/api/v2/workflows/{workflowId}/operationsApply draft edits and block enablement changes in one write. Requires workspace write access. The live deployment is unchanged; lint is advisory.
Inspect skipped and inputValidationErrors for edits that did not apply. Deferred edges apply when their targets exist; do not resubmit them. With atomic=true, declined operations or dropped inputs return 409 (OPERATIONS_NOT_APPLIED) without saving. Use returned mintedBlockIds in later requests. dryRun=true evaluates without saving, auditing, or notifying. Workspace API keys return 403; use a personal API key or scoped OAuth token.
OAuth scope: api:write.
Authentication
Send a personal or workspace API key in X-API-Key. See key types and access; operations that reject workspace keys say so in their description.
Send X-API-Key in the request header.
Alternatively
Send a Sim OAuth access token in Authorization: Bearer. See OAuth authentication and scopes.
Authorization: Bearer YOUR_ACCESS_TOKEN
Required scopes: api:write
OAuth flows
OAuth scope: api:write.
Path parameters
Unique workflow identifier.
- minLength
- 1
Query parameters
Validate and lint without writing, auditing, or notifying collaborators. Returns the same validation, preparation warnings, lint findings, and ID-ownership conflicts (409) as a committed write. needsRedeployment describes the pre-write state. For semantic operations, mintedBlockIds is empty; previewBlockIds contains provisional IDs with a warning, since committing mints new IDs.
Request body
RequiredA batch of semantic edits against a workflow graph.
A batch of semantic edits against a workflow graph.
4 fields
Edits to apply, in a single batch.
- minItems
- 1
- maxItems
- 200
Schema details
One semantic edit against a workflow graph.
Schema details
Exactly one of
3 fields
Create a new block.
- const
- add
Block the operation targets. For add, the id the new block will be given.
- minLength
- 1
Block type, name, and optional inputs, connections, retry, triggerMode, or advancedMode. inputs maps sub-block ids directly to values, never through subBlocks. Keep retry, triggerMode, and advancedMode beside inputs. connections maps source handles to target ids, { block, handle }, or arrays; success aliases source.
3 fields
Registered block type.
- minLength
- 1
Block display name.
- minLength
- 1
Block configuration keyed by sub-block id.
Schema details
All of
1 field
Agent tools configuration. Applies to a tool-input field; other block inputs remain catalog-defined.
- maxItems
- 100
Schema details
A catalog integration operation, workspace custom tool, or MCP tool available to an Agent.
Schema details
Exactly one of
A catalog integration operation the Agent may call. Resolve valid block and operation ids through the block catalog.
5 fields
Catalog block id, such as cloudwatch or slack. Use the block id, never an underlying tool id.
- minLength
- 1
- maxLength
- 255
- pattern
- ^(?!(?:custom-tool|mcp|mcp-server-advanced)$).+$
Operation ID from Get Block. Required when the block exposes multiple operations; it may differ from the tool ID.
- minLength
- 1
- maxLength
- 255
Selector Permission Mode: auto lets the model decide, force requires a call, and none disables it. Supply this property and omit usageControlExpression to select or switch to Selector mode; do not send null or set canonicalModes or block-level advancedMode. With neither property, the default is auto.
- enum
- ["auto","force","none"]
Variable Permission Mode: a reference such as <start.toolMode> or a literal such as none, resolving to auto, force, or none at execution time. Supply this property and omit usageControl to select or switch to Variable mode; do not send null or set canonicalModes or block-level advancedMode.
- maxLength
- 2048
Parameters fixed by the workflow author. Parameters left out remain available for the model to supply when the tool declares them.
Schema details
One tool parameter value.
Forward-compatible integration tool metadata preserved by the workflow editor.
A workspace custom tool. Prefer customToolId; inline declarations are also accepted.
Schema details
Any of
4 fields
Custom-tool discriminator.
- const
- custom-tool
Custom tool ID from List Custom Tools.
- minLength
- 1
- maxLength
- 255
Selector Permission Mode: auto lets the model decide, force requires a call, and none disables it. Supply this property and omit usageControlExpression to select or switch to Selector mode; do not send null or set canonicalModes or block-level advancedMode. With neither property, the default is auto.
- enum
- ["auto","force","none"]
Variable Permission Mode: a reference such as <start.toolMode> or a literal such as none, resolving to auto, force, or none at execution time. Supply this property and omit usageControl to select or switch to Variable mode; do not send null or set canonicalModes or block-level advancedMode.
- maxLength
- 2048
Forward-compatible custom tool metadata preserved by the workflow editor.
5 fields
Custom-tool discriminator.
- const
- custom-tool
Inline OpenAI-style function declaration.
2 fields
Function declaration discriminator.
- const
- function
OpenAI-style function definition.
3 fields
Function name presented to the model.
- minLength
- 1
- maxLength
- 64
What the inline custom tool does.
JSON Schema describing the function arguments.
