API cheat sheet

Operations

Authentication accounts

getAuthAccount: Inspect current human account state.
createAuthAccount: Create a local auth account as an Installation administrator.
attachGoogleIdentity: Attach an exact Google identity to an existing account.
attachOidcIdentity: Attach an exact OIDC identity to an existing account.
detachAuthMethod: Detach an external sign-in identity from an account.
disableAuthAccount: Disable a human account.
enableAuthAccount: Re-enable a disabled human account.
enrolAuthAccount: Enrol an existing account that activation skipped.
revokeAuthAccountSessions: Revoke all sessions for a human account.

Authentication sessions

getAuthSession: Inspect authentication without revealing session tokens.
signInEmail: Sign in with email and password.
signOut: Sign out of the current session.

Service API keys

createServiceKey: Issue a service API key.
revokeServiceKey: Revoke a service API key.

Authentication

completeGoogleSignIn: Complete an enrolled Google sign-in.
completeOidcSignIn: Complete an enrolled OIDC sign-in.
getAuthProviders: List configured browser sign-in methods.
getAuthRecovery: Inspect the recovery account designation.
confirmGoogleSignIn: Confirm which session a Google sign-in created.
confirmOidcSignIn: Confirm which session an OIDC sign-in created.
replaceAuthRecovery: Move the recovery designation to another Installation administrator.
startGoogleSignIn: Start Google sign-in for an enrolled account.
startOidcSignIn: Start OIDC sign-in for an enrolled account.

Installation

discoverInstallationConfigurations: Inspect selected Driver accepted startup values and configuration schemas.
getInstallation: Get the singleton Installation.
getInstallationDeploymentInventory: Get the complete authorized Agent deployment inventory.
getObservability: Get the configured external observability destination.
bootstrapInstallation: Bootstrap the singleton Installation.

Namespaces

listNamespaces: List authorized Namespaces.
getNamespace: Get an exact Installation-owned Namespace.
getNamespaceAgentCapabilities: Report the Installation capabilities that Agent creation in this Namespace needs, for a caller who may create Agents there.
getNamespaceCallerPermissions: Report advisory primary IAM permissions on a readable Namespace, not authorization for a later operation.
getNamespaceSecretPermissions: Report the readable Secrets that the caller may not bind to a new Agent, not authorization for a later operation.
createNamespace: Create an Installation-owned Namespace.
deleteNamespace: Begin or retry deletion of an empty Installation-owned Namespace.

