Beta module namespace
sessions
Beta routes may change with notice and are NOT covered by the 24-month stable window of the core contract.
Every module route is enumerated with method, path, auth and required permission; request/response schemas are not published for the beta surface.
157 operations
| Method | Path | Required permission | Authentication | Summary |
|---|---|---|---|---|
| get | /v1/m/sessions/channels | sessions:channel:read | Bearer token | Lists the active Channels of the selected workspace that the current caller may read, with the caller's own current local grant bits, without changing any state. |
| post | /v1/m/sessions/channels | sessions:channel:write | Bearer token | Creates an active Channel with only the explicit initial grants supplied by an authorized caller; no grant is implied. |
| patch | /v1/m/sessions/channels | sessions:channel:admin | Bearer token | Updates one Channel under conditional-write semantics while preserving the irreversible application-sealed content boundary. |
| get | /v1/m/sessions/channels/administration | sessions:channel:admin | Bearer token | Lists the Channels of the selected workspace that the current caller may administer, each with the strong Channel ETag the existing mutations take as their precondition, without changing any state. |
| get | /v1/m/sessions/channels/{id} | sessions:channel:read | Bearer token | Returns one Channel only after current core and local read authorization. |
| get | /v1/m/sessions/channels/{id}/grants | sessions:channel:admin | Bearer token | Returns one administrable Channel, its precondition ETag and a bounded page of the stored grant generations the requested filters select, without opening content or changing any state. |
| post | /v1/m/sessions/channels/{id}/grants | sessions:channel:admin | Bearer token | Adds one explicit, optionally expiring grant generation. |
| post | /v1/m/sessions/channels/{id}/grants/{grant_id}/revoke | sessions:channel:admin | Bearer token | Revokes one active grant without deleting its history. |
| post | /v1/m/sessions/decision-requests/{id}/responses | sessions:decision-request:write | Bearer token | Resolves or dismisses a decision request with current authority. |
| get | /v1/m/sessions/decisions | sessions:decision:read | Bearer token | sessions module route (requires sessions:decision:read) |
| post | /v1/m/sessions/decisions | sessions:decision:write | Bearer token | sessions module route (requires sessions:decision:write) |
| get | /v1/m/sessions/decisions/{id} | sessions:decision:read | Bearer token | sessions module route (requires sessions:decision:read) |
| post | /v1/m/sessions/decisions/{id}/revoke | sessions:decision:admin | Bearer token | sessions module route (requires sessions:decision:admin) |
| get | /v1/m/sessions/deliveries/{id} | sessions:delivery:read | Bearer token | Opens one authorized Delivery for its exact user, agent, or session recipient. |
| post | /v1/m/sessions/deliveries/{id}/ack | sessions:delivery:write | Bearer token | Acknowledges one exact Delivery with CAS and idempotent receipt semantics. |
| get | /v1/m/sessions/deliveries/{id}/handoff | sessions:delivery:read | Bearer token | Opens the offer context of one exact Delivery for its own recipient. |
| post | /v1/m/sessions/handoffs | sessions:message-send:write | Bearer token | Creates the carrier and WorkItem offer atomically without changing ownership. |
| post | /v1/m/sessions/handoffs/{id}/responses | sessions:handoff-response:write | Bearer token | Accepts or rejects an offered Handoff; accept atomically transfers ownership and fences the old lease. |
| get | /v1/m/sessions/inbox | sessions:delivery:read | Bearer token | Lists an authenticated principal's exact mailbox without advancing or acknowledging it. |
| get | /v1/m/sessions/inbox/cursors/personal/{recipient} | sessions:delivery:read | Bearer token | Mints an opaque navigation token without advancing durable cursor state. |
| put | /v1/m/sessions/inbox/cursors/personal/{recipient} | sessions:delivery:write | Bearer token | Rescans current Delivery authority and conditionally advances the personal cursor and barriers. |
| get | /v1/m/sessions/inbox/handoffs | sessions:delivery:read | Bearer token | Lists the handoff offers addressed to the authenticated recipient without opening their content. |
| get | /v1/m/sessions/leases | sessions:lease:read | Bearer token | sessions module route (requires sessions:lease:read) |
| get | /v1/m/sessions/live | sessions:live:read | Bearer token | Lists live sessions, most-recently-active first. |
| get | /v1/m/sessions/live/by-id/{live_ref} | sessions:live:read | Bearer token | Returns the live operation of one session row by its opaque live_ref, whichever channel it was observed through. |