Schema details
One JSON Schema keyword on the function parameters.
Additional function declaration metadata.
Additional custom tool declaration metadata.
Inline tool implementation executed by the Function runtime.
Selector Permission Mode: auto lets the model decide, force requires a call, and none disables it. Supply this property and omit usageControlExpression to select or switch to Selector mode; do not send null or set canonicalModes or block-level advancedMode. With neither property, the default is auto.
- enum
- ["auto","force","none"]
Variable Permission Mode: a reference such as <start.toolMode> or a literal such as none, resolving to auto, force, or none at execution time. Supply this property and omit usageControl to select or switch to Variable mode; do not send null or set canonicalModes or block-level advancedMode.
- maxLength
- 2048
Forward-compatible custom tool metadata preserved by the workflow editor.
One tool discovered from a workspace MCP server.
4 fields
MCP-tool discriminator.
- const
- mcp
MCP server and tool identity plus any tool arguments fixed by the workflow author.
Schema details
All of
2 fields
MCP server id returned by GET /api/v2/mcp-servers.
- minLength
- 1
- maxLength
- 128
Tool name returned by the MCP server’s tools endpoint.
- minLength
- 1
- maxLength
- 256
One parameter fixed by the workflow author.
Schema details
One parameter fixed by the workflow author.
Selector Permission Mode: auto lets the model decide, force requires a call, and none disables it. Supply this property and omit usageControlExpression to select or switch to Selector mode; do not send null or set canonicalModes or block-level advancedMode. With neither property, the default is auto.
- enum
- ["auto","force","none"]
Variable Permission Mode: a reference such as <start.toolMode> or a literal such as none, resolving to auto, force, or none at execution time. Supply this property and omit usageControl to select or switch to Variable mode; do not send null or set canonicalModes or block-level advancedMode.
- maxLength
- 2048
Forward-compatible MCP tool metadata preserved by the workflow editor.
Dynamically discovered operations permitted by the authorized credential and saved block policy.
5 fields
Server-wide MCP binding discriminator.
- const
- mcp-server-advanced
Saved workflow operation restrictions that can only narrow authorized credential access.
Schema details
Exactly one of
1 field
Allow all operations available to the authorized credential.
- const
- all
Additional properties are not allowed.
2 fields
Allow only the selected exact operations.
- const
- allow
Allowed exact MCP tool names; an empty list grants no access.
- maxItems
- 1000
Schema details
Exact MCP tool name on the resolved connection, without a Sim server prefix.
- minLength
- 1
- maxLength
- 256
Additional properties are not allowed.
2 fields
Exclude the selected exact operations.
- const
- deny
Denied exact MCP tool names; an empty list allows otherwise permitted tools.
- maxItems
- 1000
Schema details
Exact MCP tool name on the resolved connection, without a Sim server prefix.
- minLength
- 1
- maxLength
- 256
Additional properties are not allowed.
Executable server or connection identity for authorized operation discovery and execution.
1 field
Workspace MCP server ID or explicit credential-group managed MCP connection ID.
- minLength
- 1
- maxLength
- 128
Additional properties are not allowed.
Selector Permission Mode: auto lets the model decide, force requires a call, and none disables it. Supply this property and omit usageControlExpression to select or switch to Selector mode; do not send null or set canonicalModes or block-level advancedMode. With neither property, the default is auto.
- enum
- ["auto","force","none"]
Variable Permission Mode: a reference such as <start.toolMode> or a literal such as none, resolving to auto, force, or none at execution time. Supply this property and omit usageControl to select or switch to Variable mode; do not send null or set canonicalModes or block-level advancedMode.
- maxLength
- 2048
Forward-compatible MCP server metadata preserved by the workflow editor.
One block-specific input whose accepted shape is published by the block catalog.
Schema details
One block-specific input whose accepted shape is published by the block catalog.
One block-specific input or connection descriptor.
Additional properties are not allowed.
3 fields
Change an existing block: its inputs, name, or connections.
- const
- edit
Block the operation targets. For add, the id the new block will be given.
- minLength
- 1
Patch only supplied fields: inputs, name, connections, removeEdges, nestedNodes, retry, triggerMode, and advancedMode. inputs maps sub-block ids directly to values, never through subBlocks. Keep retry, triggerMode, and advancedMode beside inputs. connections maps source handles to target ids, { block, handle }, or arrays; success aliases source. Re-sending connections replaces outgoing edges; use removeEdges to delete selected edges.
Schema details
All of
1 field
Block configuration keyed by sub-block id.
Schema details
All of
1 field
Agent tools configuration. Applies to a tool-input field; other block inputs remain catalog-defined.
- maxItems
- 100
Schema details
A catalog integration operation, workspace custom tool, or MCP tool available to an Agent.
Schema details
Exactly one of
A catalog integration operation the Agent may call. Resolve valid block and operation ids through the block catalog.
