{ "schema": "nlweb-v1", "site": { "id": "agined", "name": "Agined + Attestor", "homepage": "https://agined.com", "description": "Compliance-first audit trail platform (Agined) + cryptographic receipts as a service (Attestor). All customer-facing actions are programmatically reachable.", "version": "0.32.289-agined.1" }, "transport": { "mcp_endpoint": "https://mcp.a2pi.app/mcp", "rest_endpoint": "https://api.agined.com/api/v1" }, "intents": [ { "action_id": "account.session.list", "triggers": [ "List active sessions on this account." ], "example": "List active sessions.", "safety_level": "read", "confirmation_required": false }, { "action_id": "account.session.revoke", "triggers": [ "Revoke an active session by id (cannot be disabled — safety floor)." ], "example": "Kill an active session.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "account.profile.get", "triggers": [ "Get the authenticated account's profile." ], "example": "Read your profile.", "safety_level": "read", "confirmation_required": false }, { "action_id": "account.profile.update", "triggers": [ "Update account profile (display name, avatar URL)." ], "example": "Update display name.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "account.email.change", "triggers": [ "Request an email change. A verification email is sent to the new address; the change applies only after click-through." ], "example": "Start email change flow.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "account.email.change.pending", "triggers": [ "The email change currently in flight for this account, if any, and which address still has to confirm it." ], "example": "The new address confirmed; the old one has not.", "safety_level": "read", "confirmation_required": false }, { "action_id": "account.passkey.list", "triggers": [ "List registered passkeys." ], "example": "List passkeys.", "safety_level": "read", "confirmation_required": false }, { "action_id": "account.passkey.revoke", "triggers": [ "Revoke a registered passkey." ], "example": "Remove a passkey.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "account.locale.set", "triggers": [ "Set the account-level preferred locale (overrides browser default)." ], "example": "Switch UI language to German.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "account.display-preferences.set", "triggers": [ "Set the account-level theme and timezone." ], "example": "Switch to the dark theme.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "account.notifications.get", "triggers": [ "Read notification preferences." ], "example": "Read prefs.", "safety_level": "read", "confirmation_required": false }, { "action_id": "account.notifications.update", "triggers": [ "Update notification preferences." ], "example": "Turn on anomaly alerts.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "account.token.list", "triggers": [ "List your Personal Access Tokens (PATs)." ], "example": "List active PATs.", "safety_level": "read", "confirmation_required": false }, { "action_id": "account.token.revoke", "triggers": [ "Revoke a PAT (cannot be disabled — safety floor)." ], "example": "Revoke a PAT.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "account.oauth-grants.list", "triggers": [ "List active OAuth grants to third-party agents (Claude, ChatGPT, Gemini, etc.)." ], "example": "List active connected apps.", "safety_level": "read", "confirmation_required": false }, { "action_id": "account.oauth-grants.revoke", "triggers": [ "Revoke an OAuth grant. The third-party agent's tokens are immediately invalidated." ], "example": "Kill a connected app session.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "account.security-log.list", "triggers": [ "Read the account-level security log (logins, MFA, key issuance, anomalies)." ], "example": "Last 25 security events.", "safety_level": "read", "confirmation_required": false }, { "action_id": "account.delete", "triggers": [ "Schedule account deletion after a grace window (30 days by default). Organizations you solely own are scheduled with it; ones with other members are reported back instead. Requires WebAuthn step-up." ], "example": "Start account deletion with grace period; the shared org needs an ownership transfer first.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "org.get", "triggers": [ "Get the current organization's details." ], "example": "Read org metadata.", "safety_level": "read", "confirmation_required": false }, { "action_id": "org.update", "triggers": [ "Update organization name + locale." ], "example": "Rename the organization.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "org.locale.set", "triggers": [ "Set the organization-default locale (inherited by new workspaces)." ], "example": "Org-default locale → German.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "org.billing-state.get", "triggers": [ "Get the org's current billing state (plan, subscription status, add-ons)." ], "example": "Read billing state.", "safety_level": "read", "confirmation_required": false }, { "action_id": "org.member.list", "triggers": [ "List organization members." ], "example": "List org members.", "safety_level": "read", "confirmation_required": false }, { "action_id": "org.member.invite", "triggers": [ "Invite a new member to the organization. Sends a verification email." ], "example": "Invite a new member.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "org.member.remove", "triggers": [ "Remove a member from the organization. They lose access to all workspaces immediately." ], "example": "Remove a member.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "org.member.role.change", "triggers": [ "Change an org member's role." ], "example": "Promote to admin.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "org.invitations.list", "triggers": [ "List pending/expired invitations." ], "example": "List pending invites.", "safety_level": "read", "confirmation_required": false }, { "action_id": "org.invitations.resend", "triggers": [ "Resend a pending invitation (subject to 5-minute cooldown)." ], "example": "Resend invite.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "org.invitations.revoke", "triggers": [ "Revoke a pending invitation." ], "example": "Cancel pending invite.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "org.transfer-ownership", "triggers": [ "Transfer org ownership to another admin. Requires WebAuthn step-up + reason." ], "example": "Hand off org ownership.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "org.delete.schedule", "triggers": [ "Schedule organization deletion in 30 days. Cancellable within the grace window." ], "example": "Schedule org deletion.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "org.delete.cancel", "triggers": [ "Cancel a previously-scheduled org deletion (within grace)." ], "example": "Cancel scheduled deletion.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "org.audit.list", "triggers": [ "Read org-level audit log entries (admin actions, member changes, billing)." ], "example": "Read org audit log.", "safety_level": "read", "confirmation_required": false }, { "action_id": "org.sso.connections.list", "triggers": [ "List the organization's SSO connections (SAML/OIDC), with sealed secrets redacted to booleans." ], "example": "List SSO connections.", "safety_level": "read", "confirmation_required": false }, { "action_id": "org.sso.connections.upsert", "triggers": [ "Create or update a SAML/OIDC SSO connection. A provided OIDC client secret is sealed; SAML certificates are validated." ], "example": "Create an OIDC connection.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "org.sso.connections.delete", "triggers": [ "Delete an SSO connection by id (org-scoped)." ], "example": "Delete a connection.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "org.sso.domains.list", "triggers": [ "List the organization's captured SSO domains (verified state + the DNS TXT record to publish)." ], "example": "List SSO domains.", "safety_level": "read", "confirmation_required": false }, { "action_id": "org.sso.domains.create", "triggers": [ "Claim an email domain for SSO and mint its DNS TXT verification challenge." ], "example": "Claim acme.com.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "org.sso.domains.verify", "triggers": [ "Verify a claimed domain via a DNS-over-HTTPS TXT lookup (proof of control)." ], "example": "Verify domain control.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "org.sso.domains.enforcement", "triggers": [ "Toggle SSO enforcement for a verified domain (requires a verified domain + an active connection)." ], "example": "Require SSO for the domain.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "org.sso.domains.delete", "triggers": [ "Remove a captured SSO domain (org-scoped)." ], "example": "Delete a domain.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "org.sso.scim-tokens.list", "triggers": [ "List a connection's SCIM bearer tokens (hash-only; the raw token is never returned)." ], "example": "List SCIM tokens.", "safety_level": "read", "confirmation_required": false }, { "action_id": "org.sso.scim-tokens.mint", "triggers": [ "Mint a SCIM 2.0 bearer token for a connection. The RAW token is returned exactly once; only its hash is stored." ], "example": "Mint a SCIM token (shown once).", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "org.sso.scim-tokens.revoke", "triggers": [ "Revoke a SCIM bearer token by id." ], "example": "Revoke a SCIM token.