Schemas

Generated from the published OpenAPI document. Operation pages link here by schema name.

AgentRevokeLimits

What this verb reaches and what it does not. Served with every 200 so the limit travels with the act.

Field	Type	Required	Description
`does_not_stop`	`string`	yes	—
`issue`	`string`	yes	—
`stops`	array of `string`	yes	—

GatewayPaymentResult

Field	Type	Required	Description
`audit`	array of object	yes	—
`requestId`	`string`	yes	—
`status`	`"completed"` \| `"denied"` \| `"requires-approval"` \| `"failed"`	yes	—
`wallet`	object	no	—

WHO triggered this spend, recorded on the receipt and read back from it. Optional, and absence is a real answer: a spend that sends no actor records null, and nothing is ever inferred from agent_id — that field names the agent the mandate was SIGNED for, which is an authority, not an event. A person acting through WhatsApp under an agent's mandate and the agent acting unattended are the same row without this field.

Type: object | object

Policy

Field	Type	Required	Description
`agents`	array of `string`	yes	—
`config`	object	yes	—
`createdAt`	`string (date-time)`	yes	—
`enabled`	`boolean`	yes	—
`id`	`string`	yes	—
`name`	`string`	yes	—
`order`	`number`	yes	—
`tools`	array of `string`	yes	—
`type`	`"deny"` \| `"budget"` \| `"rate-limit"` \| `"time-window"` \| `"approval-required"`	yes	—
`updatedAt`	`string (date-time)`	yes	—

PolicyCreate

Field	Type	Required	Description
`agents`	array of `string`	no	—
`config`	—	no	—
`enabled`	`boolean`	no	—
`name`	`string`	yes	—
`tools`	array of `string`	no	—
`type`	`"deny"` \| `"budget"` \| `"rate-limit"` \| `"time-window"` \| `"approval-required"`	yes	—

PolicyEvaluation

Field	Type	Required	Description
`agentId`	`string`	yes	—
`approvalId`	`string,null`	yes	—
`decidedAt`	`string,null (date-time)`	yes	—
`decidedBy`	`string,null`	yes	—
`decision`	`"allow"` \| `"deny"` \| `"approval_required"`	yes	—
`denialReason`	`string,null`	yes	—
`estimatedCost`	`number,null`	yes	The cost the evaluation was judged on, for an evaluation answered by a budget rule: the number added to the agent's budget counter, or that would have passed the limit on a `budget_exceeded` denial. It is in the unit the rule's `dailyLimit` and `monthlyLimit` are written in, which for a payment is MAJOR units of BRL (a Pix of R$ 25,00 is `25`, not `2500`); it carries no currency. `null` for an evaluation that priced nothing (rate limits, approvals, denials by name) and for every evaluation recorded before this field existed. `0` is a cost of zero, not a missing one.
`id`	`string`	yes	—
`projectId`	`string,null`	yes	—
`ruleId`	`string,null`	yes	—
`ruleName`	`string,null`	yes	—
`timestamp`	`string (date-time)`	yes	—
`toolName`	`string`	yes	—

PolicyReorder

Field	Type	Required	Description
`ids`	array of `string`	yes	—

PolicyUpdate

Field	Type	Required	Description
`agents`	array of `string`	no	—
`config`	—	no	—
`enabled`	`boolean`	no	—
`name`	`string`	no	—
`tools`	array of `string`	no	—
`type`	`"deny"` \| `"budget"` \| `"rate-limit"` \| `"time-window"` \| `"approval-required"`	no	—