5 fields
Catalog block id, such as cloudwatch or slack. Use the block id, never an underlying tool id.
- minLength
- 1
- maxLength
- 255
- pattern
- ^(?!(?:custom-tool|mcp|mcp-server-advanced)$).+$
Operation ID from Get Block. Required when the block exposes multiple operations; it may differ from the tool ID.
- minLength
- 1
- maxLength
- 255
Selector Permission Mode: auto lets the model decide, force requires a call, and none disables it. Supply this property and omit usageControlExpression to select or switch to Selector mode; do not send null or set canonicalModes or block-level advancedMode. With neither property, the default is auto.
- enum
- ["auto","force","none"]
Variable Permission Mode: a reference such as <start.toolMode> or a literal such as none, resolving to auto, force, or none at execution time. Supply this property and omit usageControl to select or switch to Variable mode; do not send null or set canonicalModes or block-level advancedMode.
- maxLength
- 2048
Parameters fixed by the workflow author. Parameters left out remain available for the model to supply when the tool declares them.
Schema details
One tool parameter value.
Forward-compatible integration tool metadata preserved by the workflow editor.
A workspace custom tool. Prefer customToolId; inline declarations are also accepted.
Schema details
Any of
4 fields
Custom-tool discriminator.
- const
- custom-tool
Custom tool ID from List Custom Tools.
- minLength
- 1
- maxLength
- 255
Selector Permission Mode: auto lets the model decide, force requires a call, and none disables it. Supply this property and omit usageControlExpression to select or switch to Selector mode; do not send null or set canonicalModes or block-level advancedMode. With neither property, the default is auto.
- enum
- ["auto","force","none"]
Variable Permission Mode: a reference such as <start.toolMode> or a literal such as none, resolving to auto, force, or none at execution time. Supply this property and omit usageControl to select or switch to Variable mode; do not send null or set canonicalModes or block-level advancedMode.
- maxLength
- 2048
Forward-compatible custom tool metadata preserved by the workflow editor.
5 fields
Custom-tool discriminator.
- const
- custom-tool
Inline OpenAI-style function declaration.
2 fields
Function declaration discriminator.
- const
- function
OpenAI-style function definition.
3 fields
Function name presented to the model.
- minLength
- 1
- maxLength
- 64
What the inline custom tool does.
JSON Schema describing the function arguments.
Schema details
One JSON Schema keyword on the function parameters.
Additional function declaration metadata.
Additional custom tool declaration metadata.
Inline tool implementation executed by the Function runtime.
Selector Permission Mode: auto lets the model decide, force requires a call, and none disables it. Supply this property and omit usageControlExpression to select or switch to Selector mode; do not send null or set canonicalModes or block-level advancedMode. With neither property, the default is auto.
- enum
- ["auto","force","none"]
Variable Permission Mode: a reference such as <start.toolMode> or a literal such as none, resolving to auto, force, or none at execution time. Supply this property and omit usageControl to select or switch to Variable mode; do not send null or set canonicalModes or block-level advancedMode.
- maxLength
- 2048
Forward-compatible custom tool metadata preserved by the workflow editor.
One tool discovered from a workspace MCP server.
4 fields
MCP-tool discriminator.
- const
- mcp
MCP server and tool identity plus any tool arguments fixed by the workflow author.
Schema details
All of
2 fields
MCP server id returned by GET /api/v2/mcp-servers.
- minLength
- 1
- maxLength
- 128
Tool name returned by the MCP server’s tools endpoint.
- minLength
- 1
- maxLength
- 256
One parameter fixed by the workflow author.
Schema details
One parameter fixed by the workflow author.
Selector Permission Mode: auto lets the model decide, force requires a call, and none disables it. Supply this property and omit usageControlExpression to select or switch to Selector mode; do not send null or set canonicalModes or block-level advancedMode. With neither property, the default is auto.
- enum
- ["auto","force","none"]
Variable Permission Mode: a reference such as <start.toolMode> or a literal such as none, resolving to auto, force, or none at execution time. Supply this property and omit usageControl to select or switch to Variable mode; do not send null or set canonicalModes or block-level advancedMode.
- maxLength
- 2048
Forward-compatible MCP tool metadata preserved by the workflow editor.
Dynamically discovered operations permitted by the authorized credential and saved block policy.
5 fields
Server-wide MCP binding discriminator.
- const
- mcp-server-advanced
Saved workflow operation restrictions that can only narrow authorized credential access.
Schema details
Exactly one of
1 field
Allow all operations available to the authorized credential.
- const
- all
Additional properties are not allowed.
2 fields
Allow only the selected exact operations.
- const
- allow
Allowed exact MCP tool names; an empty list grants no access.
- maxItems
- 1000
Schema details
Exact MCP tool name on the resolved connection, without a Sim server prefix.
- minLength
- 1
- maxLength
- 256
Additional properties are not allowed.
2 fields
Exclude the selected exact operations.