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "workspace.list", "triggers": [ "List all workspaces in the current organization." ], "example": "List up to 10 workspaces in the active organization.", "safety_level": "read", "confirmation_required": false }, { "action_id": "workspace.get", "triggers": [ "Get the full state of a single workspace by id." ], "example": "Read the active workspace's full state.", "safety_level": "read", "confirmation_required": false }, { "action_id": "workspace.create", "triggers": [ "Create a new workspace in the current organization." ], "example": "Create an EU-bound workspace in Western Europe.", "safety_level": "billing_impacting", "confirmation_required": true }, { "action_id": "workspace.update", "triggers": [ "Update workspace settings (name, retention, locale, Tools controls)." ], "example": "Enable Tools auto-overage with a 3× cap.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "workspace.rename", "triggers": [ "Rename a workspace (convenience alias of workspace.update)." ], "example": "Rename a workspace.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "workspace.delete.schedule", "triggers": [ "Schedule a workspace for deletion in 30 days (grace period)." ], "example": "Schedule deletion with a 30-day grace.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "workspace.delete.cancel", "triggers": [ "Cancel a previously-scheduled workspace deletion (within grace)." ], "example": "Cancel deletion within the grace window.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "workspace.region.binding-proof", "triggers": [ "Download the OpenTimestamps proof of the workspace's region binding." ], "example": "Pull the region-binding OTS proof for offline verification.", "safety_level": "read", "confirmation_required": false }, { "action_id": "workspace.member.list", "triggers": [ "List members of a workspace with their roles." ], "example": "List workspace members.", "safety_level": "read", "confirmation_required": false }, { "action_id": "workspace.member.add", "triggers": [ "Add an organization member to a workspace with a specific role." ], "example": "Add a member.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "workspace.member.role.change", "triggers": [ "Change a workspace member's role." ], "example": "Promote a member to admin.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "workspace.member.remove", "triggers": [ "Remove a member from a workspace." ], "example": "Remove a workspace member.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "workspace.transfer-ownership", "triggers": [ "Transfer workspace ownership to another admin." ], "example": "Transfer ownership — destructive, requires confirmation.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "workspace.attestor.enable", "triggers": [ "Enable Attestor on a workspace (requires an org-level Attestor subscription)." ], "example": "Enable Attestor on a workspace.", "safety_level": "billing_impacting", "confirmation_required": true }, { "action_id": "workspace.attestor.disable", "triggers": [ "Disable Attestor on a workspace." ], "example": "Turn off Attestor on this workspace.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "workspace.regions.list", "triggers": [ "List the available regions a workspace can be created in." ], "example": "List all 21 supported regions for region picker UIs.", "safety_level": "read", "confirmation_required": false }, { "action_id": "billing.subscription.get", "triggers": [ "Get the org's current subscription." ], "example": "Read subscription.", "safety_level": "read", "confirmation_required": false }, { "action_id": "billing.subscription.upgrade", "triggers": [ "Upgrade to a higher tier. Prorates charges; takes effect immediately." ], "example": "Upgrade to Team.", "safety_level": "billing_impacting", "confirmation_required": true }, { "action_id": "billing.subscription.downgrade", "triggers": [ "Downgrade to a lower tier. Effective at next billing period." ], "example": "Downgrade scheduled for period end.", "safety_level": "billing_impacting", "confirmation_required": true }, { "action_id": "billing.subscription.cancel", "triggers": [ "Cancel subscription at current period end. Workspace remains accessible until then." ], "example": "Cancel at period end.", "safety_level": "billing_impacting", "confirmation_required": true }, { "action_id": "billing.subscription.reactivate", "triggers": [ "Reactivate a subscription that's been scheduled to cancel." ], "example": "Reactivate.", "safety_level": "billing_impacting", "confirmation_required": true }, { "action_id": "billing.invoices.list", "triggers": [ "List invoices." ], "example": "List invoices.", "safety_level": "read", "confirmation_required": false }, { "action_id": "billing.invoices.get", "triggers": [ "Get a single invoice." ], "example": "Read invoice.", "safety_level": "read", "confirmation_required": false }, { "action_id": "billing.invoices.download", "triggers": [ "Get a signed download URL for the invoice PDF." ], "example": "Download invoice PDF.", "safety_level": "read", "confirmation_required": false }, { "action_id": "billing.payment-method.get", "triggers": [ "Get the current default payment method (masked)." ], "example": "Read masked payment method.", "safety_level": "read", "confirmation_required": false }, { "action_id": "billing.payment-method.update-url", "triggers": [ "Get a signed URL to the hosted payment-method update page. The update happens there, not in Agined." ], "example": "Get the billing portal URL.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "billing.packs.list", "triggers": [ "List available top-up packs (runs, Number One queries, Tools calls)." ], "example": "Discover packs.", "safety_level": "read", "confirmation_required": false }, { "action_id": "billing.packs.purchase", "triggers": [ "Purchase a top-up pack." ], "example": "Buy a 1k-run pack — complete payment at checkoutUrl; the credit lands via webhook.", "safety_level": "billing_impacting", "confirmation_required": true }, { "action_id": "billing.auto-topup.get", "triggers": [ "Get auto-topup configuration." ], "example": "Read auto-topup config.", "safety_level": "read", "confirmation_required": false }, { "action_id": "billing.auto-topup.configure", "triggers": [ "Configure auto-topup. Fires when balance drops below threshold; capped at monthly USD limit." ], "example": "Enable auto-topup.", "safety_level": "billing_impacting", "confirmation_required": true }, { "action_id": "billing.cost-centers.list", "triggers": [ "List org cost centers (for tagging charges + per-cost-center invoicing)." ], "example": "List cost centers.", "safety_level": "read", "confirmation_required": false }, { "action_id": "billing.cost-centers.create", "triggers": [ "Create a cost center." ], "example": "Create cost center.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "billing.cost-centers.update", "triggers": [ "Update a cost center." ], "example": "Set monthly cap.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "billing.cost-centers.delete", "triggers": [ "Delete a cost center. Tagged charges keep historical tag." ], "example": "Delete.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "billing.notarian.subscribe", "triggers": [ "Subscribe to the Notarian add-on (per-tier subscription pricing)." ], "example": "Subscribe to Notarian.", "safety_level": "billing_impacting", "confirmation_required": true }, { "action_id": "billing.notarian.unsubscribe", "triggers": [ "Unsubscribe from Notarian at next billing period." ], "example": "Unsubscribe Notarian.", "safety_level": "billing_impacting", "confirmation_required": true }, { "action_id": "billing.retention-extension.unsubscribe", "triggers": [ "Cancel the paid retention extension. Coverage continues until the paid-through date." ], "example": "Cancel the retention extension; coverage runs to the paid-through date.", "safety_level": "billing_impacting", "confirmation_required": true }, { "action_id": "billing.multi-workspace.subscribe", "triggers": [ "Subscribe the organization to the multi-workspace add-on, allowing more than one workspace." ], "example": "Buy the multi-workspace add-on.", "safety_level": "billing_impacting", "confirmation_required": true }, { "action_id": "billing.multi-workspace.unsubscribe", "triggers": [ "Cancel the multi-workspace add-on at the end of the current period." ], "example": "Cancel the multi-workspace add-on.", "safety_level": "billing_impacting", "confirmation_required": true }, { "action_id": "billing.infinite-memory.subscribe", "triggers": [ "Subscribe to the Infinite Memory add-on for Number One ($19/mo on paid tiers)." ], "example": "Subscribe Infinite Memory.", "safety_level": "billing_impacting", "confirmation_required": true }, { "action_id": "billing.infinite-memory.unsubscribe", "triggers": [ "Unsubscribe Infinite Memory at next billing period." ], "example": "Unsubscribe Infinite Memory.", "safety_level": "billing_impacting", "confirmation_required": true }, { "action_id": "billing.retention-extension.subscribe", "triggers": [ "Subscribe to the universal paid retention extension. Convenience alias of retention.extension.subscribe." ], "example": "Subscribe to 3-year retention extension.", "safety_level": "billing_impacting", "confirmation_required": true }, { "action_id": "billing.attestor.tier.set", "triggers": [ "Set the Attestor subscription tier for the org." ], "example": "Set Attestor tier.", "safety_level": "billing_impacting", "confirmation_required": true }, { "action_id": "billing.attestor.tier.get", "triggers": [ "Get the current Attestor tier." ], "example": "Read Attestor tier.", "safety_level": "read", "confirmation_required": false }, { "action_id": "billing.attestor.top-up.purchase", "triggers": [ "Purchase an Attestor top-up pack (extra call quota for the current month)." ], "example": "Buy 100k Attestor calls.", "safety_level": "billing_impacting", "confirmation_required": true }, { "action_id": "billing.attestor.auto-overage.set", "triggers": [ "Configure auto-overage for an Attestor-enabled workspace." ], "example": "Enable auto-overage at 3× cap.", "safety_level": "billing_impacting", "confirmation_required": true }, { "action_id": "billing.attestor.billing-mode.set", "triggers": [ "Set the Attestor billing mode (combined vs separate subscription)." ], "example": "Separate subscriptions for Agined + Attestor.