| get | /v1/m/sessions/live/by-id/{live_ref}/timeline | sessions:live:read | Bearer token | Returns the timeline of exactly one session row by its live_ref: a scoped row by the events written with that reference, a legacy row by its legacy events. |
| get | /v1/m/sessions/live/{ref} | sessions:live:read | Bearer token | Returns the live operation of the LEGACY row of one session by its bare external reference; a profile-scoped row is never returned here — read it by its live_ref. |
| get | /v1/m/sessions/live/{ref}/timeline | sessions:live:read | Bearer token | Returns the LEGACY timeline of one session by its bare external reference — the events that carry no live_ref — in chronological (ingestion) order, keyset-paginated by the time-ordered row id. |
| post | /v1/m/sessions/messages/send | sessions:message-send:write | Bearer token | Publishes one governed direct Message and required Delivery. |
| get | /v1/m/sessions/messages/{id} | sessions:message:read | Bearer token | Opens one authorized user Message after its exact carrier checks. |
| get | /v1/m/sessions/protocol-binding-specs | sessions:protocol-binding:read | Bearer token | Lists protocol binding spec generations in one workspace. |
| post | /v1/m/sessions/protocol-binding-specs | sessions:protocol-binding:write | Bearer token | Records a new draft generation of a protocol binding spec. |
| get | /v1/m/sessions/protocol-binding-specs/{id} | sessions:protocol-binding:read | Bearer token | Returns one immutable protocol binding spec generation. |
| post | /v1/m/sessions/protocol-binding-specs/{id}/activate | sessions:protocol-binding:admin | Bearer token | Makes one spec generation the active desired state for its binding. |
| post | /v1/m/sessions/protocol-binding-specs/{id}/disable | sessions:protocol-binding:admin | Bearer token | Stops one spec generation from being the active desired state. |
| get | /v1/m/sessions/protocol-bindings | sessions:protocol-binding:read | Bearer token | Lists the protocol bindings visible to the caller, filtered and paginated by the query. |
| get | /v1/m/sessions/protocol-bindings/{id} | sessions:protocol-binding:read | Bearer token | Returns one protocol binding in the caller's tenant. |
| post | /v1/m/sessions/protocol-bindings/{id}/reconcile | sessions:protocol-binding:write | Bearer token | Drives one binding towards its desired state. |
| get | /v1/m/sessions/provider-accounts | sessions:account:read | Bearer token | Lists the tenant's named provider accounts, optionally narrowed by environment, driver and state; a profile nobody has named is never listed. |
| post | /v1/m/sessions/provider-accounts | sessions:account:write | Bearer token | Creates a provider account: the server builds its home on this node in two phases and registers the account that owns it, under the given name or a generated one. |
| get | /v1/m/sessions/provider-accounts/{ref} | sessions:account:read | Bearer token | Returns one provider account by its reference, without its paths; a profile nobody has named is not an account and answers not found. |
| patch | /v1/m/sessions/provider-accounts/{ref} | sessions:account:write | Bearer token | Edits the account's name, display label and/or color; a rename changes only the name, never the reference, home or launch configuration, and an empty display label or color clears that field. |
| post | /v1/m/sessions/provider-accounts/{ref}/adopt | sessions:account:write | Bearer token | Names an existing provider profile as an account, under the given name or a generated one; the database decides whether the name is free, and the home is recorded as shared isolation. |
| get | /v1/m/sessions/provider-profiles | sessions:profile:read | Bearer token | Lists the tenant's provider profiles as references and labels, never paths. |
| post | /v1/m/sessions/provider-profiles | sessions:profile:write | Bearer token | Registers a provider profile for a configuration home on this node's execution environment; the homes are validated on the server and must already exist. |
| get | /v1/m/sessions/provider-profiles/readiness | sessions:profile:read | Bearer token | Answers whether a new session can start on each tool now: what it would run on (its own login, or a key or local model from Providers), or a stable code and the one sentence that says why not (not installed, nothing to run on, a refused key, an unreadable sign-in); it creates nothing. |
| get | /v1/m/sessions/provider-profiles/resolve | sessions:profile:read | Bearer token | Answers what a new session of a driver would run on, without creating anything: the tool's own login when it is signed in, otherwise the key or local model from Providers that the resolve rule picks, or the sentence that says what to add. |