- const
- deny
Denied exact MCP tool names; an empty list allows otherwise permitted tools.
- maxItems
- 1000
Schema details
Exact MCP tool name on the resolved connection, without a Sim server prefix.
- minLength
- 1
- maxLength
- 256
Additional properties are not allowed.
Executable server or connection identity for authorized operation discovery and execution.
1 field
Workspace MCP server ID or explicit credential-group managed MCP connection ID.
- minLength
- 1
- maxLength
- 128
Additional properties are not allowed.
Selector Permission Mode: auto lets the model decide, force requires a call, and none disables it. Supply this property and omit usageControlExpression to select or switch to Selector mode; do not send null or set canonicalModes or block-level advancedMode. With neither property, the default is auto.
- enum
- ["auto","force","none"]
Variable Permission Mode: a reference such as <start.toolMode> or a literal such as none, resolving to auto, force, or none at execution time. Supply this property and omit usageControl to select or switch to Variable mode; do not send null or set canonicalModes or block-level advancedMode.
- maxLength
- 2048
Forward-compatible MCP server metadata preserved by the workflow editor.
One block-specific input whose accepted shape is published by the block catalog.
Schema details
One block-specific input whose accepted shape is published by the block catalog.
One operation parameter; see the description for the accepted keys.
Schema details
One operation parameter; see the description for the accepted keys.
Additional properties are not allowed.
2 fields
Remove a block and every edge touching it.
- const
- delete
Block the operation targets. For add, the id the new block will be given.
- minLength
- 1
Additional properties are not allowed.
3 fields
Create a block inside a loop or parallel container.
- const
- insert_into_subflow
Block the operation targets. For add, the id the new block will be given.
- minLength
- 1
Container, block type, name, and the same optional fields as add. inputs maps sub-block ids directly to values, never through subBlocks. Keep retry, triggerMode, and advancedMode beside inputs. connections maps source handles to target ids, { block, handle }, or arrays; success aliases source.
4 fields
Loop or parallel container to insert the block into.
- minLength
- 1
Registered block type.
- minLength
- 1
Block display name.
- minLength
- 1
Block configuration keyed by sub-block id.
Schema details
All of
1 field
Agent tools configuration. Applies to a tool-input field; other block inputs remain catalog-defined.
- maxItems
- 100
Schema details
A catalog integration operation, workspace custom tool, or MCP tool available to an Agent.
Schema details
Exactly one of
A catalog integration operation the Agent may call. Resolve valid block and operation ids through the block catalog.
5 fields
Catalog block id, such as cloudwatch or slack. Use the block id, never an underlying tool id.
- minLength
- 1
- maxLength
- 255
- pattern
- ^(?!(?:custom-tool|mcp|mcp-server-advanced)$).+$
Operation ID from Get Block. Required when the block exposes multiple operations; it may differ from the tool ID.
- minLength
- 1
- maxLength
- 255
Selector Permission Mode: auto lets the model decide, force requires a call, and none disables it. Supply this property and omit usageControlExpression to select or switch to Selector mode; do not send null or set canonicalModes or block-level advancedMode. With neither property, the default is auto.
- enum
- ["auto","force","none"]
Variable Permission Mode: a reference such as <start.toolMode> or a literal such as none, resolving to auto, force, or none at execution time. Supply this property and omit usageControl to select or switch to Variable mode; do not send null or set canonicalModes or block-level advancedMode.
- maxLength
- 2048
Parameters fixed by the workflow author. Parameters left out remain available for the model to supply when the tool declares them.
Schema details
One tool parameter value.
Forward-compatible integration tool metadata preserved by the workflow editor.
A workspace custom tool. Prefer customToolId; inline declarations are also accepted.
Schema details
Any of
4 fields
Custom-tool discriminator.
- const
- custom-tool
Custom tool ID from List Custom Tools.
- minLength
- 1
- maxLength
- 255
Selector Permission Mode: auto lets the model decide, force requires a call, and none disables it. Supply this property and omit usageControlExpression to select or switch to Selector mode; do not send null or set canonicalModes or block-level advancedMode. With neither property, the default is auto.
- enum
- ["auto","force","none"]
Variable Permission Mode: a reference such as <start.toolMode> or a literal such as none, resolving to auto, force, or none at execution time. Supply this property and omit usageControl to select or switch to Variable mode; do not send null or set canonicalModes or block-level advancedMode.
- maxLength
- 2048
Forward-compatible custom tool metadata preserved by the workflow editor.
5 fields
Custom-tool discriminator.
- const
- custom-tool
Inline OpenAI-style function declaration.
2 fields
Function declaration discriminator.
- const
- function
OpenAI-style function definition.
3 fields
Function name presented to the model.
- minLength
- 1
- maxLength
- 64
What the inline custom tool does.
JSON Schema describing the function arguments.
Schema details
One JSON Schema keyword on the function parameters.