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "billing.attestor.usage.current", "triggers": [ "Get current Attestor usage for the org (calls used + remaining quota + auto-overage status)." ], "example": "Read current Attestor usage.", "safety_level": "read", "confirmation_required": false }, { "action_id": "billing.ledger-bundles.subscribe", "triggers": [ "Subscribe to the LedgerBundles add-on (per-tier subscription pricing)." ], "example": "Subscribe to LedgerBundles.", "safety_level": "billing_impacting", "confirmation_required": true }, { "action_id": "billing.ledger-bundles.unsubscribe", "triggers": [ "Unsubscribe from LedgerBundles at next billing period." ], "example": "Unsubscribe LedgerBundles.", "safety_level": "billing_impacting", "confirmation_required": true }, { "action_id": "keys.list", "triggers": [ "List workspace API keys (active + revoked filter)." ], "example": "List active keys.", "safety_level": "read", "confirmation_required": false }, { "action_id": "keys.get", "triggers": [ "Get a single workspace API key by id." ], "example": "Fetch one key.", "safety_level": "read", "confirmation_required": false }, { "action_id": "keys.issue", "triggers": [ "Issue a new workspace API key. Cleartext returned ONCE." ], "example": "Mint a new key; cleartext shown once.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "keys.revoke", "triggers": [ "Revoke a workspace API key. Propagates in ≤30s." ], "example": "Revoke a key.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "keys.rotate", "triggers": [ "Rotate a key: revoke the current value + issue a replacement with the same label + scopes. Cleartext returned ONCE." ], "example": "Rotate a key with 5-min grace.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "keys.scopes.list", "triggers": [ "List the available scope grants for workspace API keys." ], "example": "Discover scopes.", "safety_level": "read", "confirmation_required": false }, { "action_id": "keys.usage.get", "triggers": [ "Get usage statistics (calls + last-used + IP CIDRs) for a key over a time window." ], "example": "Read key usage.", "safety_level": "read", "confirmation_required": false }, { "action_id": "keys.last-used.get", "triggers": [ "Quick lookup: when was this key last used?" ], "example": "Lightweight last-used check.", "safety_level": "read", "confirmation_required": false }, { "action_id": "keys.attestor.list", "triggers": [ "Convenience: list only the Attestor-product workspace keys." ], "example": "List Attestor-only keys.", "safety_level": "read", "confirmation_required": false }, { "action_id": "keys.attestor.issue", "triggers": [ "Issue an Attestor-product workspace key (atst_*). Cleartext shown ONCE." ], "example": "Mint an Attestor key.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "keys.ingest-secret.list", "triggers": [ "List this workspace's ingest secrets (metadata only — never the secret value)." ], "example": "See which platforms can deliver.", "safety_level": "read", "confirmation_required": false }, { "action_id": "keys.ingest-secret.issue", "triggers": [ "Issue an ingest secret for a platform. Any active secret for that platform is revoked. Cleartext returned ONCE." ], "example": "Generate the secret a Vapi webhook signs with.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "keys.ingest-secret.revoke", "triggers": [ "Revoke an ingest secret without issuing a replacement. Deliveries for that platform then fail closed." ], "example": "Stop accepting deliveries for a platform.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "webhooks.list", "triggers": [ "List webhook endpoints for a workspace." ], "example": "List webhooks.", "safety_level": "read", "confirmation_required": false }, { "action_id": "webhooks.get", "triggers": [ "Get a single webhook endpoint." ], "example": "Read a webhook.", "safety_level": "read", "confirmation_required": false }, { "action_id": "webhooks.create", "triggers": [ "Register a new webhook endpoint. Returns the signing secret cleartext ONCE." ], "example": "Create + receive signing secret.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "webhooks.update", "triggers": [ "Update a webhook's URL, label, or event subscriptions." ], "example": "Narrow subscription set.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "webhooks.delete", "triggers": [ "Delete a webhook endpoint. Pending deliveries are abandoned." ], "example": "Remove a webhook.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "webhooks.enable", "triggers": [ "Enable or disable a webhook without deleting it." ], "example": "Disable temporarily.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "webhooks.test-fire", "triggers": [ "Fire a synthetic test event to a webhook to verify delivery + signature validation." ], "example": "Test webhook delivery.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "webhooks.events.list", "triggers": [ "List the event types this webhook can subscribe to (from the AsyncAPI 3 spec)." ], "example": "Discover event types.", "safety_level": "read", "confirmation_required": false }, { "action_id": "webhooks.events.replay", "triggers": [ "Replay missed events from a time window. Useful for recovering after webhook downtime." ], "example": "Replay events from yesterday.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "webhooks.signing-secret.rotate", "triggers": [ "Rotate the HMAC signing secret. Old secret valid for 24h grace." ], "example": "Rotate webhook signing secret.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "webhooks.deliveries.list", "triggers": [ "List delivery attempts for a webhook (success + failure history)." ], "example": "List delivery attempts.", "safety_level": "read", "confirmation_required": false }, { "action_id": "webhooks.deliveries.retry", "triggers": [ "Retry a specific failed delivery." ], "example": "Retry a delivery.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "alerts.list", "triggers": [ "List alert rules for a workspace." ], "example": "List alerts.", "safety_level": "read", "confirmation_required": false }, { "action_id": "alerts.get", "triggers": [ "Get a single alert rule." ], "example": "Read an alert rule.", "safety_level": "read", "confirmation_required": false }, { "action_id": "alerts.create", "triggers": [ "Create a new alert rule." ], "example": "Create alert.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "alerts.update", "triggers": [ "Update an alert's label / config / channels / enabled flag." ], "example": "Update alert.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "alerts.delete", "triggers": [ "Delete an alert rule." ], "example": "Delete alert.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "alerts.enable", "triggers": [ "Enable an alert rule." ], "example": "Enable.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "alerts.disable", "triggers": [ "Disable an alert rule without deleting it." ], "example": "Disable.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "alerts.test-fire", "triggers": [ "Fire a synthetic test of an alert to verify channels." ], "example": "Test fire.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "alerts.kinds.list", "triggers": [ "List all supported alert kinds + their config shapes + severity classifications." ], "example": "Discover alert kinds.", "safety_level": "read", "confirmation_required": false }, { "action_id": "alerts.history.list", "triggers": [ "List historical firings for a given alert rule." ], "example": "Read alert fire history.", "safety_level": "read", "confirmation_required": false }, { "action_id": "exports.list", "triggers": [ "List exports for a workspace." ], "example": "List exports.", "safety_level": "read", "confirmation_required": false }, { "action_id": "exports.get", "triggers": [ "Get a single export's status + metadata." ], "example": "Read export status.", "safety_level": "read", "confirmation_required": false }, { "action_id": "exports.request", "triggers": [ "Request a new compliance export. Returns the export id; status polls reveal readiness." ], "example": "Request a compliance bundle.