Runtime execution policy and bearer tokens for /v1 and MCP clients.
List runtime API token summaries.
List runtime API token summaries. › Responses
JSON response.
idRuntime token identifier.
nameUser-facing token label.
allowedActionsAction allow rules applied to this stored runtime token.
blockedActionsAction block rules applied to this stored runtime token.
allowedProxiesProvider proxies explicitly granted to this token. An empty list grants no proxy access.
allowedConnectionsStable connection IDs granted to this stored runtime token. An empty list is unrestricted connection access. IDs are opaque values returned by the connection APIs. Virtual no_auth connections do not require grants.
createdAtCreation timestamp.
lastUsedAtLast successful use timestamp.
Create a runtime API token.
The plaintext token is returned once. Only a hash is stored locally. Policy request bodies must not exceed 262144 bytes.
Create a runtime API token. › Request Body
nameUser-facing token label.
allowedActionsOptional action allow rules for the new token.
blockedActionsOptional action block rules for the new token.
allowedProxiesOptional provider proxy grants for the new token. Omit or leave empty to deny proxy access.
allowedConnectionsOptional stable connection IDs granted to the new token. Omit or leave empty for unrestricted connection access. A non-empty list matches exact opaque IDs returned by the connection APIs. Virtual no_auth connections do not require grants.
Create a runtime API token. › Responses
JSON response.
tokenPlaintext runtime bearer token. Store it now.
Runtime API token summary. Plaintext tokens and token hashes are not returned.
Replace one stored runtime token's permissions.
Policy request bodies must not exceed 262144 bytes.
Replace one stored runtime token's permissions. › Request Body
allowedActionsAction allow rules for this token.
blockedActionsAction block rules for this token.
allowedProxiesProvider proxies explicitly granted to this token. An empty list grants no proxy access.
allowedConnectionsStable connection IDs granted to this stored token. An empty list is unrestricted connection access. A non-empty list matches exact opaque IDs returned by the connection APIs. Virtual no_auth connections do not require grants.
Replace one stored runtime token's permissions. › Responses
JSON response.
idRuntime token identifier.
nameUser-facing token label.
allowedActionsAction allow rules applied to this stored runtime token.
blockedActionsAction block rules applied to this stored runtime token.
allowedProxiesProvider proxies explicitly granted to this token. An empty list grants no proxy access.
allowedConnectionsStable connection IDs granted to this stored runtime token. An empty list is unrestricted connection access. IDs are opaque values returned by the connection APIs. Virtual no_auth connections do not require grants.
createdAtCreation timestamp.
lastUsedAtLast successful use timestamp.
Read deployment and persisted Runtime policy layers.
Read deployment and persisted Runtime policy layers. › Responses
JSON response.
One complete action and proxy policy layer.
One complete action and proxy policy layer.
updatedAtLast Runtime policy update timestamp, when configured.
Replace the persisted Runtime action and proxy policy.
Deployment policy remains read-only. Block rules take precedence and non-empty allowlists intersect. Policy request bodies must not exceed 262144 bytes.
Replace the persisted Runtime action and proxy policy. › Request Body
allowedActionsAction allow rules.
blockedActionsAction block rules.
allowedProxiesProxy service allow rules.
blockedProxiesProxy service block rules.
Replace the persisted Runtime action and proxy policy. › Responses
JSON response.
One complete action and proxy policy layer.
One complete action and proxy policy layer.
updatedAtLast Runtime policy update timestamp, when configured.