| post | /v1/m/sessions/provider-profiles/resolve | sessions:profile:write | Bearer token | Answers which provider profile a new session of a driver uses on this node: the tool's own login when it is signed in, otherwise a key or local model from Providers; it reuses a matching profile or creates one. |
| get | /v1/m/sessions/provider-profiles/{ref} | sessions:profile:read | Bearer token | Returns one provider profile by its reference, without its paths. |
| patch | /v1/m/sessions/provider-profiles/{ref} | sessions:profile:write | Bearer token | Renames a provider profile and/or moves it between active and disabled; driver, environment and homes are immutable and retirement has its own route. |
| get | /v1/m/sessions/provider-profiles/{ref}/configuration | sessions:profile:admin | Bearer token | Returns the stored canonical homes of one provider profile; this is the only read that exposes paths, and it never exposes a credential value. |
| get | /v1/m/sessions/provider-profiles/{ref}/host-tools | sessions:profile:read | Bearer token | Reports the official provider CLI candidates this node observes for one provider profile, grouped into closed codes; it installs nothing, probes nothing and authorizes nothing. |
| get | /v1/m/sessions/provider-profiles/{ref}/launch-readiness | sessions:profile:read | Bearer token | Reports the LOCAL launch requirements observed for one provider profile under one transport and isolation, with the checks this read cannot make left explicitly unknown; it starts nothing, mints nothing and authorizes nothing. |
| get | /v1/m/sessions/provider-profiles/{ref}/models | sessions:profile:read | Bearer token | Lists the models and effort levels that the installed tool or bound provider of one provider profile reports now, cached for two minutes; it sends no prompt, starts no conversation and returns no credential. |
| post | /v1/m/sessions/provider-profiles/{ref}/retire | sessions:profile:admin | Bearer token | Retires a provider profile for good: the id stays, its history stays, and the home becomes free for a new profile id. |
| get | /v1/m/sessions/provider-source-bindings | sessions:profile-binding:read | Bearer token | Lists the source-to-profile bindings of the tenant, optionally narrowed to one profile. |
| post | /v1/m/sessions/provider-source-bindings | sessions:profile-binding:write | Bearer token | Dedicates one configured source, at the exact revision this node has applied, to a provider profile; administering the source is checked through the composition port. |
| get | /v1/m/sessions/provider-source-bindings/{ref} | sessions:profile-binding:read | Bearer token | Returns one source-to-profile binding by its reference. |
| post | /v1/m/sessions/provider-source-bindings/{ref}/revoke | sessions:profile-binding:admin | Bearer token | Revokes a source-to-profile binding; events already attributed under it keep their provenance and later observations through that source are no longer attributed to the profile. |
| get | /v1/m/sessions/providers | sessions:provider:read | Bearer token | Lists the tenant's registered providers as kinds, names and hints, never a credential. |
| post | /v1/m/sessions/providers | sessions:provider:write | Bearer token | Registers one provider credential; the engine seals the value and returns only a four-character hint. |
| get | /v1/m/sessions/providers/{ref} | sessions:provider:read | Bearer token | Returns one registered provider by its reference, without its credential. |
| patch | /v1/m/sessions/providers/{ref} | sessions:provider:write | Bearer token | Renames a provider, changes its endpoint and/or rotates its credential in place. |
| post | /v1/m/sessions/providers/{ref}/revoke | sessions:provider:admin | Bearer token | Withdraws a provider credential for good; the record keeps its id so the sessions it authorized still read truthfully. |
| post | /v1/m/sessions/providers/{ref}/test | sessions:provider:write | Bearer token | Asks the provider which models it serves with the registered credential; it sends no completion and spends nothing. |
| get | /v1/m/sessions/runs | sessions:run:read | Bearer token | sessions module route (requires sessions:run:read) |
| post | /v1/m/sessions/runs | sessions:run:write | Bearer token | sessions module route (requires sessions:run:write) |
| get | /v1/m/sessions/runs/{ref} | sessions:run:read | Bearer token | sessions module route (requires sessions:run:read) |
| delete | /v1/m/sessions/runs/{ref} | sessions:run:admin | Bearer token | sessions module route (requires sessions:run:admin) |