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "exports.download", "triggers": [ "Get the signed download URL for a ready export (URL is time-bounded; SHA-256 included for integrity check)." ], "example": "Get signed download URL.", "safety_level": "read", "confirmation_required": false }, { "action_id": "exports.verify", "triggers": [ "Verify an export's Ed25519 signature + OTS Bitcoin proof. Offline-verifiable." ], "example": "Offline verify an export.", "safety_level": "read", "confirmation_required": false }, { "action_id": "exports.attestor.receipt-bundle.request", "triggers": [ "Request a portable Attestor-receipt bundle — JSON manifest + receipt files + public key JWK + verify README. Verifiable with @attestor/verify." ], "example": "Bundle Attestor receipts.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "exports.eu-ai-act.article-12.request", "triggers": [ "Request an EU AI Act Article 12 compliant log bundle (prEN 18229-1 + ISO/IEC DIS 24970 schema). Cannot be disabled — regulatory mandate." ], "example": "EU AI Act Art. 12 compliance export.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "exports.audit-log.request", "triggers": [ "Request a JSON or CSV export of the workspace audit log filtered by time + kind." ], "example": "Export audit log as CSV.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "exports.kinds.list", "triggers": [ "List the supported export kinds + their output formats + retention." ], "example": "Discover export kinds.", "safety_level": "read", "confirmation_required": false }, { "action_id": "exports.delete", "triggers": [ "Delete a completed export (frees R2 storage immediately)." ], "example": "Delete an export.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "retention.policy.get", "triggers": [ "Get the active retention policy for a workspace." ], "example": "Read retention policy.", "safety_level": "read", "confirmation_required": false }, { "action_id": "retention.policy.update", "triggers": [ "Update workspace retention days (within tier limits)." ], "example": "Extend retention via paid extension.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "retention.histogram.get", "triggers": [ "Get a histogram of record ages in the workspace (helps visualize what's near purge)." ], "example": "Read age distribution.", "safety_level": "read", "confirmation_required": false }, { "action_id": "retention.next-purge.preview", "triggers": [ "Preview which records will purge in the next cycle (live 1-Hz countdown on the dashboard)." ], "example": "Preview upcoming purge.", "safety_level": "read", "confirmation_required": false }, { "action_id": "retention.purge-history.list", "triggers": [ "List historical purge events with verification status." ], "example": "Read purge history.", "safety_level": "read", "confirmation_required": false }, { "action_id": "retention.extension.subscribe", "triggers": [ "Subscribe to the paid retention extension at the per-tier rate." ], "example": "Subscribe to 3-year retention extension.", "safety_level": "billing_impacting", "confirmation_required": true }, { "action_id": "retention.extension.get", "triggers": [ "Get the current retention extension subscription (if any)." ], "example": "Workspace has no extension subscription.", "safety_level": "read", "confirmation_required": false }, { "action_id": "retention.extension.update", "triggers": [ "Update the active retention extension (change duration)." ], "example": "Bump to 5-year retention.", "safety_level": "billing_impacting", "confirmation_required": true }, { "action_id": "retention.extension.cancel", "triggers": [ "Cancel the retention extension at the end of the current billing period." ], "example": "Cancel at period end.", "safety_level": "billing_impacting", "confirmation_required": true }, { "action_id": "retention.extension.rates.list", "triggers": [ "List the per-tier retention extension rates (USD cents per GB per month)." ], "example": "List per-tier rates.", "safety_level": "read", "confirmation_required": false }, { "action_id": "retention.policy.suggested-tier.get", "triggers": [ "Recommend a higher tier if the workspace's data growth + retention needs make extension uneconomical." ], "example": "Suggested upgrade.", "safety_level": "read", "confirmation_required": false }, { "action_id": "retention.audit.list", "triggers": [ "List retention-policy audit events (changes, purges, extensions)." ], "example": "Read retention audit.", "safety_level": "read", "confirmation_required": false }, { "action_id": "audit.workspace.list", "triggers": [ "List audit log entries for a workspace." ], "example": "Read workspace audit log.", "safety_level": "read", "confirmation_required": false }, { "action_id": "audit.workspace.get", "triggers": [ "Get a specific audit entry by id." ], "example": "Fetch a single entry.", "safety_level": "read", "confirmation_required": false }, { "action_id": "audit.workspace.search", "triggers": [ "Full-text search across a workspace's audit log." ], "example": "Search for any mention of an email in the audit log.", "safety_level": "read", "confirmation_required": false }, { "action_id": "audit.workspace.share", "triggers": [ "Generate a time-bounded share URL to an audit entry (for external auditors)." ], "example": "Share with auditor.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "audit.workspace.shares.list", "triggers": [ "List the audit share links minted for this workspace, with their expiry and revocation state." ], "example": "See what is still shared.", "safety_level": "read", "confirmation_required": false }, { "action_id": "audit.workspace.share.revoke", "triggers": [ "Revoke an audit share link immediately, before its expiry." ], "example": "Kill a leaked share.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "audit.custody.list", "triggers": [ "List custody chain entries for a workspace (hash-chained, Ed25519-signed)." ], "example": "Read custody chain.", "safety_level": "read", "confirmation_required": false }, { "action_id": "audit.custody.get", "triggers": [ "Get a custody entry by id (hash-chained via prevHash→entryHash; per-entry signature is optional — the Ed25519 seal covers a range, not each entry)." ], "example": "Fetch a custody entry.", "safety_level": "read", "confirmation_required": false }, { "action_id": "audit.tops.list", "triggers": [ "List Tops feed entries (hash-chained per entry; authenticity is the periodically Ed25519-signed + OTS Bitcoin-anchored SEAL ROOT — per-entry signature is null until its seal exists)." ], "example": "Read Tops feed.", "safety_level": "read", "confirmation_required": false }, { "action_id": "audit.tops.verify", "triggers": [ "Verify the hash chain of this workspace's Tops entries." ], "example": "Verify a Tops range end-to-end.", "safety_level": "read", "confirmation_required": false }, { "action_id": "audit.shadow-sessions.list", "triggers": [ "List Agined-staff shadow-mode sessions on a workspace." ], "example": "List Agined-staff shadow sessions.", "safety_level": "read", "confirmation_required": false }, { "action_id": "audit.shadow-sessions.get", "triggers": [ "Get full details + action feed of a shadow-mode session." ], "example": "Inspect a shadow session.", "safety_level": "read", "confirmation_required": false }, { "action_id": "audit.aggregate", "triggers": [ "Group + count audit entries by a dimension (kind, transport, outcome, agentClientId)." ], "example": "Group by transport.", "safety_level": "read", "confirmation_required": false }, { "action_id": "audit.kinds.list", "triggers": [ "List all audit-kind discriminator values supported by the platform." ], "example": "Discover audit kinds.", "safety_level": "read", "confirmation_required": false }, { "action_id": "audit.export.scoped", "triggers": [ "Request a scoped CSV/JSON export of audit entries matching filters. Returns a download URL when ready (signed, time-bounded)." ], "example": "Queue a compliance-bundle export.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "audit.outside-access.list", "triggers": [ "List entries representing access from outside the workspace's normal principals (admin reads, side-car reads, share-url access)." ], "example": "See every external touch on this workspace.", "safety_level": "read", "confirmation_required": false }, { "action_id": "audit.stream.list", "triggers": [ "List the workspace's SIEM/S3 audit-stream destinations (Splunk HEC / Datadog / webhook / S3), with sealed credentials masked." ], "example": "List audit-stream destinations.", "safety_level": "read", "confirmation_required": false }, { "action_id": "audit.stream.configure", "triggers": [ "Create or update a SIEM/S3 audit-stream destination. A provided vendor token / S3 secret / webhook secret is sealed at rest." ], "example": "Add a Splunk HEC destination.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "audit.stream.delete", "triggers": [ "Delete an audit-stream destination by id (workspace-scoped)." ], "example": "Delete a destination.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "tops.config.get", "triggers": [ "Get the Tops config for a specific scope (org, workspace, or actor)." ], "example": "Read scope config.", "safety_level": "read", "confirmation_required": false }, { "action_id": "tops.config.set", "triggers": [ "Set the Tops config for a scope. Forensic detail level requires explicit acknowledgement." ], "example": "Set scope config.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "tops.config.delete", "triggers": [ "Delete a scope-level Tops config (scope reverts to parent inheritance)." ], "example": "Delete scope config.