ServerCatalogRow

Field	Type	Required	Description
`auth_type`	`string`	yes	—
`category`	`string`	yes	—
`connect_fields`	`integer`	yes	How many fields this provider's connect form has: the length of `fields` on its auth-schema. 0 for oauth and none.
`connectable`	`boolean`	yes	Whether the dashboard can connect this provider itself: a credential form with at least one field that `POST /v1/connections` accepts, or an oauth provider with an authorization config. False for `none`, which needs no connection, for a form type whose catalog row declares no refs, and for Coinbase CDP (`cdp`, `jwt_ecdsa`) while the deployment holds CDP self-serve connect.
`country`	`string`	yes	—
`description`	`string,null`	yes	—
`description_pt_br`	`string,null`	yes	`description` in Brazilian Portuguese, a faithful translation kept in the catalog. Null where the catalog has none; read `description` then.
`engine_provisionable`	`boolean`	yes	Has an engine provisioning descriptor AND is not quarantined.
`engine_status`	`"none"` \| `"available"` \| `"quarantined"`	yes	Carries the reason `engine_provisionable` is false.
`id`	`string`	yes	—
`name`	`string`	yes	—
`pkg`	`string`	yes	—
`provider_docs_url`	`string,null`	no	—
`provider_homepage`	`string,null`	no	—
`provider_logo_fallback_url`	`string,null`	no	—
`provider_logo_url`	`string,null`	no	—
`sandbox_available`	`boolean`	no	—
`sandbox_url`	`string,null`	no	—
`status`	`string`	yes	—
`subaccount_provisionable`	`boolean`	yes	—
`tools_count`	`integer`	yes	—

Session

Field	Type	Required	Description
`closed_at`	`string,null (date-time)`	no	—
`created_at`	`string (date-time)`	yes	—
`id`	`string`	yes	`ses_`-prefixed
`org_id`	`string`	yes	—
`project_id`	`string`	yes	—
`servers`	array of `string`	yes	—
`status`	`"active"` \| `"closed"` \| `"error"`	yes	—
`user_id`	`string`	yes	—

SpendApproval

The hash of what the caller says a person approved: items_hash for this spend's lines, and for a batch batch_hash over the whole presented list. When present it is SEALED into the receipt's signed chain as its own link (chain version 4), so it cannot be stripped or altered afterwards without breaking both receipt_sig and receipt_sig_ed25519, and the receipt reads return it. It is a SEALED CLAIM by the caller, NOT a server-side approval check. The server only validates the shape; it never interprets the value, never compares it with anything and never refuses a spend because of it. It proves that this payment was sealed together with this hash, so whoever holds the approval artifact can recompute the hash and hold it against the receipt. It does not prove that anybody approved anything, or who. A malformed value, or a key other than these two, is refused with invalid_approval_hash before anything is read, held or sent. Part of what makes two requests with one attempt_id the same payment: a repeat with a different approval is attempt_id_conflict.

Field	Type	Required	Description
`batch_hash`	`string`	no	A SHA-256 digest in lowercase hex, optionally prefixed `sha256:`. Sealed exactly as sent.
`items_hash`	`string`	yes	A SHA-256 digest in lowercase hex, optionally prefixed `sha256:`. Sealed exactly as sent.

SpendOutcome

Field	Type	Required	Description
`attempt_id`	`string`	yes	The attempt this payment settled under: the `attempt_id` sent, or the fresh one minted when none was. Presenting it again reads this outcome instead of paying again.
`audit`	array of —	yes	The lifecycle steps, in order, each with a timestamp and an outcome.
`idempotent_replay`	`boolean`	yes	True when this `attempt_id` had already settled and this is its recorded outcome, answered again: every other field is the ORIGINAL response, verbatim, and nothing was sent, held, sealed or published by this call. False on the call that settled it.
`mandate`	object	yes	—
`payment`	object	yes	—
`receipt`	`object,null`	yes	The sealed Control Record. Null when there was no consumer secret to sign it with.
`requestId`	`string`	yes	—
`status`	`"completed"`	yes	—
`wallet`	object	yes	—

SpendQuote

The offer the agent approved. When present it is signed into the receipt, and at close the price and the payee are compared against what actually settled. A divergence is RECORDED on the receipt; it does not abort settlement.

Field	Type	Required	Description
`at`	`string (date-time)`	no	When the offer was presented, RFC 3339 with an offset, in UTC years 0001-9999. Sealed into the receipt's chain as that instant in UTC with milliseconds. Anything else is refused with `invalid_receipt_timestamp` before anything is read, held or sent.
`payee`	`string`	yes	—
`price_minor`	`integer`	yes	—
`resource`	`string`	yes	—
`seller`	`string`	yes	—
`session_id`	`string`	no	—

TedDestination

The destination of a TED, the Brazilian same-day bank wire. Present this object on a spend to send a wire instead of a Pix: its presence is what switches the rail, and what makes the three TED requirements on those operations bind. Money leaves the consumer's own sub-account, never a pooled one.

