withHuman

Create a team, optionally with its first members. Teams are escalation targets: a level that names a team reaches every current member, or runs the team's escalation policy when it has one. Requires a personal API key; organization keys cannot manage teams.

Read one agent: its kind and status, a page of its instances (id, name, owner, status, liveness, credentials) and a page of its provisioner tokens. Instance and token ids are what update_agent_instance, revoke_agent_credential and revoke_provisioner_token take.

Read an escalation path's active revision: its nodes, working hours, repeat setting and warnings. Not found when the path has no active revision; use list_escalation_path_revisions then.

Read one escalation path revision, active or not, with its nodes and warnings.

Read a pipeline's active revision with its blocks in order and its default escalation path. Blocks come back in the shape update_pipeline accepts, so you can edit and resubmit them.

Read one pipeline revision, active or not, with its blocks.

List everything a pipeline revision names (escalation paths, webhook endpoints, delegated pipelines, an edition's block dependencies) with each one's state: what stands in the way of activating it.

Read one team and its members.

Read a team's active escalation policy: how a level targeting the team pages its members, with warnings for targets who have left. Not found when no policy is active; such a level then reaches every member at once.

Read one team escalation policy revision, active or not, with warnings for targets who have since left the team.

Read one tool catalogue entry with its full input schema and description.

Read a webhook endpoint's active revision: name and URL. The signing secret is never returned here; it is shown once when the endpoint is created or its secret rotated.

Read one webhook endpoint revision, active or not.

List the organization's agents: slug (what pipelines and conditions refer to), name, kind, status, and recent request counts.

List an escalation path's revisions, newest first, with which one is active.

List the active pipeline revisions that name this path, as a block's path or as the default: what stands in the way of archiving it.

List escalation paths with their key, name, active revision and latest revision.

List the permission policies granted directly to one member: each policy's permissions, the scope they apply at and its revision. Grants the member inherits from teams are on list_team_permission_policies. Requires a personal API key.

List the organization's members with the membership id (the id an escalation path's user target carries), display name, email, status, roles and team ids.

List every permission key this deployment knows, with what it allows, who can hold it, the kind of resource it applies to and whether it is dangerous. Use it to tell a person which grant to make, for example pipeline.write at pipeline:<key> for a team that owns a delegated pipeline. Requires a personal API key that can read permission policies.

List a pipeline's revisions, newest first, with which one is active. Use it to find a revision to roll back to.

List the delegate blocks in active pipeline revisions that hand requests to this pipeline: what stands in the way of archiving it.

List every approval pipeline: the entry pipeline every request starts in, then every pipeline a delegate block can hand requests to, each with its key, name, active revision number, the delegate blocks that hand requests to it, and history.

List the predefined roles (owner, admin, reviewer, auditor) with the permissions each grants. Assigning roles and permission policies is done by a person in the app. Requires a personal API key.

List a team's escalation policy revisions, newest first, with which one is active.

List the permission policies a team holds, which every member inherits live: each policy's permissions, scope and revision. Requires a personal API key.

List teams with their id (what an escalation path's team target carries), name, member count and whether an escalation policy is active.

List the tools agents have reported or can reach, one entry per tool and source, with its schema, the instances offering it and whether its source is available. Use it to learn the exact tool names and argument fields pipeline conditions test. The catalogue is advisory: it never changes how a request is decided.

List every distinct tool definition across agents in one answer (name, server, schema and description, with the runtimes and instances offering it): the vocabulary to write pipeline conditions against.

List a webhook endpoint's revisions, newest first, with which one is active. Use it to find a revision to roll back to.

List the active pipeline revisions whose webhook blocks post to this endpoint: what stands in the way of archiving it.

List webhook endpoints (the URLs a pipeline's webhook block can ask for an outcome) with their key, active revision, and which pipelines use them.

Run a sample request through a set of blocks and report the outcome (approve, deny, human, or next), which block decided, its reason, and the escalation path a human exit would take. Each step lists a block the request reached, with the pipeline it belongs to; a branch or delegate reports enter or next for its condition, and end_of_branch when the request ran out of its blocks (for a delegate, out of the target pipeline). Delegate blocks expand to their targets' current active revisions, so the preview walks what a request would. Nothing is saved and no approval request is created. webhook blo…

Read the exact grammar for pipeline blocks, conditions, or escalation path and team escalation policy documents. Read the relevant topic before writing one: unknown fields are refused and ids must be UUIDs.

Remove a member from the organization for good: their sessions, API keys and agent instances stop working. Refused for your own membership, the last active owner, and members your directory manages. Requires a personal API key.

Rename a team. Escalation paths name teams by id, so nothing else changes. Refused for a team your directory manages. Requires a personal API key.

Restore an archived agent to active. Credentials and provisioner tokens revoked when it was archived stay revoked; its instances can be enrolled again.

Revoke one instance credential for good: the runtime holding it can no longer make requests. To pause an instance instead, disable it with update_agent_instance.

Revoke a provisioner token for good. Instances it already created keep their own credentials.

Replace a webhook endpoint's signing secret. The old secret stops working at once for every revision, so deliveries fail signature checks until the receiver has the new one. The answer carries the new secret exactly once: relay it to whoever operates the receiving service.

Create a webhook endpoint or save a new revision of one, and activate it unless activate is false. A new key answers with signing_secret exactly once: relay it to whoever operates the receiving service, because it is what verifies withHuman's signature and it cannot be read back. The URL must be public HTTPS.

Replace a team's manual member list. Requires a personal API key; organization keys cannot manage teams.

Send one signed test delivery (type webhook_endpoint.test, flagged as a preview) to a revision's URL and report what came back, waiting up to 10 seconds. It checks the receiver's signature verification too. The test is recorded in the audit log.

Rename an agent or switch it between active and disabled. Disabling refuses every instance's credentials until the agent is active again, without revoking them. The slug never changes.

Rename one instance of an agent or switch it between active and disabled. Disabling refuses the instance's credentials until it is active again, without revoking them.

Save a new revision of an existing escalation path (the whole document again, not a diff) and activate it unless activate is false. Pipelines that name the key pick up the active revision for new requests; requests already routed keep the revision they were pinned to.

Suspend a member (signs them out everywhere and refuses their sessions, API keys and agents) or reactivate a suspended one. Refused for your own membership, the last active owner, and members your directory manages. Requires a personal API key.

Save a new revision of a pipeline (the entry pipeline, or one a delegate hands requests to) and activate it (unless activate is false). Blocks run in order and the first to decide wins: outcome blocks decide every request that reaches them, webhook blocks ask a service of yours (and a kind this deployment adds may ask a model), branch blocks run their own blocks only for requests their condition matches (so "if this, then that" is a branch holding an outcome block), and delegate blocks hand matching requests to another pipeline by key; a request that enters a branch or a delegated pipeline is …

Save a new revision of a team's escalation policy (the whole document again, not a diff) and activate it unless activate is false. The policy orders how members are paged when a path level targets the team: levels name current members as user targets, or broadcast for everyone; every member a request reaches may still decide it. Call read_reference (escalation_paths) first.