create`	`auth:write`	Creates an email domain; the answer names the TXT record to publish.
`auth.oauth_clients.create`	`auth:write`	Creates an OAuth client.
`auth.oauth_clients.update`	`auth:write`	Updates an OAuth client.
`billing.billing_accounts.update`	`billing:admin`	Updates a billing account: changes plan, spend limit, or billing email.
`broker.trust_policies.create`	`broker:admin`	Creates a trust policy.
`broker.trust_policies.update`	`broker:admin`	Updates a trust policy.
`build.builds.create`	`build:run`	Creates a build: one command or one image over a commit or a tree. The Operation is done when the build reaches a final state. `run` and `image` are the short forms.
`build.builds.run`	`build:run`	Runs one command over an uploaded tree and settles with its exit code, like the local command. A caller that gets a failure before the command started (BUILD_FAILURE_SETUP_FAILED, NO_CAPACITY) may build locally.
`build.builds.build_image`	`build:run`	Builds an image, with an SBOM and signed provenance, from a commit or an uploaded tree.
`build.build_caches.update`	`build:write`	Updates a build cache.
`config.config_flags.create`	`config:write`	Creates a config flag; the Operation is done when every cell serves it.
`config.config_flags.update`	`config:write`	Updates a config flag; the change rolls out in waves and the Operation is done when every cell serves it.
`config.config_segments.create`	`config:write`	Creates a config segment.
`config.config_segments.update`	`config:write`	Updates a config segment; every flag naming it follows.
`connections.connection_providers.create`	`connections:admin`	Creates a connection provider.
`connections.connection_providers.update`	`connections:admin`	Updates a connection provider.
`connections.connections.create`	`connections:write`	Records an installation; the controller confirms it with the provider.
`connections.connections.update`	`connections:write`	Updates a connection's metadata.
`data.databases.create`	`data:write`	Creates a database. The Operation is done when the controller settles it.
`data.databases.update`	`data:write`	Updates a database.
`data.kv_namespaces.create`	`data:write`	Creates a kv namespace. The Operation is done when the controller settles it.
`data.kv_namespaces.update`	`data:write`	Updates a kv namespace.
`data.buckets.create`	`data:write`	Creates a bucket. The Operation is done when the controller settles it.
`data.buckets.update`	`data:write`	Updates a bucket.
`data.search_indexes.create`	`data:write`	Creates a search index. The Operation is done when the controller settles it.
`data.search_indexes.update`	`data:write`	Updates a search index.
`events.topics.create`	`events:write`	Creates a topic.
`events.topics.update`	`events:write`	Updates a topic.
`events.subscriptions.create`	`events:write`	Creates a subscription.
`events.subscriptions.update`	`events:write`	Updates a subscription.
`events.queues.create`	`events:write`	Creates a queue.
`events.queues.update`	`events:write`	Updates a queue.
`events.webhook_endpoints.create`	`events:write`	Creates a webhook endpoint.
`events.webhook_endpoints.update`	`events:write`	Updates a webhook endpoint.
`events.inbound_endpoints.create`	`events:write`	Creates an inbound endpoint.
`events.inbound_endpoints.update`	`events:write`	Updates an inbound endpoint.
`events.realtime_channels.create`	`events:write`	Creates a realtime channel.
`events.realtime_channels.update`	`events:write`	Updates a realtime channel.
`hosting.services.create`	`hosting:write`	Creates a service. The Operation is done when the controller settles it.
`hosting.services.update`	`hosting:write`	Updates a service.
`hosting.service_rollouts.create`	`hosting:write`	Creates a rollout.
`hosting.previews.create`	`hosting:write`	Creates a preview. The Operation is done when the controller settles it.
`hosting.source_links.create`	`hosting:write`	Creates a source link. The Operation is done when the controller settles it.
`hosting.source_links.update`	`hosting:write`	Updates a source link.
`keys.keys.create`	`keys:write`	Creates a key; the signer generates its first version.
`keys.keys.update`	`keys:write`	Updates a key's rotation period, deletion protection, or metadata.
`knowledge.spaces.create`	`knowledge:write`	Creates a space.
`knowledge.spaces.update`	`knowledge:write`	Updates a space.
`knowledge.knowledge_schemas.create`	`knowledge:write`	Creates a knowledge schema.
`knowledge.knowledge_schemas.update`	`knowledge:write`	Updates a knowledge schema. An accepted update publishes a new revision; a change that would invalidate existing records is refused with `INVALID_FIELD`.
`knowledge.episodes.create`	`knowledge:write`	Records an episode and returns at once (`remember`); extraction reads it afterwards.
`knowledge.entities.create`	`knowledge:write`	Creates an entity in a space. An entity whose external id already names one in the graph is refused with `RESOURCE_ALREADY_EXISTS`, which names it; use Update with `allow_missing` to upsert.