Field	Type	Required	Description
`account`	`string`	yes	Account, including the check digit.
`account_type`	`"CC"` \| `"CI"` \| `"PG"` \| `"PP"`	no	Checking, investment, payment or savings. This is the TED product's OWN enum, different from the Pix account enum (`CACC`, `SLRY`, `SVGS`, `TRAN`): they are distinct endpoints and distinct products at the provider.
`bank`	`string`	yes	ISPB of the destination institution, digits only.
`branch`	`string`	yes	Branch, with no separate check digit.
`client_finality`	`string`	no	The banking partner's purpose code. Defaults to `1`, a generic transfer.
`name`	`string`	yes	Name of the destination account holder.
`person_type`	`"F"` \| `"J"`	no	A natural person or a legal entity.
`tax_id`	`string`	yes	CPF or CNPJ of the destination account holder.

ToolCall

Field	Type	Required	Description
`called_at`	`string (date-time)`	yes	—
`duration_ms`	`integer,null`	yes	—
`error_code`	`string,null`	yes	—
`failover_trail`	—	no	—
`id`	`string`	yes	`tc_`-prefixed: the bigserial with a `tc_` prefix prepended
`input`	—	no	—
`output`	—	no	—
`routing`	—	no	—
`server_id`	`string`	yes	—
`session_id`	`string`	yes	—
`status`	`"running"` \| `"success"` \| `"error"`	yes	—
`tool_name`	`string`	yes	—

Trigger

Field	Type	Required	Description
`action`	object \| object \| object	yes	What the trigger does when it fires. Absent means `webhook`, the signed POST to `webhook_url`. `human_review` puts an item in the approvals inbox; `pause_agent` suspends the agent named by `agent_did`, or the agent the event names when `agent_did` is absent. Neither moves money. `webhook_url` is required for `webhook` and refused for the other two.
`condition`	`object,null`	yes	Null fires on every event of the type.
`created_at`	`string (date-time)`	yes	—
`event`	`string`	yes	—
`event_known`	`boolean`	yes	Whether `event` is a type this build emits. `false` means the subscription exists but will not fire until a release starts emitting that name: it was accepted so you can subscribe ahead of a release, not because it matches.
`id`	`string`	yes	—
`last_run_at`	`string,null (date-time)`	yes	—
`name`	`string`	yes	—
`org_id`	`string`	yes	—
`project_id`	`string,null`	yes	nullable during the 0014→0015 rollout
`server_id`	`string,null`	yes	—
`signing_enabled`	`boolean`	yes	Whether a signing secret exists. The secret itself is never read back — the serializer drops the vault reference and reports only this.
`status`	`string`	yes	—
`total_runs`	`integer`	yes	—
`webhook_url`	`string,null`	yes	—

TriggerCreated

Type: —

Wallet

Field	Type	Required	Description
`agent_id`	`string,null`	yes	—
`balances`	array of WalletBalance	no	—
`closed_at`	`string,null (date-time)`	yes	—
`created_at`	`string (date-time)`	yes	—
`display_name`	`string`	yes	—
`id`	`string`	yes	—
`metadata`	object	yes	—
`org_id`	`string`	yes	—
`project_id`	`string`	yes	—
`status`	`"active"` \| `"frozen"` \| `"closed"`	yes	—

WalletAnomalyResolve

Field	Type	Required	Description
`note`	`string`	no	—
`status`	`"resolved"` \| `"dismissed"`	yes	—

WalletBalance

Field	Type	Required	Description
`available_minor`	`string`	yes	bigint as string
`balance_minor`	`string`	yes	bigint as string
`currency`	`"BRL"` \| `"USD"` \| `"MXN"` \| `"COP"` \| `"ARS"` \| `"USDC"` \| `"BRLA"`	yes	—
`updated_at`	`string (date-time)`	yes	—
`wallet_id`	`string`	yes	—

WalletCreate

Field	Type	Required	Description
`agent_id`	`string,null`	no	—
`currency`	`"BRL"` \| `"USD"` \| `"MXN"` \| `"COP"` \| `"ARS"` \| `"USDC"` \| `"BRLA"`	yes	—
`display_name`	`string`	yes	—
`metadata`	object	no	—