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "tops.config.list", "triggers": [ "List Tops configs (all scopes in an org or workspace)." ], "example": "List configs.", "safety_level": "read", "confirmation_required": false }, { "action_id": "tops.config.cascade.resolve", "triggers": [ "Resolve the effective Tops config at a specific (org, workspace, actor) leaf — applies the leaf-wins cascade." ], "example": "Resolve effective config.", "safety_level": "read", "confirmation_required": false }, { "action_id": "tops.config.preset.apply", "triggers": [ "Apply one of the 3 presets (Minimal / Recommended / Forensic) to a scope." ], "example": "Apply recommended preset.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "tops.config.presets.list", "triggers": [ "List the 3 supported presets with their config shapes + tradeoff labels." ], "example": "Discover presets.", "safety_level": "read", "confirmation_required": false }, { "action_id": "tops.config.testbed.run", "triggers": [ "Test the cascade resolver against a synthetic actor id to preview what entries it would generate." ], "example": "Test cascade.", "safety_level": "read", "confirmation_required": false }, { "action_id": "tops.config.change-history.list", "triggers": [ "List Tops-config change events (audit cross-link)." ], "example": "Read config change history.", "safety_level": "read", "confirmation_required": false }, { "action_id": "tops.config.sparkline.get", "triggers": [ "Get a 30-day sparkline of Tops detail-level changes (visualizes forensic-cooldown nudge)." ], "example": "Sparkline data.", "safety_level": "read", "confirmation_required": false }, { "action_id": "tops.config.audit-cross-links.get", "triggers": [ "Get deep-links to the workspace audit log filtered by Tops-config-change events." ], "example": "Audit cross-link helper.", "safety_level": "read", "confirmation_required": false }, { "action_id": "tops.config.cooldown-status.get", "triggers": [ "Check if a scope is in the forensic cooldown window (auto-revert nudge)." ], "example": "Read cooldown state.", "safety_level": "read", "confirmation_required": false }, { "action_id": "tops.specimen.get", "triggers": [ "Read this workspace's public trust page settings. `null` when nothing has ever been published." ], "example": "Nothing published.", "safety_level": "read", "confirmation_required": false }, { "action_id": "tops.specimen.set", "triggers": [ "Claim or rename the workspace's public handle, and turn the page on or off." ], "example": "Claim the handle without publishing yet.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "tops.specimen.delete", "triggers": [ "Take the public page down and RELEASE the handle for anyone else to claim." ], "example": "Unpublish.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "referrals.code.get", "triggers": [ "Get your active referral code + share URL." ], "example": "Read your referral code.", "safety_level": "read", "confirmation_required": false }, { "action_id": "referrals.code.regenerate", "triggers": [ "Regenerate referral code. Old code stops working." ], "example": "Get a fresh referral code.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "referrals.share-message.set", "triggers": [ "Set the message shared alongside your referral link." ], "example": "Replace your share message.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "referrals.share.record", "triggers": [ "Record that you shared your referral link, and where." ], "example": "Record a share to Slack.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "referrals.list-sent", "triggers": [ "List referrals you have sent." ], "example": "List sent referrals.", "safety_level": "read", "confirmation_required": false }, { "action_id": "referrals.list-received", "triggers": [ "List referrals where you were the referee." ], "example": "List received referrals.", "safety_level": "read", "confirmation_required": false }, { "action_id": "referrals.balance.get", "triggers": [ "Get your current point balance + lifetime multiplier tier." ], "example": "Read point balance.", "safety_level": "read", "confirmation_required": false }, { "action_id": "referrals.funnel.get", "triggers": [ "Get conversion funnel analytics (sent → clicked → joined → redeemed)." ], "example": "Read funnel.", "safety_level": "read", "confirmation_required": false }, { "action_id": "referrals.redeem", "triggers": [ "Redeem a referral or voucher code." ], "example": "Redeem a code.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "referrals.spend", "triggers": [ "Spend points on a reward (run pack, add-on credit, Every.org charity, etc.)." ], "example": "Donate to charity.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "referrals.spend-products.list", "triggers": [ "List the products you can redeem points against." ], "example": "Discover spend products.", "safety_level": "read", "confirmation_required": false }, { "action_id": "referrals.ledger.list", "triggers": [ "List point transactions (earned + spent)." ], "example": "Read point ledger.", "safety_level": "read", "confirmation_required": false }, { "action_id": "number_one.conversation.create", "triggers": [ "Start a new Number One conversation." ], "example": "Start a new conversation.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "number_one.conversation.list", "triggers": [ "List your conversations (most recent first)." ], "example": "List conversations.", "safety_level": "read", "confirmation_required": false }, { "action_id": "number_one.conversation.get", "triggers": [ "Get a conversation's metadata + recent messages." ], "example": "Read a conversation.", "safety_level": "read", "confirmation_required": false }, { "action_id": "number_one.conversation.delete", "triggers": [ "Delete a conversation. Memory facts attached to it survive but lose conversation context." ], "example": "Delete a conversation.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "number_one.message.send", "triggers": [ "Send a user message in a Number One conversation. Returns the full buffered assistant turn." ], "example": "Send a message.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "number_one.message.list", "triggers": [ "List messages in a conversation." ], "example": "List messages.", "safety_level": "read", "confirmation_required": false }, { "action_id": "number_one.mode.set", "triggers": [ "Switch a conversation's mode (Calculator / Analyst / Admin)." ], "example": "Switch to Admin mode (requires step-up auth).", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "number_one.memory.list", "triggers": [ "List memory facts pinned in a workspace." ], "example": "List memory facts.", "safety_level": "read", "confirmation_required": false }, { "action_id": "number_one.memory.pin", "triggers": [ "Pin a memory fact so Number One reliably recalls it across conversations. Pass factId to re-pin an existing fact, or text (optionally with conversationId provenance) to create + pin a new one." ], "example": "Re-pin an existing fact.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "number_one.memory.unpin", "triggers": [ "Unpin a memory fact." ], "example": "Unpin.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "number_one.memory.erase", "triggers": [ "Permanently erase a memory-ledger turn's content (ADR-014 marker — the redaction cannot be undone). memoryId is a message id from message.list; pinned facts are managed via memory.unpin instead." ], "example": "Erase a remembered turn's content.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "number_one.memory.cap.get", "triggers": [ "Get the workspace's memory usage + cap. The ledger is byte-capped (Z-07); capBytes is -1 when the Infinite Memory add-on is active." ], "example": "Read memory usage + cap.", "safety_level": "read", "confirmation_required": false }, { "action_id": "number_one.llm-billing.get", "triggers": [ "Read whether this workspace's Number One calls run on Agined's LLM key (metered) or on its own provider key (BYOK, not metered)." ], "example": "Read the billing posture.", "safety_level": "read", "confirmation_required": false }, { "action_id": "number_one.llm-billing.set", "triggers": [ "Choose whether this workspace's Number One calls run on Agined's LLM key (metered) or on its own provider key (BYOK, not metered)." ], "example": "Run on our own key.", "safety_level": "billing_impacting", "confirmation_required": true }, { "action_id": "number_one.analyst.get", "triggers": [ "Read whether Analyst mode is enabled for this workspace." ], "example": "Is Analyst on?", "safety_level": "read", "confirmation_required": false }, { "action_id": "number_one.analyst.set", "triggers": [ "Turn Analyst mode on or off for everyone in this workspace." ], "example": "Disable Analyst for the workspace.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "number_one.assistant-posture.get", "triggers": [ "Read which posture the assistant runs in for this workspace — membrane-protected, in-boundary or off — and which model provider its calls go to." ], "example": "Read the assistant posture.", "safety_level": "read", "confirmation_required": false }, { "action_id": "number_one.assistant-posture.set", "triggers": [ "Choose the assistant's posture for this workspace, and which model provider its calls go to." ], "example": "Disable the assistant workspace-wide.