`knowledge.entities.update`	`knowledge:write`	Updates an entity. With `allow_missing` it is the structured upsert (`upsert_entity`): an entity matched by `external_ids` is updated, otherwise one is created.
`knowledge.relations.create`	`knowledge:write`	Records a fact in a space (`relate`). A fact that contradicts a current one with the same subject and a single-valued predicate closes the older fact; nothing is overwritten.
`localization.catalogs.create`	`localization:write`	Creates a catalog.
`localization.catalogs.update`	`localization:write`	Updates a catalog.
`localization.glossaries.create`	`localization:write`	Creates a glossary.
`localization.glossaries.update`	`localization:write`	Updates a glossary.
`money.price_catalogs.update`	`billing:write`	Updates the environment's catalog: its features and products, whole.
`money.checkout_policies.update`	`billing:write`	Updates the environment's checkout policy, whole.
`money.store_connections.create`	`billing:write`	Creates a store connection; its credential is sealed and never returned.
`money.store_connections.update`	`billing:write`	Updates a store connection; a new credential replaces the stored one.
`money.entitlement_grants.create`	`billing:credits.approve`	Creates a manual entitlement grant (support, comp, grace). Append-only; needs the approval-class scope. The approver recorded is the key's principal.
`money.merchant_accounts.update`	`billing:write`	Updates the merchant account's own settings: the fields named in `update_mask`.
`money.checkout_sessions.create`	`billing:write`	Creates a hosted checkout for a subject.
`money.portal_sessions.create`	`billing:write`	Creates a customer portal session for a subject.
`money.licence_keys.generate`	`billing:licence_keys.approve`	Generates a licence key: Money creates the Ed25519 key, seals it, and never returns the private half. Needs the approval-class scope, which the developer role does not hold.
`money.licence_keys.import`	`billing:licence_keys.approve`	Imports an existing Ed25519 key (PKCS8), for a key already pinned in shipped clients. Refused unless the expected public key is the imported key's public half.
`money.usage_settings.update`	`billing:write`	Updates the usage settings, the enforcement switch included. A change is recorded with who made it.
`money.usage_tiers.update`	`billing:write`	Creates or updates a usage tier.
`money.usage_reservations.create`	`billing:metering:write`	Reserves usage before the work starts. Refused with PLAN_LIMIT_REACHED (spend limit, no payment method) or INVALID_STATE (suspended) only while enforcement is on; while it is dark the reservation is granted and the refusal is recorded.
`money.usage_events.create`	`billing:metering:write`	Records usage directly, only for a meter the merchant marked reservation-optional.
`money.usage_events.batch_ingest`	`billing:metering:ingest`	Records a batch of already-incurred usage from the merchant's own servers (Stripe's meter-event model): the caller is a key of the merchant's own org holding the exact grant `billing:metering:ingest`, which no wildcard covers, and each event names its subject with no subject proof. Each event is keyed by its project, meter, meter version and event id: a replay is a no-op (`duplicate`), and the same key with different content is a `conflict` and never counted. One result per event, in request order.
`money.credit_grants.create`	`billing:credits.approve`	Gives a subject credit. Append-only: a change is a new grant that supersedes the old. Refused with INVALID_STATE (`tax_treatment_unsupported`) for `post_tax_settlement` while the merchant has automatic tax on.
`money.usage_meters.update`	`billing:write`	Creates or updates a usage meter. The unit cannot change once it has recorded usage.
`money.usage_meter_prices.create`	`billing:write`	Appends a price to a meter's history. It applies from its effective time on and never rewrites usage already rated.
`money.revenue_sources.create`	`revenue:write`	Registers a revenue source. The `money` source is implicit and never created here.
`money.revenue_sources.update`	`revenue:write`	Renames, pauses or resumes a revenue source, or changes its settings.
`network.domains.create`	`network:write`	Creates a domain. The Operation is done when the controller settles it.
`network.domains.update`	`network:write`	Updates a domain.
`network.routes.create`	`network:write`	Creates a route. The Operation is done when the controller settles it.
`network.routes.update`	`network:write`	Updates a route.
`network.egress_identities.create`	`network:write`	Creates an egress identity. The Operation is done when the controller settles it.
`network.egress_identities.update`	`network:write`	Updates an egress identity.
`network.private_links.create`	`network:write`	Creates a private link. The Operation is done when the controller settles it.
`network.private_links.update`	`network:write`	Updates a private link.
`notify.mail_domains.create`	`notify:write`	Creates an email domain.
`notify.mail_domains.update`	`notify:write`	Updates an email domain.
`notify.mail_routes.create`	`notify:write`	Creates a route.
`notify.mail_routes.update`	`notify:write`	Updates a route.