WalletExecute

Field	Type	Required	Description
`amount`	`number`	yes	—
`attempt_id`	`string`	no	—
`currency`	`"BRL"` \| `"USD"` \| `"MXN"` \| `"COP"` \| `"ARS"` \| `"USDC"` \| `"BRLA"`	yes	—
`description`	`string`	yes	—
`mandate_id`	`string`	yes	—
`metadata`	object	no	—
`preferred_method`	`string`	no	—
`purpose`	`string`	no	—
`recipient`	`string`	yes	—
`target_currency`	`"USD"` \| `"EUR"` \| `"BRL"` \| `"MXN"`	no	—

WalletFundingSource

Field	Type	Required	Description
`connection_id`	`string`	yes	—
`created_at`	`string (date-time)`	yes	—
`currency`	`"BRL"` \| `"USD"` \| `"MXN"` \| `"COP"` \| `"ARS"` \| `"USDC"` \| `"BRLA"`	yes	—
`enabled`	`boolean`	yes	—
`metadata`	object	yes	—
`wallet_id`	`string`	yes	—

WalletFundingSourceBind

Field	Type	Required	Description
`connection_id`	`string`	yes	—
`currency`	`"BRL"` \| `"USD"` \| `"MXN"` \| `"COP"` \| `"ARS"` \| `"USDC"` \| `"BRLA"`	yes	—
`metadata`	object	no	—

WalletLedgerEntry

Field	Type	Required	Description
`amount_minor`	`string`	yes	bigint signed minor units
`attempt_id`	`string,null`	yes	—
`currency`	`"BRL"` \| `"USD"` \| `"MXN"` \| `"COP"` \| `"ARS"` \| `"USDC"` \| `"BRLA"`	yes	—
`external_ref`	`string,null`	yes	—
`id`	`string`	yes	bigserial as string
`kind`	`"fund"` \| `"hold"` \| `"release"` \| `"debit"` \| `"reconcile"` \| `"reverse"` \| `"fee"`	yes	—
`mandate_id`	`string,null`	yes	—
`metadata`	object	yes	—
`org_id`	`string`	yes	—
`posted_at`	`string (date-time)`	yes	—
`reconciled_at`	`string,null (date-time)`	yes	—
`wallet_id`	`string`	yes	—

WalletLedgerPost

Field	Type	Required	Description
`amount_minor`	`string`	yes	—
`attempt_id`	`string,null`	no	—
`currency`	`"BRL"` \| `"USD"` \| `"MXN"` \| `"COP"` \| `"ARS"` \| `"USDC"` \| `"BRLA"`	yes	—
`external_ref`	`string,null`	no	—
`kind`	`"fund"` \| `"hold"` \| `"release"` \| `"debit"` \| `"reconcile"` \| `"reverse"` \| `"fee"`	yes	—
`mandate_id`	`string,null`	no	—
`metadata`	object	no	—
`org_id`	`string`	yes	—
`wallet_id`	`string`	yes	—

WalletReconAnomaly

Field	Type	Required	Description
`amount_minor`	`string,null`	yes	—
`currency`	`"BRL"` \| `"USD"` \| `"MXN"` \| `"COP"` \| `"ARS"` \| `"USDC"` \| `"BRLA"`	yes	—
`detected_at`	`string (date-time)`	yes	—
`external_ref`	`string,null`	yes	—
`id`	`string`	yes	—
`kind`	`"debit_without_receipt"` \| `"receipt_without_debit"`	yes	—
`ledger_entry_id`	`string,null`	yes	—
`metadata`	object	yes	—
`org_id`	`string`	yes	—
`resolution_note`	`string,null`	yes	—
`resolved_at`	`string,null (date-time)`	yes	—
`status`	`"open"` \| `"resolved"` \| `"dismissed"`	yes	—
`wallet_id`	`string`	yes	—

Whoami

Field	Type	Required	Description
`key`	object	yes	—
`organization`	object	yes	—
`project`	object	yes	—
`user`	`object,null`	yes	Always `null` for an API key and for an OAuth token: a key is scoped to an org and a project, not to a user, so there is no person to name. Identify the credential by `organization`, `project` and `key`. A person appears only on the service path the dashboard uses, and is the member it is acting for.