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "attestor.attest.agent-call", "triggers": [ "Issue an Attestor receipt for an agent.call primitive (outbound API call by a customer's agent)." ], "example": "Attest an agent call.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "attestor.attest.content", "triggers": [ "Attest a content blob (text, image hash, document). Returns a signed receipt." ], "example": "Attest content.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "attestor.attest.llm", "triggers": [ "Attest an LLM inference (model + prompt hash + response hash + provider)." ], "example": "Attest LLM call.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "attestor.attest.commit", "triggers": [ "Attest a Git commit (commit hash + author + repo URL). Pairs with the @attestor/attest-commit GitHub Action." ], "example": "Attest a Git commit.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "attestor.deliver.webhook", "triggers": [ "Issue a receipt for an outbound webhook delivery attempt." ], "example": "Attest webhook delivery.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "attestor.monitor.http.add", "triggers": [ "Register a new HTTP monitor (1-minute minimum interval)." ], "example": "Register HTTP monitor.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "attestor.monitor.http.list", "triggers": [ "List HTTP monitors in a workspace." ], "example": "List monitors.", "safety_level": "read", "confirmation_required": false }, { "action_id": "attestor.monitor.http.run-now", "triggers": [ "Run a monitor check immediately (bypasses the scheduled interval)." ], "example": "Run a monitor check now.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "attestor.monitor.http.remove", "triggers": [ "Delete an HTTP monitor." ], "example": "Delete monitor.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "attestor.watch.dns.add", "triggers": [ "Register a DNS watch (detects record drift; signs every check as a receipt)." ], "example": "Register DNS watch.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "attestor.watch.dns.list", "triggers": [ "List DNS watches in a workspace." ], "example": "List DNS watches.", "safety_level": "read", "confirmation_required": false }, { "action_id": "attestor.watch.dns.remove", "triggers": [ "Delete a DNS watch." ], "example": "Delete DNS watch.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "attestor.watch.tls.add", "triggers": [ "Register a TLS certificate watch (detects cert changes; signs every check)." ], "example": "Register TLS watch.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "attestor.watch.tls.list", "triggers": [ "List TLS watches in a workspace." ], "example": "List TLS watches.", "safety_level": "read", "confirmation_required": false }, { "action_id": "attestor.watch.tls.remove", "triggers": [ "Delete a TLS watch." ], "example": "Delete TLS watch.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "attestor.receipt.list", "triggers": [ "List Attestor receipts for a workspace." ], "example": "List receipts.", "safety_level": "read", "confirmation_required": false }, { "action_id": "attestor.receipt.get", "triggers": [ "Get a single receipt with full body." ], "example": "Read a receipt.", "safety_level": "read", "confirmation_required": false }, { "action_id": "attestor.receipt.verify", "triggers": [ "Verify a receipt's Ed25519 signature against the published public key. Cannot be disabled." ], "example": "Verify a receipt.", "safety_level": "read", "confirmation_required": false }, { "action_id": "attestor.usage.current", "triggers": [ "Get current-period Attestor usage for a workspace (calls per primitive + budget consumed)." ], "example": "Read current usage.", "safety_level": "read", "confirmation_required": false }, { "action_id": "attestor.usage.historical", "triggers": [ "Get historical Attestor usage (per-day breakdown for a date range)." ], "example": "Read historical usage.", "safety_level": "read", "confirmation_required": false }, { "action_id": "attestor.subscription.get", "triggers": [ "Get workspace Attestor subscription state." ], "example": "Read subscription state.", "safety_level": "read", "confirmation_required": false }, { "action_id": "attestor.subscription.cancel", "triggers": [ "Cancel the Attestor subscription at the next billing period. Workspace's existing receipts remain accessible." ], "example": "Cancel Attestor subscription.", "safety_level": "billing_impacting", "confirmation_required": true }, { "action_id": "attestor.abuse-status.get", "triggers": [ "Get the current Attestor abuse status for a workspace." ], "example": "Read abuse status.", "safety_level": "read", "confirmation_required": false }, { "action_id": "attestor.abuse-status.appeal", "triggers": [ "Submit an appeal against an abuse-status flag or suspension." ], "example": "Submit abuse appeal.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "attestor.signing-key.get", "triggers": [ "Get the current active Attestor signing key id for the workspace's jurisdiction." ], "example": "Read signing key id.", "safety_level": "read", "confirmation_required": false }, { "action_id": "attestor.signing-key.list", "triggers": [ "List all signing keys (active + historical) usable to verify the workspace's receipts." ], "example": "List signing keys.", "safety_level": "read", "confirmation_required": false }, { "action_id": "attestor.signing-key.rotate-request", "triggers": [ "Request signing-key rotation (Enterprise tier dedicated keys only). Agined ops fulfils via key ceremony." ], "example": "Request key rotation.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "attestor.signing-key.public.get", "triggers": [ "Get the public-key JWK for a specific signing key id (for offline verification)." ], "example": "Read public key JWK.", "safety_level": "read", "confirmation_required": false }, { "action_id": "attestor.status.get", "triggers": [ "Get the Attestor subsystem health (per-jurisdiction Worker uptime, per-primitive error rate, last self-attestation receipt)." ], "example": "Read Attestor health.", "safety_level": "read", "confirmation_required": false }, { "action_id": "attestor.attestation-feed.get", "triggers": [ "Get the daily Attestor self-attestation receipt feed (Agined attesting to its own platform integrity)." ], "example": "Read self-attestation feed.", "safety_level": "read", "confirmation_required": false }, { "action_id": "starfleet.run", "triggers": [ "Post a run to a Starfleet spot actor (witness/council/historian/custodian/conscience/…) — observe + decide + anchor it in the workspace hash-chain." ], "example": "Witness a billing-agent run.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "starfleet.runs.list", "triggers": [ "List the workspace's Starfleet runs (actor IS the surface: witness | historian | custodian | conscience | …)." ], "example": "Recent witness runs.", "safety_level": "read", "confirmation_required": false }, { "action_id": "starfleet.actors.list", "triggers": [ "List the Starfleet roster (optionally for one version) with each actor's min tier." ], "example": "Discover v1 actors.", "safety_level": "read", "confirmation_required": false }, { "action_id": "starfleet.agents.list", "triggers": [ "List the workspace's posting agents (distinct agent DIDs across runs, with counts + last-seen)." ], "example": "Who's posting runs.", "safety_level": "read", "confirmation_required": false }, { "action_id": "starfleet.runs.verify-chain", "triggers": [ "Verify the integrity of the workspace's run hash-chain from a starting sequence." ], "example": "Prove the chain is intact.", "safety_level": "read", "confirmation_required": false }, { "action_id": "starfleet.runs.diff", "triggers": [ "Compare two Starfleet runs (classification + payload diff)." ], "example": "Diff two runs.", "safety_level": "read", "confirmation_required": false }, { "action_id": "starfleet.runs.replay", "triggers": [ "Reconstruct + re-verify a single run from its chain entry." ], "example": "Replay a run.", "safety_level": "read", "confirmation_required": false }, { "action_id": "ledger-bundles.snapshot.create", "triggers": [ "Create a signed LedgerBundles snapshot of the workspace's audit state (a paid action)." ], "example": "Seal a signed snapshot.", "safety_level": "billing_impacting", "confirmation_required": true }, { "action_id": "ledger-bundles.verify-chain", "triggers": [ "Verify the LedgerBundles transparency chain (free — a transparency guarantee)." ], "example": "Prove the chain is intact.", "safety_level": "read", "confirmation_required": false }, { "action_id": "ledger-bundles.anchors.list", "triggers": [ "List the LedgerBundles anchors (the published chain checkpoints)." ], "example": "List anchors.", "safety_level": "read", "confirmation_required": false }, { "action_id": "privacy.dsr.submit", "triggers": [ "Submit a data-subject request (GDPR / CCPA). Cannot be disabled — statutory right." ], "example": "File an Art. 15 access request.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "privacy.dsr.status", "triggers": [ "Check status of a submitted DSR. Cannot be disabled — statutory right." ], "example": "Status check.", "safety_level": "read", "confirmation_required": false }, { "action_id": "privacy.dsr.list", "triggers": [ "List all DSRs filed for this account / workspace." ], "example": "List your filed DSRs.", "safety_level": "read", "confirmation_required": false }, { "action_id": "privacy.export.request", "triggers": [ "Request a personal-data export (GDPR Art. 20 — data portability). Cannot be disabled." ], "example": "Art. 20 portability export.