Agents

listAgentAuditEvents: List audit metadata for one Agent.
listAgentRepositoryOptions: List approved repository choices for updating one Agent.
listAgents: List authorized Agents in one exact Namespace.
listAgentStandingApprovals: Read attributable repository approvals and removed generations for one Agent.
listAgentStandingApprovalScopes: Review resolved repository scope before explicitly approving it.
listRepositoryOptions: List approved repository choices for Agent creation in one Namespace.
discoverAgentConfigurations: Discover authorized Agent Driver configuration contributions.
getAgent: Get an exact Namespace-owned Agent.
getAgentCallerPermissions: Report advisory primary IAM permissions on a readable Agent, not authorization for a later operation.
getAgentCredentialWithdrawal: Get the withdrawal state of a credential source for an Agent.
getAgentHarnessStatus: Read the Sandbox Driver's record of a running Agent's dedicated Harness Sandbox.
getAgentProvisioning: Get first-time provisioning status for one exact work item.
getAgentRuntimeImages: Read observed images and source commits for an Agent's active runtime.
getAgentSandboxPolicy: Read one Agent sandbox policy and delegation ceiling.
getAgentSandboxRecommendations: Read policy suggestions for the requested Agent revision.
getAgentSecretPermissions: Report the readable Secrets that the caller may not bind to a readable Agent, not authorization for a later operation.
getSavedAgentPluginPolicyCapabilities: Read selected Plugin Driver policy capabilities for an active Agent with caller Agent read/update permission.
recoverAgentFirstDeployment: Read an exact first-deployment receipt; null does not prove failure; requires Configuration read.
resolveAgentNativeAdminReturn: Resolve an authorized Agent from a copied native chat link.
createAgent: Create a Namespace-owned Agent.
provisionAgent: Create a new Agent and queue first-time provisioning.
TEMPORARY_API_WILL_BREAK_IN_FUTURE_setAgentSandboxPolicyEditing: Temporarily enable or disable future policy edits for one Agent.
updateAgent: Replace an exact Namespace-owned Agent's editable draft.
updateAgentSandboxPolicy: Replace one Agent network policy additions.
applyAgentSandboxPolicy: Queue policy application to the running Agent revision, optionally replacing saved additions.
confirmAgentNativeAdmin: Confirm a native Agent browser challenge.
deployAgent: Save an Agent revision from the Agent's saved settings.
deployAgentFirst: Admit the first deployment of an exact reviewed Configuration; requires Configuration read.
discoverAgentModels: List provider models for Agent creation without storing the supplied credential.
discoverAgentPluginDetails: Read plugin details using the selected Driver.
discoverAgentPlugins: List or search available plugins for Agent creation using the selected Driver.
discoverSavedAgentPluginDetails: Read plugin details for an active Agent with Agent read/update access. Hosted discovery uses the Agent's bound credential. Managed MCP discovery uses an eligible saved connection. The caller and Agent need operate access to the credential.
discoverSavedAgentPlugins: List or search plugins for an active Agent; caller needs Agent read/update. Curated discovery needs no Secret; hosted discovery needs the Agent's bound Service Accounts Secret with caller and Agent Secret operate grants.
launchAgentNativeAdmin: Create a browser-bound native Agent launch.
lookupChannelDirectory: Search a channel directory using an authorized Namespace Secret.
pollAgentDeviceAuthorization: Experimental: Complete device login without returning credential material.
pollSavedAgentDeviceAuthorization: Experimental: Complete device login without returning credential material.
removeAgentStandingApproval: Remove repository approval independently of configuration or runtime cleanup.
retryAgentProvisioning: Retry failed first-time provisioning for one exact work item.
startAgentDeviceAuthorization: Experimental: Start a private device login for Agent configuration.
startSavedAgentDeviceAuthorization: Experimental: Start a private device login for Agent configuration.
stopAgent: Stop one Agent and keep its saved Agent revision and persistent state.
validateAgentCreate: Check an unsaved Agent Configuration, plugin selections, initial workspace files and Harness authentication as Configuration and Agent create would, without saving anything.
validateAgentSandboxPolicy: Preview Agent network policy admission without saving or applying.
withdrawAgentCredentialSource: Revoke one credential source from the selected Agent revision.
getAgentNativeAdmin: Resolve native admin UI launch availability for one Agent.
cancelAgentDeviceAuthorization: Experimental: Discard a local device login without upstream revocation.
cancelSavedAgentDeviceAuthorization: Experimental: Discard a local device login without upstream revocation.
deleteAgent: Begin or retry deletion of the requested Agent and its Agent revisions.

Agent deployments

getAgentDeployment: Get the saved deployment status for an Agent revision.
getAgentDeploymentRuntime: Read Pod status, restart counts, Events, and log sources for an Agent revision.
getAgentDeploymentRuntimeLogs: Read one page of redacted container output for an Agent revision.
diagnoseAgentDeployment: Check the current runtime for an Agent revision.

Agent revisions

listAgentRevisions: List Agent revision summaries that you can read for the requested Agent, newest first.
getAgentRevision: Get an Agent revision that you can read.

Agent runtime credentials

getAgentRuntimeCredentials: Get metadata for one Agent's provisioned runtime credentials.
provisionAgentRuntimeCredentials: Provision initial runtime credentials for one undeployed Agent.

Agent workspace files

getAgentWorkspaceFile: Read an allowed workspace file from one active Agent.
putAgentWorkspaceFile: Create or replace an allowed workspace file for one active Agent.