| get | /v1/m/sessions/runs/{ref}/activity | sessions:run:read | Bearer token | sessions module route (requires sessions:run:read) |
| get | /v1/m/sessions/runs/{ref}/activity/agents/{agent} | sessions:run:read | Bearer token | sessions module route (requires sessions:run:read) |
| post | /v1/m/sessions/runs/{ref}/archive | sessions:run:write | Bearer token | Archives the run for every reader, idempotently: an archived run keeps its first archived_at. |
| delete | /v1/m/sessions/runs/{ref}/archive | sessions:run:write | Bearer token | Unarchives the run, idempotently. |
| get | /v1/m/sessions/runs/{ref}/attach | sessions:run:read | Bearer token | Streams a live session's bridged I/O as server-sent events, replaying from an optional ?from=<seq> cursor. |
| post | /v1/m/sessions/runs/{ref}/attachments | sessions:run:write | Bearer token | Stores one image with a session, to be sent with its next message. |
| get | /v1/m/sessions/runs/{ref}/attachments/{id} | sessions:run:read | Bearer token | Returns an image stored with a session, as it was uploaded. |
| get | /v1/m/sessions/runs/{ref}/changes | sessions:run:read | Bearer token | Lists the files in the run's folder that changed since the run started, newest first. |
| get | /v1/m/sessions/runs/{ref}/changes/file | sessions:run:read | Bearer token | Returns the current text of one file in the run's folder, or with rev=HEAD the text git HEAD holds for it (?path=, relative to the folder; at most 256 KiB; 404 when the folder has no readable git history or HEAD has no such file). |
| post | /v1/m/sessions/runs/{ref}/cleanup | sessions:run:admin | Bearer token | sessions module route (requires sessions:run:admin) |
| get | /v1/m/sessions/runs/{ref}/commands | sessions:run:write | Bearer token | Lists the commands, skills and agents the session's tool reports. |
| get | /v1/m/sessions/runs/{ref}/diff | sessions:run:read | Bearer token | Lists the paths the run's worktree branch changed since it left the workspace's current commit. |
| get | /v1/m/sessions/runs/{ref}/diff/file | sessions:run:read | Bearer token | Returns one path of the run's worktree branch at the base and at the branch tip (?path=, relative to the repository's top folder; each side keeps the workspace's read limit and the 64 KiB Git output cap). |
| post | /v1/m/sessions/runs/{ref}/done | sessions:run:read | Bearer token | Marks the run done for the caller, idempotently. |
| delete | /v1/m/sessions/runs/{ref}/done | sessions:run:read | Bearer token | Removes the caller's done mark, idempotently. |
| get | /v1/m/sessions/runs/{ref}/events | sessions:run:read | Bearer token | sessions module route (requires sessions:run:read) |
| get | /v1/m/sessions/runs/{ref}/git | sessions:run:read | Bearer token | sessions module route (requires sessions:run:read) |
| post | /v1/m/sessions/runs/{ref}/git/branch | sessions:run:write | Bearer token | sessions module route (requires sessions:run:write) |
| post | /v1/m/sessions/runs/{ref}/git/commit | sessions:run:write | Bearer token | sessions module route (requires sessions:run:write) |
| post | /v1/m/sessions/runs/{ref}/git/stage | sessions:run:write | Bearer token | sessions module route (requires sessions:run:write) |
| post | /v1/m/sessions/runs/{ref}/git/unstage | sessions:run:write | Bearer token | sessions module route (requires sessions:run:write) |
| get | /v1/m/sessions/runs/{ref}/handoff | sessions:run:read | Bearer token | sessions module route (requires sessions:run:read) |
| post | /v1/m/sessions/runs/{ref}/handoff | sessions:run:write | Bearer token | sessions module route (requires sessions:run:write) |
| post | /v1/m/sessions/runs/{ref}/input | sessions:run:write | Bearer token | sessions module route (requires sessions:run:write) |
| post | /v1/m/sessions/runs/{ref}/interrupt | sessions:run:write | Bearer token | Cancels the active provider turn of a live session and keeps its owned process running; it is the non-terminal control, /stop remains the terminal one, and the optional body decides which control plane answers — absent, it is the legacy interrupt of a non-work run; with a positive work_lease_fence, it is the fenced control this work-bound run's input and stop already use. |
| get | /v1/m/sessions/runs/{ref}/messages | sessions:run:read | Bearer token | sessions module route (requires sessions:run:read) |
| post | /v1/m/sessions/runs/{ref}/move | sessions:run:write | Bearer token | sessions module route (requires sessions:run:write) |
| put | /v1/m/sessions/runs/{ref}/name | sessions:run:write | Bearer token | Renames the run; an empty name clears it. |