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "privacy.export.download", "triggers": [ "Get a signed download URL for a completed personal-data export." ], "example": "Download your export.", "safety_level": "read", "confirmation_required": false }, { "action_id": "privacy.subject-rights.list", "triggers": [ "List the data-subject rights Agined honours (GDPR, CCPA, LGPD) + the legal references." ], "example": "Read supported rights.", "safety_level": "read", "confirmation_required": false }, { "action_id": "support.tickets.list", "triggers": [ "List your support tickets." ], "example": "List your tickets.", "safety_level": "read", "confirmation_required": false }, { "action_id": "support.tickets.create", "triggers": [ "Open a new support ticket." ], "example": "Open a new ticket.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "support.tickets.get", "triggers": [ "Get a ticket's details + reply thread." ], "example": "Read ticket + thread.", "safety_level": "read", "confirmation_required": false }, { "action_id": "support.tickets.reply", "triggers": [ "Post a reply to a ticket." ], "example": "Reply to a ticket.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "support.tickets.close", "triggers": [ "Close a ticket (optionally with a reason)." ], "example": "Close a ticket.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "support.satisfaction.rate", "triggers": [ "Rate the support experience after a ticket closes — five dimensions, 1–5 each (ADR-034). A 2-or-below on any dimension triggers the feedback loop." ], "example": "Rate support 5/5 across the board.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "discovery.capabilities.get", "triggers": [ "Get the full action registry catalogue (machine-readable). Same content as `/api/v1/actions.json`." ], "example": "Discover all actions.", "safety_level": "read", "confirmation_required": false }, { "action_id": "discovery.version.get", "triggers": [ "Get the platform version + contracts package version + supported MCP / OpenAPI spec versions." ], "example": "Read all version + spec info.", "safety_level": "read", "confirmation_required": false }, { "action_id": "discovery.schema.get", "triggers": [ "Get the JSON Schema for a specific action's input or output." ], "example": "Get an action's JSON Schema.", "safety_level": "read", "confirmation_required": false }, { "action_id": "discovery.locales.list", "triggers": [ "List supported user-facing locales." ], "example": "Six supported locales.", "safety_level": "read", "confirmation_required": false }, { "action_id": "discovery.plans.list", "triggers": [ "List the available Agined + Tools subscription plans." ], "example": "List all plans.", "safety_level": "read", "confirmation_required": false }, { "action_id": "discovery.regions.list", "triggers": [ "List the 32 data-residency regions a workspace can be bound to." ], "example": "List all 32 regions (6 Cloudflare + 26 AWS Aurora).", "safety_level": "read", "confirmation_required": false }, { "action_id": "discovery.confirmation.token.verify", "triggers": [ "Verify a confirmation token is well-formed + still valid (cannot be disabled — safety floor)." ], "example": "Verify confirmation token.", "safety_level": "read", "confirmation_required": false }, { "action_id": "agents.identity.enroll", "triggers": [ "Enroll a new W3C DID Web agent identity under your principal." ], "example": "Enroll a workspace-scoped agent DID for CI signing. One-time secrets are minted by rotate, not enroll.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "agents.identity.list", "triggers": [ "List enrolled agent DIDs visible to the principal." ], "example": "List workspace-scoped agents.", "safety_level": "read", "confirmation_required": false }, { "action_id": "agents.identity.get", "triggers": [ "Get one enrolled agent DID with full document + rotation history." ], "example": "Read one agent DID.", "safety_level": "read", "confirmation_required": false }, { "action_id": "agents.identity.rotate", "triggers": [ "Rotate the signing key for an agent DID. Old key kept active for a cooldown period." ], "example": "Quarterly key rotation.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "agents.identity.revoke", "triggers": [ "Permanently revoke an agent DID. Cannot be undone; the DID id cannot be re-enrolled." ], "example": "Compromise-recovery revoke.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "agents.identity.did.resolve", "triggers": [ "Resolve any DID (did:web, did:key, did:peer) and return the resolution result envelope." ], "example": "Resolve a DID to its document.", "safety_level": "read", "confirmation_required": false }, { "action_id": "agents.identity.delegate", "triggers": [ "Issue an A2A delegation token granting a remote partner DID a scope subset on your behalf." ], "example": "Issue A2A delegation.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "agents.identity.delegate.revoke", "triggers": [ "Revoke an A2A delegation. Flips its bit in the published BitstringStatusList." ], "example": "Revoke an A2A delegation.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "agents.identity.delegate.verify", "triggers": [ "Verify a presented A2A delegation credential. Returns ok, or a structured reason." ], "example": "Verify a presented A2A delegation.", "safety_level": "read", "confirmation_required": false }, { "action_id": "agents.identity.authority.get", "triggers": [ "Resolve who an agent acts on behalf of, from verified identity rather than operator configuration." ], "example": "Resolve the on-whose-behalf value.", "safety_level": "read", "confirmation_required": false }, { "action_id": "agents.mandate.issue", "triggers": [ "Issue an AP2 Verifiable Credential mandate authorising an agent up to spend / volume limits." ], "example": "Issue an AP2 mandate.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "agents.mandate.list", "triggers": [ "List mandates issued under the principal." ], "example": "List mandates.", "safety_level": "read", "confirmation_required": false }, { "action_id": "agents.mandate.verify", "triggers": [ "Verify a presented mandate VC against an action request. Returns ok or a structured reason." ], "example": "Verify a mandate.", "safety_level": "read", "confirmation_required": false }, { "action_id": "agents.mandate.revoke", "triggers": [ "Revoke a mandate, and every A2A delegation the agent issued under it (the kill chain). Goes into the BitstringStatusList revocation register immediately." ], "example": "Revoking the mandate also withdrew one delegation the agent had issued — and named the two API keys it minted, which are STILL LIVE and must be revoked directly.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "agents.spiffe.bind", "triggers": [ "Bind a SPIFFE ID to an agent DID so its JWT-SVIDs can attest as that agent." ], "example": "Bind SPIFFE workload to agent.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "agents.spiffe.unbind", "triggers": [ "Unbind a SPIFFE ID from its agent DID so its SVIDs stop attesting as that agent." ], "example": "Stop a decommissioned workload attesting as this agent.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "agents.spiffe.workload.attest", "triggers": [ "Exchange a SPIFFE SVID for a short-lived DPoP-bound Agined session." ], "example": "Workload exchange.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "agents.trusted-roots.list", "triggers": [ "List partner organization DIDs the workspace accepts as A2A federation roots." ], "example": "List trusted A2A roots.", "safety_level": "read", "confirmation_required": false }, { "action_id": "agents.trusted-roots.add", "triggers": [ "Add a partner organization DID to the trusted-roots list for this workspace." ], "example": "Add federated root.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "agents.trusted-roots.remove", "triggers": [ "Remove a partner organization DID from the trusted-roots list for this workspace." ], "example": "Stop trusting a federated root.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "fabric.retrieve.signed", "triggers": [ "Query the fabric and seal the result as a signed-retrieval receipt — the query hash plus every returned record's content hash, so a grounded claim can be proved after the fact." ], "example": "Ground a claim on policy clauses, provably.", "safety_level": "billing_impacting", "confirmation_required": true }, { "action_id": "fabric.memory.snapshot", "triggers": [ "Snapshot the fabric's records as a signed memory-attestation receipt — entry count, Merkle root over every entry's content hash, and the provenance window — so an export can be verified without trusting the exporter." ], "example": "Make an agent's memory portable and independently checkable.", "safety_level": "billing_impacting", "confirmation_required": true }, { "action_id": "fabric.sources.catalog", "triggers": [ "List the connectable source catalog — each source's category, purpose, auth method, and the engine classes it contributes." ], "example": "Browse developer-tool sources.", "safety_level": "read", "confirmation_required": false }, { "action_id": "fabric.connections.connect", "triggers": [ "Connect a catalog source (BYO credentials) into the fabric. The connection's records broadcast to every subscribing product." ], "example": "Connect Jira — an OAuth source stays pending until its oauth/start → callback completes.