Additional function declaration metadata.
Additional custom tool declaration metadata.
Inline tool implementation executed by the Function runtime.
Selector Permission Mode: auto lets the model decide, force requires a call, and none disables it. Supply this property and omit usageControlExpression to select or switch to Selector mode; do not send null or set canonicalModes or block-level advancedMode. With neither property, the default is auto.
- enum
- ["auto","force","none"]
Variable Permission Mode: a reference such as <start.toolMode> or a literal such as none, resolving to auto, force, or none at execution time. Supply this property and omit usageControl to select or switch to Variable mode; do not send null or set canonicalModes or block-level advancedMode.
- maxLength
- 2048
Forward-compatible custom tool metadata preserved by the workflow editor.
One tool discovered from a workspace MCP server.
4 fields
MCP-tool discriminator.
- const
- mcp
MCP server and tool identity plus any tool arguments fixed by the workflow author.
Schema details
All of
2 fields
MCP server id returned by GET /api/v2/mcp-servers.
- minLength
- 1
- maxLength
- 128
Tool name returned by the MCP server’s tools endpoint.
- minLength
- 1
- maxLength
- 256
One parameter fixed by the workflow author.
Schema details
One parameter fixed by the workflow author.
Selector Permission Mode: auto lets the model decide, force requires a call, and none disables it. Supply this property and omit usageControlExpression to select or switch to Selector mode; do not send null or set canonicalModes or block-level advancedMode. With neither property, the default is auto.
- enum
- ["auto","force","none"]
Variable Permission Mode: a reference such as <start.toolMode> or a literal such as none, resolving to auto, force, or none at execution time. Supply this property and omit usageControl to select or switch to Variable mode; do not send null or set canonicalModes or block-level advancedMode.
- maxLength
- 2048
Forward-compatible MCP tool metadata preserved by the workflow editor.
Dynamically discovered operations permitted by the authorized credential and saved block policy.
5 fields
Server-wide MCP binding discriminator.
- const
- mcp-server-advanced
Saved workflow operation restrictions that can only narrow authorized credential access.
Schema details
Exactly one of
1 field
Allow all operations available to the authorized credential.
- const
- all
Additional properties are not allowed.
2 fields
Allow only the selected exact operations.
- const
- allow
Allowed exact MCP tool names; an empty list grants no access.
- maxItems
- 1000
Schema details
Exact MCP tool name on the resolved connection, without a Sim server prefix.
- minLength
- 1
- maxLength
- 256
Additional properties are not allowed.
2 fields
Exclude the selected exact operations.
- const
- deny
Denied exact MCP tool names; an empty list allows otherwise permitted tools.
- maxItems
- 1000
Schema details
Exact MCP tool name on the resolved connection, without a Sim server prefix.
- minLength
- 1
- maxLength
- 256
Additional properties are not allowed.
Executable server or connection identity for authorized operation discovery and execution.
1 field
Workspace MCP server ID or explicit credential-group managed MCP connection ID.
- minLength
- 1
- maxLength
- 128
Additional properties are not allowed.
Selector Permission Mode: auto lets the model decide, force requires a call, and none disables it. Supply this property and omit usageControlExpression to select or switch to Selector mode; do not send null or set canonicalModes or block-level advancedMode. With neither property, the default is auto.
- enum
- ["auto","force","none"]
Variable Permission Mode: a reference such as <start.toolMode> or a literal such as none, resolving to auto, force, or none at execution time. Supply this property and omit usageControl to select or switch to Variable mode; do not send null or set canonicalModes or block-level advancedMode.
- maxLength
- 2048
Forward-compatible MCP server metadata preserved by the workflow editor.
One block-specific input whose accepted shape is published by the block catalog.
Schema details
One block-specific input whose accepted shape is published by the block catalog.
One block-specific input or connection descriptor.
Additional properties are not allowed.
3 fields
Move a block out of its loop or parallel container.
- const
- extract_from_subflow
Block the operation targets. For add, the id the new block will be given.
- minLength
- 1
Container identifier, plus any block-specific inputs.
1 field
Loop or parallel container the block moves into or out of.
- minLength
- 1
One block-specific input.
Additional properties are not allowed.
Fail the whole batch when any operation is declined or any block input would be dropped. The default applies what it can and reports the rest in skipped and inputValidationErrors; true writes nothing and answers 409 instead.
- default
- false
Whether to reposition blocks the batch touched. targeted (default) nudges only the affected subgraph; none leaves every position exactly as supplied.
- default
- targeted
- enum
- ["targeted","none"]
Blocks to enable or disable, applied after operations. Disabling a loop or parallel cascades to its unlocked descendants; enabling a block whose container is disabled is declined.
- maxItems
- 200
Schema details
2 fields
Block the operation targets. For add, the id the new block will be given.
- minLength
- 1
Whether the block should run.
Additional properties are not allowed.
Additional properties are not allowed.