Configurations

getConfiguration: Get an exact Namespace-owned Configuration.
createConfiguration: Create a native Namespace-owned Agent Configuration.
updateConfiguration: Replace values and increment an exact Namespace-owned Configuration generation.
deleteConfiguration: Delete an exact unreferenced Namespace-owned Configuration.

IAM access bindings

listIAMAccessBindings: List exact Namespace IAM AccessBindings.
getIAMAccessBinding: Get an exact Namespace IAM AccessBinding.
createIAMAccessBinding: Create an immutable exact-resource Namespace IAM AccessBinding.
deleteIAMAccessBinding: Delete one exact Namespace IAM AccessBinding.

IAM roles

listIAMRoles: List exact Namespace IAM Roles.
getIAMRole: Get an exact Namespace IAM Role.
createIAMRole: Create an immutable Namespace IAM Role.
deleteIAMRole: Delete an unreferenced exact Namespace IAM Role.

IAM service principals

listIAMServicePrincipals: List the Namespace's non-Agent ServicePrincipals.
getIAMServicePrincipal: Get an exact Namespace ServicePrincipal.
createIAMServicePrincipal: Create a Namespace ServicePrincipal with no grants for automation or CLI keys.

Secrets

listSecrets: List readable Namespace-owned Secret metadata without revealing material.
getSecret: Get exact Namespace-owned Secret metadata and its readable consumers.
createSecret: Create exact Namespace-owned Secret material and return metadata only.
updateSecret: Replace exact Namespace-owned Secret material and return stable metadata.
deleteSecret: Delete exact unbound Namespace-owned Secret material.

Service accounts

listServiceAccounts: List authorized Namespace-owned ServiceAccounts in one exact Namespace.
getServiceAccount: Get an exact Namespace-owned ServiceAccount.
createServiceAccount: Create a native Namespace-owned ServiceAccount.
deleteServiceAccount: Delete an exact unreferenced Namespace-owned ServiceAccount.

Service account credentials

createServiceAccountCredential: Issue a managed credential for an exact Namespace-owned ServiceAccount.
updateServiceAccountCredential: Associate an exact Namespace-local credential reference with a ServiceAccount.

Backends

listBackends: List configured Backends (experimental).

Connections

listConnectionTemplates: List all Installation-wide and Namespace-scoped connection templates.
listNamespaceConnections: List completed connections the caller can read in this Namespace.
listOAuthClients: List registered OAuth clients.
listUsableConnectionTemplates: List connection templates the caller may connect in this Namespace.
completeNamespaceConnection: Complete a browser connection for the signed-in person who started it.
getConnectionTemplate: Get one connection template.
createConnectionTemplate: Create an Installation-wide or Namespace-scoped connection template.
createOAuthClient: Register an OAuth client from a connection template.
updateConnectionTemplate: Rename a connection template, or create a version with new approved values.
discoverConnectionTemplate: Read public MCP resource and authorization server metadata.
rotateOAuthClientSecret: Rotate an OAuth client secret.
startNamespaceConnection: Start consent for a reusable account in this Namespace.
deleteConnectionTemplate: Delete a connection template.
deleteOAuthClient: Delete an unused OAuth client.
disconnectNamespaceConnection: Disconnect a saved account and retire its OAuth grant.

Credential sources

listCredentialSources: List readable credential sources without revealing credential values.
getCredentialSource: Get one credential source and its live Credential Gateway status.
createCredentialSource: Register a credential source with the selected Credential Gateway.
updateCredentialSource: Push current or replacement Secret values to the Credential Gateway copy.
rotateCredentialSource: Force the Credential Refresh Driver to mint a new token for a refresh-type source.
deleteCredentialSource: Remove an unreferenced credential source from the Credential Gateway.

Presets

listPresets: List readable Preset summaries in one Namespace.
getPreset: Read one exact Namespace-owned Preset.
createPreset: Create a reusable Namespace-owned Agent Preset.
updatePreset: Update a Preset without changing existing Agents.
deletePreset: Delete a Preset without changing existing Agents.