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "fabric.connections.list", "triggers": [ "List the workspace's fabric connections with their sync health." ], "example": "List connections.", "safety_level": "read", "confirmation_required": false }, { "action_id": "fabric.connections.sync", "triggers": [ "Enqueue an on-demand sync + re-extraction of a fabric connection." ], "example": "Sync now.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "fabric.connections.revoke", "triggers": [ "Revoke a fabric connection — purges its extracted records per the platform's data-handling terms." ], "example": "Revoke + purge.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "fabric.webhooks.list", "triggers": [ "List the workspace's inbound webhook endpoints, with which sources can push and whether each scheme binds the body." ], "example": "What can push, and what has.", "safety_level": "read", "confirmation_required": false }, { "action_id": "fabric.webhooks.open", "triggers": [ "Open an inbound webhook endpoint for a connection — returns the signing secret ONCE." ], "example": "Open an endpoint for a GitHub connection.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "fabric.webhooks.revoke", "triggers": [ "Revoke an inbound webhook endpoint — deliveries to it stop immediately." ], "example": "Stop accepting pushes.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "fabric.records.query", "triggers": [ "Query extracted records by kind / source / subscriber — the universal read every product (and agent) uses to consume the fabric." ], "example": "Read policy clauses across all sources.", "safety_level": "read", "confirmation_required": false }, { "action_id": "fabric.subscriptions.matrix", "triggers": [ "Return the fabric subscription matrix — which product consumes which record kinds, and how many products each kind powers." ], "example": "Introspect the matrix.", "safety_level": "read", "confirmation_required": false }, { "action_id": "actionflow.flows.list", "triggers": [ "List the workspace's ActionFlow flows." ], "example": "List flows.", "safety_level": "read", "confirmation_required": false }, { "action_id": "actionflow.flows.run", "triggers": [ "Run a flow — trigger an execution through the bounded graph engine." ], "example": "Run the incident flow.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "actionflow.flows.publish", "triggers": [ "Publish a flow (make the current draft the live version)." ], "example": "Publish a flow.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "actionflow.flows.deprecate", "triggers": [ "Retire a published flow. It stops running on its triggers; its execution history is kept." ], "example": "Retire a published flow.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "actionflow.templates.list", "triggers": [ "List the ActionFlow starter templates." ], "example": "Browse templates.", "safety_level": "read", "confirmation_required": false }, { "action_id": "actionflow.templates.instantiate", "triggers": [ "Instantiate a template into a new draft flow in the workspace." ], "example": "Create a flow from a template.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "actionflow.executions.list", "triggers": [ "List recent ActionFlow executions." ], "example": "List executions.", "safety_level": "read", "confirmation_required": false }, { "action_id": "lens.list", "triggers": [ "List the available compliance-evidence lenses." ], "example": "Browse lenses.", "safety_level": "read", "confirmation_required": false }, { "action_id": "lens.execute", "triggers": [ "Execute a lens over the audit chain — produces a signed compliance-evidence bundle (a paid action)." ], "example": "Run a GDPR lens.", "safety_level": "billing_impacting", "confirmation_required": true }, { "action_id": "lens.validate", "triggers": [ "Validate a lens definition (dry-run; no evidence bundle, no charge)." ], "example": "Validate a lens.", "safety_level": "read", "confirmation_required": false }, { "action_id": "lens.results.list", "triggers": [ "List prior lens-execution results (the evidence-bundle history)." ], "example": "List evidence bundles.", "safety_level": "read", "confirmation_required": false }, { "action_id": "lens.custom.list", "triggers": [ "List the custom lenses this workspace has authored." ], "example": "Browse the workspace's own lenses.", "safety_level": "read", "confirmation_required": false }, { "action_id": "lens.custom.get", "triggers": [ "Read one custom lens definition." ], "example": "Read one.", "safety_level": "read", "confirmation_required": false }, { "action_id": "lens.custom.create", "triggers": [ "Author a custom lens. The runtime sanitises the definition and refuses an invalid one with the specific errors." ], "example": "Author a lens.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "lens.custom.update", "triggers": [ "Replace a custom lens definition." ], "example": "Revise a lens.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "lens.custom.delete", "triggers": [ "Delete a custom lens. Its past results keep the definition hash they were produced under." ], "example": "Remove a lens the workspace authored.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "lens.marketplace.list", "triggers": [ "Browse the lens marketplace, with what this workspace has published and installed." ], "example": "What is available, and what I have.", "safety_level": "read", "confirmation_required": false }, { "action_id": "lens.marketplace.publish", "triggers": [ "Publish one of the workspace's own custom lenses at its pinned version. Enterprise only." ], "example": "Share a lens.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "lens.marketplace.unpublish", "triggers": [ "Withdraw a listing. It leaves the catalogue; workspaces that already installed it keep the lens." ], "example": "Stop offering it.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "lens.marketplace.install", "triggers": [ "Install a listing into this workspace as a custom lens, pinned to the published version." ], "example": "Take a shared lens.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "lens.marketplace.uninstall", "triggers": [ "Remove an installed lens and its install receipt together — the inverse of install." ], "example": "Give a shared lens back.", "safety_level": "destructive", "confirmation_required": true }, { "action_id": "notarian.snapshot.create", "triggers": [ "Create a signed Notarian snapshot of the workspace's audit state (a paid action)." ], "example": "Seal a signed snapshot.", "safety_level": "billing_impacting", "confirmation_required": true }, { "action_id": "notarian.verify-chain", "triggers": [ "Verify the Notarian transparency chain (free — a transparency guarantee)." ], "example": "Prove the chain is intact.", "safety_level": "read", "confirmation_required": false }, { "action_id": "notarian.anchors.list", "triggers": [ "List the Notarian anchors (the published chain checkpoints)." ], "example": "List anchors.", "safety_level": "read", "confirmation_required": false }, { "action_id": "witness.frameworks.list", "triggers": [ "List the supported agent-framework catalog (~180 frameworks) with status, category, and integration pattern — the platform-wide registry, not product-scoped." ], "example": "All stable frameworks.", "safety_level": "read", "confirmation_required": false }, { "action_id": "witness.frameworks.get", "triggers": [ "Get one agent framework's catalog entry (support status, integration pattern, SDK package, docs)." ], "example": "LangChain's catalog entry.", "safety_level": "read", "confirmation_required": false }, { "action_id": "witness.patterns.list", "triggers": [ "List the 9 integration patterns an agent runtime can attach through (SDK, webhook, OAuth polling, cloud event, OTel, MCP server, LLM proxy, browser instrument, proprietary)." ], "example": "The pattern catalog.", "safety_level": "read", "confirmation_required": false }, { "action_id": "witness.subscriptions.get", "triggers": [ "Get the Witness-Fabric subscription matrix — which products consume which record event classes from the neutral stream." ], "example": "The WITNESS_SUBSCRIPTIONS routing matrix.", "safety_level": "read", "confirmation_required": false }, { "action_id": "witness.records.list", "triggers": [ "List the workspace's adapter-captured agent records from the neutral Witness-Fabric store (chain-free read — product-independent; no enrollment required)." ], "example": "Latest CrewAI records.", "safety_level": "read", "confirmation_required": false }, { "action_id": "witness.records.post", "triggers": [ "Post an adapter record directly onto the neutral Witness-Fabric plane (stored chain-free + fanned out to subscribing products; NOT anchored in Agined's Tops chain — use the ingest lane for evidentiary anchoring)." ], "example": "Neutral-plane record post.", "safety_level": "mutation", "confirmation_required": true }, { "action_id": "witness.records.stats", "triggers": [ "Aggregate stats over the workspace's neutral witness stream (totals + per-framework / per-pattern / per-event counts)." ], "example": "Stream aggregates for dashboards.", "safety_level": "read", "confirmation_required": false } ], "meta": { "generated_at": "2026-11-10T21:32:07.834Z", "contracts_version": "0.32.289-agined.1", "intent_count": 337 } }