Request example 1
Responses
200
The batch was applied.
Outcome of a batch of semantic edits.
1 field
Response data.
11 fields
Identifier of the workflow whose draft graph was written.
Non-fatal notes about blocks and edges that were normalized or dropped before persistence and, when lint has findings, one line counting them by category, so a caller that reads only warnings still learns they exist. The findings themselves are in lint. Empty when there is nothing to report.
Schema details
Whether the live deployment differs from the draft. A graph write never changes what the deployed endpoint serves; deploy to publish it. On a dry run, this describes the state before the proposed write.
Operations the engine applied.
- minimum
- 0
- maximum
- 9007199254740991
Operations the engine declined. Empty when everything applied.
Schema details
One operation the edit engine did not apply.
5 fields
Machine-readable reason the engine declined an operation.
- enum
- ["block_not_found","invalid_block_type","block_not_allowed","model_not_allowed","block_locked","tool_not_allowed","invalid_edge_target","invalid_edge_source","invalid_edge_scope","invalid_source_handle","invalid_target_handle","invalid_subblock_field","missing_required_params","invalid_subflow_parent","nested_subflow_not_allowed","duplicate_block_name","reserved_block_name","retry_not_supported","duplicate_trigger","duplicate_single_instance_block","disabled_ancestor"]
The operation_type that was declined.
Block the declined operation targeted.
Human-readable explanation.
Additional context for the reason; keys depend on type.
Schema details
One piece of engine-supplied context for the reason.
Additional properties are not allowed.
Edges waiting for target blocks. They apply automatically when their targets exist, in this batch or a later one. Do not resubmit them.
Schema details
One operation the edit engine did not apply.
5 fields
Machine-readable reason the engine declined an operation.
- enum
- ["block_not_found","invalid_block_type","block_not_allowed","model_not_allowed","block_locked","tool_not_allowed","invalid_edge_target","invalid_edge_source","invalid_edge_scope","invalid_source_handle","invalid_target_handle","invalid_subblock_field","missing_required_params","invalid_subflow_parent","nested_subflow_not_allowed","duplicate_block_name","reserved_block_name","retry_not_supported","duplicate_trigger","duplicate_single_instance_block","disabled_ancestor"]
The operation_type that was declined.
Block the declined operation targeted.
Human-readable explanation.
Additional context for the reason; keys depend on type.
Schema details
One piece of engine-supplied context for the reason.
Additional properties are not allowed.
Block inputs that were dropped rather than persisted, and only those. The rest of the operation still applied. References that merely fail to resolve stay persisted and are reported in lint.unresolvedReferences instead.
Schema details
One block input that was dropped rather than persisted.
4 fields
Block whose input was rejected.
Type of the block whose input was rejected.
Sub-block field that was rejected.
Why the value was rejected.
Additional properties are not allowed.
Assigned IDs keyed by requested block_id, including only changed IDs. add and insert_into_subflow replace non-UUID labels with minted UUIDs. References within the batch are remapped automatically; later requests must use the minted IDs. Supply UUIDs to preserve your chosen IDs. Empty on dry runs, which return provisional IDs in previewBlockIds instead.
Schema details
The id the block was actually given.
Dry run only: the provisional id the evaluation assigned to each block whose block_id was not already a UUID, keyed by the block_id you asked for. These are not the ids a committed apply produces — the real apply mints new ones — so never wire a later request against them. Wire edges by block_id within one batch, or by the mintedBlockIds the real apply returns.
Schema details
The provisional id the dry run assigned.
Advisory findings about a saved graph. Findings never block a write or a deploy; they tell a caller what will misbehave at run time.
11 fields
Blocks with no incoming edge. A trigger block is naturally a source; anything else here is unreachable.
Schema details
3 fields
Block the finding is about.
Display name of the block, when it has one.
Schema details
Any of
Registered type of the block, when it has one.
Schema details
Any of
Additional properties are not allowed.
Blocks with no outgoing edge.
Schema details
3 fields
Block the finding is about.
Display name of the block, when it has one.
Schema details
Any of
Registered type of the block, when it has one.
Schema details
Any of
Additional properties are not allowed.
Blocks with neither an incoming nor an outgoing edge.
Schema details
3 fields
Block the finding is about.
Display name of the block, when it has one.
Schema details
Any of
Registered type of the block, when it has one.
Schema details
Any of
Additional properties are not allowed.
Branch and container ports that lead nowhere.
Schema details
5 fields
Block the finding is about.
Display name of the block, when it has one.
Schema details
Any of
Registered type of the block, when it has one.
Schema details
Any of
Source handle with nothing connected to it.
Human-readable name of the port.
Additional properties are not allowed.
Condition and router edges whose source handle names no real branch.
Schema details
5 fields
Block the finding is about.
Display name of the block, when it has one.
Schema details
Any of
Registered type of the block, when it has one.
Schema details
Any of
Source handle that does not match the block.