`notify.senders.create`	`notify:write`	Creates a sender.
`notify.senders.update`	`notify:write`	Updates a sender.
`notify.recipients.create`	`notify:write`	Creates a recipient.
`notify.recipients.update`	`notify:write`	Updates a recipient.
`notify.preferences.update`	`notify:write`	Updates a preference.
`notify.suppressions.create`	`notify:write`	Creates a suppression.
`notify.templates.create`	`notify:write`	Creates a template.
`notify.templates.update`	`notify:write`	Updates a template.
`notify.messages.create`	`notify:send`	Sends a Message.
`notify.mailboxes.create`	`notify:write`	Creates a mailbox.
`notify.mailboxes.update`	`notify:write`	Updates a mailbox.
`notify.mailbox_oauth_apps.create`	`notify:write`	Creates a mailbox OAuth app.
`notify.mailbox_oauth_apps.update`	`notify:write`	Updates a mailbox OAuth app.
`notify.mailbox_connect_links.create`	`notify:write`	Mints a mailbox connect link for one end user; the response carries its `url`, which no later call returns.
`notify.broadcasts.create`	`notify:write`	Creates a broadcast.
`notify.broadcasts.update`	`notify:write`	Updates a broadcast.
`release.releases.create`	`release:write`	Creates a release: admits it and rolls it out in waves. The Operation is done when the release is live or halted.
`runners.scale_sets.create`	`runners:write`	Creates a scale set. The Operation is done when the controller settles it.
`runners.scale_sets.update`	`runners:write`	Updates a scale set.
`sandboxes.pools.create`	`sandboxes:write`	Creates a pool. The Operation is done when the controller settles it.
`sandboxes.pools.update`	`sandboxes:write`	Updates a pool.
`sandboxes.leases.create`	`sandboxes:write`	Creates a lease: granted now and returned READY (or GRANTED when `wait_ready` is false), or refused with a typed error. There is no queue.
`sandboxes.volumes.create`	`sandboxes:write`	Creates a volume.
`sandboxes.volumes.update`	`sandboxes:write`	Updates a volume: grows `spec.size_gib` and edits metadata.
`sandboxes.snapshots.create`	`sandboxes:write`	Captures a running lease's disk as a snapshot.
`secrets.secrets.create`	`secrets:write`	Creates a secret, without a value; add one with CreateSecretVersion.
`secrets.secrets.update`	`secrets:write`	Updates a secret.
`secrets.secret_versions.create`	`secrets:write`	Adds a value to a secret as its newest version. The value is never returned.
`secrets.secret_bindings.create`	`secrets:write`	Creates a secret binding.
`secrets.secret_bindings.update`	`secrets:write`	Updates a secret binding.
`secrets.profiles.create`	`secrets:write`	Creates an empty profile; its first version is written by a write-back mount (`:open` with WRITE_BACK, then `:commit`).
`secrets.profiles.update`	`secrets:write`	Updates a profile's grants or declared paths. Granting a mount is this call: nothing else adds a grant.
`workflows.workflows.create`	`workflows:write`	Creates a workflow.
`workflows.workflows.update`	`workflows:write`	Updates a workflow.
`workflows.schedules.create`	`workflows:write`	Creates a schedule.
`workflows.schedules.update`	`workflows:write`	Updates a schedule; with `allow_missing` it creates the schedule when it does not exist, so its short name `schedule` is an upsert by name.
`workflows.runs.create`	`workflows:run`	Starts a Run of a Workflow, now or after `start_delay` or at `schedule_time`. `run_id` is the caller's key: the same key and intent return the same Run, a changed intent is refused. An end user's session may call it on a Workflow whose `callers` is `USERS` when the session holds the Workflow's `permission`.
`workflows.jobs.create`	`workflows:write`	Creates a job.
`workflows.jobs.update`	`workflows:write`	Updates a job. Runs already started keep the generation they pinned.
`workflows.job_runs.create`	`workflows:run`	Starts a run of a Job now. The same `Idempotency-Key` returns the same run for 24h; a Schedule fire uses `{job}:{intended time}`. With concurrency `forbid`, a start while a run is active fails with INVALID_STATE.
`workflows.distributed_jobs.create`	`workflows:write`	Creates a distributed job.
`workflows.distributed_jobs.update`	`workflows:write`	Updates a distributed job. Runs already started keep the generation they pinned.
`workflows.distributed_runs.create`	`workflows:run`	Starts a run of a distributed job. The same `Idempotency-Key` returns the same run for 24h.
`workflows.distributed_runs.add_shards`	`workflows:run`	Appends shards to a run started with an open manifest; `close` ends the manifest, and the run ends once those shards are done.

Was this page helpful?

Tell us what is missing, wrong, or unclear — this opens a real inbox.

Send feedback

Platform links