| put | /v1/m/sessions/runs/{ref}/peers | sessions:run:write | Bearer token | Stores one operator choice on the existing run row. |
| post | /v1/m/sessions/runs/{ref}/pin | sessions:run:read | Bearer token | Pins the run for the caller. |
| delete | /v1/m/sessions/runs/{ref}/pin | sessions:run:read | Bearer token | Removes the caller's pin, idempotently. |
| get | /v1/m/sessions/runs/{ref}/preview | sessions:run:read | Bearer token | Lists the loopback ports the run's own processes listen on, which a browser preview can open; a run not live on this node has none. |
| post | /v1/m/sessions/runs/{ref}/preview | sessions:run:write | Bearer token | Opens a browser preview of one port the run listens on and returns its URL, which expires within the hour and when the session stops. |
| post | /v1/m/sessions/runs/{ref}/resume | sessions:run:write | Bearer token | sessions module route (requires sessions:run:write) |
| post | /v1/m/sessions/runs/{ref}/snooze | sessions:run:read | Bearer token | Snoozes the run for the caller until a moment still to come, or moves the moment of a snooze already set. |
| delete | /v1/m/sessions/runs/{ref}/snooze | sessions:run:read | Bearer token | Ends the caller's snooze, idempotently. |
| post | /v1/m/sessions/runs/{ref}/stop | sessions:run:write | Bearer token | sessions module route (requires sessions:run:write) |
| get | /v1/m/sessions/stream | sessions:live:read | Bearer token | Serves the live operation as server-sent events. |
| get | /v1/m/sessions/templates | sessions:template:read | Bearer token | sessions module route (requires sessions:template:read) |
| post | /v1/m/sessions/templates | sessions:template:write | Bearer token | sessions module route (requires sessions:template:write) |
| get | /v1/m/sessions/templates/{id} | sessions:template:read | Bearer token | sessions module route (requires sessions:template:read) |
| put | /v1/m/sessions/templates/{id} | sessions:template:write | Bearer token | sessions module route (requires sessions:template:write) |
| delete | /v1/m/sessions/templates/{id} | sessions:template:admin | Bearer token | sessions module route (requires sessions:template:admin) |
| post | /v1/m/sessions/templates/{id}/apply | sessions:template:read | Bearer token | sessions module route (requires sessions:template:read) |
| post | /v1/m/sessions/templates/{id}/duplicate | sessions:template:write | Bearer token | sessions module route (requires sessions:template:write) |
| get | /v1/m/sessions/tool-rings | sessions:run:admin | Bearer token | Returns HTTP 501 with business_required because tool version rings require Business; no ring is read or changed. |
| put | /v1/m/sessions/tool-rings/{driver} | sessions:run:admin | Bearer token | Returns HTTP 501 with business_required because tool version rings require Business; no ring is read or changed. |
| post | /v1/m/sessions/tool-rings/{driver}/promote | sessions:run:admin | Bearer token | Returns HTTP 501 with business_required because tool version rings require Business; no ring is read or changed. |
| post | /v1/m/sessions/tool-rings/{driver}/rollback | sessions:run:admin | Bearer token | Returns HTTP 501 with business_required because tool version rings require Business; no ring is read or changed. |
| post | /v1/m/sessions/work-events/{event_id}/replay | sessions:work:admin | Bearer token | sessions module route (requires sessions:work:admin) |
| get | /v1/m/sessions/work-items | sessions:work:read | Bearer token | sessions module route (requires sessions:work:read) |
| post | /v1/m/sessions/work-items | sessions:work:write | Bearer token | sessions module route (requires sessions:work:write) |
| get | /v1/m/sessions/work-items/{id} | sessions:work:read | Bearer token | sessions module route (requires sessions:work:read) |
| patch | /v1/m/sessions/work-items/{id} | sessions:work:write | Bearer token | sessions module route (requires sessions:work:write) |
| get | /v1/m/sessions/work-items/{id}/acceptance | sessions:work:read | Bearer token | sessions module route (requires sessions:work:read) |
| post | /v1/m/sessions/work-items/{id}/acceptance | sessions:work:write | Bearer token | sessions module route (requires sessions:work:write) |
| patch | /v1/m/sessions/work-items/{id}/acceptance/{criterion_id} | sessions:work:write | Bearer token | sessions module route (requires sessions:work:write) |
| post | /v1/m/sessions/work-items/{id}/assignments | sessions:work:admin | Bearer token | sessions module route (requires sessions:work:admin) |
| get | /v1/m/sessions/work-items/{id}/dependencies | sessions:work:read | Bearer token | sessions module route (requires sessions:work:read) |