Why the handle is not valid for this block.
Additional properties are not allowed.
Edges pointing at a block that cannot legally receive them.
Schema details
5 fields
Block the edge leaves.
Display name of the source block.
Schema details
Any of
Handle the edge leaves from.
Schema details
Any of
Block the edge points at.
Why the target is not a legal destination.
Additional properties are not allowed.
Per-block configuration problems. The most actionable part of the report for a headless graph builder: a block missing a required field will fail at run time.
Schema details
5 fields
Block the finding is about.
Display name of the block, when it has one.
Schema details
Any of
Registered type of the block, when it has one.
Schema details
Any of
Required sub-block fields that resolve empty in the active mode.
Schema details
Values stranded on the inactive member of a canonical pair.
Schema details
4 fields
Canonical parameter the two sub-block modes share.
Sub-block the runtime reads, where the value should live.
Schema details
Any of
Sub-block holding the stranded value, which the runtime ignores.
What kind of value is stranded.
- enum
- ["credential","resource","other"]
Additional properties are not allowed.
Additional properties are not allowed.
Credential, resource, tool, and skill references that do not resolve; block-output references that will not work as written: a block that does not exist, or an output field the block does not have (reason unknown-field); and text outputs written unquoted in a JSON field (reason unquoted-json-string), which leave the field invalid JSON at run time unless the text is itself JSON. These values are still persisted; they are reported, not dropped.
Schema details
7 fields
Block the finding is about.
Display name of the block, when it has one.
Schema details
Any of
Registered type of the block, when it has one.
Schema details
Any of
Sub-block field holding the reference.
The reference, or references, that did not resolve.
Schema details
Any of
Schema details
What kind of entity the reference was expected to name.
- enum
- ["credential","resource","custom-tool","mcp-tool","skill","block-output"]
Why the reference does not resolve.
Additional properties are not allowed.
Table block filter and order fields checked against the bound table's live schema that name no column (nor the implicit id, createdAt, updatedAt). Such a run fails inside the block's error edge. A filter holding a <block.output> reference, or one that is not JSON, is not checked.
Schema details
5 fields
Block the finding is about.
Display name of the block, when it has one.
Schema details
Any of
Registered type of the block, when it has one.
Schema details
Any of
The filter or sort field that names no column.
Display name of the table the block is bound to.
Additional properties are not allowed.
Why a manual run from the editor's Run button would be refused before it starts: no enabled trigger it can start from, more than one API trigger, or a selected trigger with no outgoing connection. The API run endpoints do not apply these checks. null when no manual-run issue is reported: the run can begin, only a chat trigger can start the workflow, or the graph is empty (reported in notes instead).
Schema details
Any of
5 fields
Why the run is refused.
- enum
- ["no-trigger","multiple-api-triggers","trigger-not-connected"]
The error the manual run raises.
Trigger the run would start from, when the problem is that trigger.
Schema details
Any of
Display name of that trigger.
Schema details
Any of
Registered type of that trigger.
Schema details
Any of
Additional properties are not allowed.
Advisory notes about the report itself.
Schema details
Additional properties are not allowed.
Whether this request only evaluated. true means nothing was persisted; the outcome describes what a committed apply of the same body would produce.
Additional properties are not allowed.
Additional properties are not allowed.
Response example 1
Response headers
Maximum requests allowed in the current window.
- minimum
- 0
- maximum
- 9007199254740991
Requests remaining in the current window.
- minimum
- 0
- maximum
- 9007199254740991
ISO 8601 timestamp when the current rate-limit window resets.
- format
- date-time
- pattern
- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
400
The request is invalid. This includes a query parameter sent with no value (?limit=, ?search=), which is rejected rather than read as zero, empty, or the parameter default — omit the parameter instead.
Canonical error envelope returned by the public v2 API.
1 field
Canonical error details.
3 fields
Stable machine-readable error code.
Human-readable explanation of the error.
Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.
Schema details
Any of
Machine-readable cause and optional context for an actionable 403 response.
1 field
Stable cause code for an actionable 403 response.
- enum
- ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]
Additional context for this refusal.
Other structured context defined by the specific error.
Additional properties are not allowed.
Additional properties are not allowed.
401
The API credential is missing or invalid.
Canonical error envelope returned by the public v2 API.
1 field
Canonical error details.
3 fields
Stable machine-readable error code.
Human-readable explanation of the error.
Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.
Schema details
Any of
Machine-readable cause and optional context for an actionable 403 response.
1 field
Stable cause code for an actionable 403 response.
- enum
- ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]
Additional context for this refusal.
Other structured context defined by the specific error.
Additional properties are not allowed.
Additional properties are not allowed.
403
The caller lacks the rights this operation requires. When the cause is one a caller can act on, error.details.code names it. A resource in a workspace the caller cannot reach at all answers 404 instead, so absence and denial are indistinguishable.
Canonical error envelope returned by the public v2 API.
1 field
Canonical error details.
3 fields
Stable machine-readable error code.
Human-readable explanation of the error.
Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.
Schema details
Any of
Machine-readable cause and optional context for an actionable 403 response.
1 field
Stable cause code for an actionable 403 response.
- enum
- ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]
Additional context for this refusal.
Other structured context defined by the specific error.
Additional properties are not allowed.
Additional properties are not allowed.
404
The requested resource was not found.
Canonical error envelope returned by the public v2 API.
1 field
Canonical error details.
3 fields
Stable machine-readable error code.
Human-readable explanation of the error.
Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.
Schema details
Any of
Machine-readable cause and optional context for an actionable 403 response.
1 field
Stable cause code for an actionable 403 response.
- enum
- ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]
Additional context for this refusal.
Other structured context defined by the specific error.
Additional properties are not allowed.
Additional properties are not allowed.
409
The request conflicts with current resource state.
Canonical error envelope returned by the public v2 API.
1 field
Canonical error details.
3 fields
Stable machine-readable error code.
Human-readable explanation of the error.
Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.
Schema details
Any of
Machine-readable cause and optional context for an actionable 403 response.
1 field
Stable cause code for an actionable 403 response.
- enum
- ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]
Additional context for this refusal.
Other structured context defined by the specific error.
Additional properties are not allowed.
Additional properties are not allowed.
413
The request, or a resource collection it must materialize, exceeds the allowed size: an oversized request body, a generated artifact past the download ceiling, or a workspace folder tree too large to load in full.
Canonical error envelope returned by the public v2 API.
1 field
Canonical error details.
3 fields
Stable machine-readable error code.
Human-readable explanation of the error.
Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.
Schema details
Any of
Machine-readable cause and optional context for an actionable 403 response.
1 field
Stable cause code for an actionable 403 response.
- enum
- ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]
Additional context for this refusal.
Other structured context defined by the specific error.
Additional properties are not allowed.
Additional properties are not allowed.
415
The request uses an unsupported media type.
Canonical error envelope returned by the public v2 API.
1 field
Canonical error details.
3 fields
Stable machine-readable error code.
Human-readable explanation of the error.
Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.
Schema details
Any of
Machine-readable cause and optional context for an actionable 403 response.
1 field
Stable cause code for an actionable 403 response.
- enum
- ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]
Additional context for this refusal.
Other structured context defined by the specific error.
Additional properties are not allowed.
Additional properties are not allowed.
423
The resource is temporarily locked or unavailable; retry the request.
Canonical error envelope returned by the public v2 API.
1 field
Canonical error details.
3 fields
Stable machine-readable error code.
Human-readable explanation of the error.
Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.
Schema details
Any of
Machine-readable cause and optional context for an actionable 403 response.
1 field
Stable cause code for an actionable 403 response.
- enum
- ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]
Additional context for this refusal.
Other structured context defined by the specific error.
Additional properties are not allowed.
Additional properties are not allowed.
429
The caller exceeded the request rate limit.
Canonical error envelope returned by the public v2 API.
1 field
Canonical error details.
3 fields
Stable machine-readable error code.
Human-readable explanation of the error.
Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.
Schema details
Any of
Machine-readable cause and optional context for an actionable 403 response.
1 field
Stable cause code for an actionable 403 response.
- enum
- ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]
Additional context for this refusal.
Other structured context defined by the specific error.
Additional properties are not allowed.
Additional properties are not allowed.
Response headers
Seconds to wait before retrying, sent on 429 and 503. Add jitter rather than retrying at exactly this offset.
- minimum
- 0
- maximum
- 9007199254740991
500
An unexpected server error occurred.
Canonical error envelope returned by the public v2 API.
1 field
Canonical error details.
3 fields
Stable machine-readable error code.
Human-readable explanation of the error.
Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.
Schema details
Any of
Machine-readable cause and optional context for an actionable 403 response.
1 field
Stable cause code for an actionable 403 response.
- enum
- ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]
Additional context for this refusal.
Other structured context defined by the specific error.
Additional properties are not allowed.
Additional properties are not allowed.
503
A required service is temporarily unavailable. When present, Retry-After gives the minimum seconds to wait; add jitter before retrying. Check operation-specific guidance before repeating a change after an uncertain response.
Canonical error envelope returned by the public v2 API.
1 field
Canonical error details.
3 fields
Stable machine-readable error code.
Human-readable explanation of the error.
Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.
Schema details
Any of
Machine-readable cause and optional context for an actionable 403 response.
1 field
Stable cause code for an actionable 403 response.
- enum
- ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]
Additional context for this refusal.
Other structured context defined by the specific error.
Additional properties are not allowed.
Additional properties are not allowed.
Response headers
Seconds to wait before retrying, sent on 429 and 503. Add jitter rather than retrying at exactly this offset.
- minimum
- 0
- maximum
- 9007199254740991