| post | /v1/m/sessions/work-items/{id}/dependencies | sessions:work:write | Bearer token | sessions module route (requires sessions:work:write) |
| delete | /v1/m/sessions/work-items/{id}/dependencies/{dep_id} | sessions:work:write | Bearer token | sessions module route (requires sessions:work:write) |
| get | /v1/m/sessions/work-items/{id}/events | sessions:work:read | Bearer token | sessions module route (requires sessions:work:read) |
| get | /v1/m/sessions/work-items/{id}/lease | sessions:lease:read | Bearer token | sessions module route (requires sessions:lease:read) |
| post | /v1/m/sessions/work-items/{id}/lease/acquire | sessions:lease:write | Bearer token | sessions module route (requires sessions:lease:write) |
| post | /v1/m/sessions/work-items/{id}/lease/clock-rebase | sessions:lease:admin | Bearer token | sessions module route (requires sessions:lease:admin) |
| post | /v1/m/sessions/work-items/{id}/lease/release | sessions:lease:write | Bearer token | sessions module route (requires sessions:lease:write) |
| post | /v1/m/sessions/work-items/{id}/lease/renew | sessions:lease:write | Bearer token | sessions module route (requires sessions:lease:write) |
| post | /v1/m/sessions/work-items/{id}/lease/revoke | sessions:lease:admin | Bearer token | sessions module route (requires sessions:lease:admin) |
| post | /v1/m/sessions/work-items/{id}/lease/takeover | sessions:lease:admin | Bearer token | sessions module route (requires sessions:lease:admin) |
| post | /v1/m/sessions/work-items/{id}/transitions | sessions:work:write | Bearer token | sessions module route (requires sessions:work:write) |
| get | /v1/m/sessions/work-stream | sessions:work:read | Bearer token | sessions module route (requires sessions:work:read) |
| get | /v1/m/sessions/workspaces | sessions:workspace:read | Bearer token | sessions module route (requires sessions:workspace:read) |
| post | /v1/m/sessions/workspaces | sessions:workspace:admin | Bearer token | sessions module route (requires sessions:workspace:admin) |
| get | /v1/m/sessions/workspaces/{ref} | sessions:workspace:read | Bearer token | sessions module route (requires sessions:workspace:read) |
| delete | /v1/m/sessions/workspaces/{ref} | sessions:workspace:admin | Bearer token | sessions module route (requires sessions:workspace:admin) |
| patch | /v1/m/sessions/workspaces/{ref} | sessions:workspace:admin | Bearer token | Changes a workspace's read-only host folders or DLP mode. |
| get | /v1/m/sessions/workspaces/{ref}/files | sessions:workspace:read | Bearer token | sessions module route (requires sessions:workspace:read) |
| delete | /v1/m/sessions/workspaces/{ref}/files | sessions:workspace:write | Bearer token | sessions module route (requires sessions:workspace:write) |
| post | /v1/m/sessions/workspaces/{ref}/files/dir | sessions:workspace:write | Bearer token | sessions module route (requires sessions:workspace:write) |
| post | /v1/m/sessions/workspaces/{ref}/files/move | sessions:workspace:write | Bearer token | sessions module route (requires sessions:workspace:write) |
| get | /v1/m/sessions/workspaces/{ref}/files/raw | sessions:workspace:read | Bearer token | sessions module route (requires sessions:workspace:read) |
| put | /v1/m/sessions/workspaces/{ref}/files/raw | sessions:workspace:write | Bearer token | sessions module route (requires sessions:workspace:write) |
| get | /v1/m/sessions/workspaces/{ref}/files/stat | sessions:workspace:read | Bearer token | sessions module route (requires sessions:workspace:read) |
| get | /v1/m/sessions/workspaces/{ref}/project-config | sessions:workspace:admin | Bearer token | Lists the repo-resident agent configuration of a registered folder that runs programs or redirects traffic, with the SHA-256 of that flagged part and whether a person approved it; the files are read and never executed. |
| post | /v1/m/sessions/workspaces/{ref}/project-config/approve | sessions:workspace:admin | Bearer token | Records that a person approved the SHA-256 of a folder's flagged agent configuration, so sessions of the tools that read it may start until one character of it changes. |
| put | /v1/m/sessions/workspaces/{ref}/setup-command | sessions:workspace:admin | Bearer token | Stores the exact setup command text of one folder, or clears it when the text is empty. |
| post | /v1/m/sessions/workspaces/{ref}/setup-command/approve | sessions:workspace:admin | Bearer token | Records a person's approval of the setup command text whose SHA-256 is posted, and refuses with 409 when the stored text no longer has that hash. |
| post | /v1/m/sessions/workspaces/{ref}/wiki | sessions:workspace:admin | Bearer token | sessions module route (requires sessions:workspace:admin) |