endpoints_v13.go (package eai)

Source: sdks/go/endpoints_v13.go. Back to the Go SDK reference index.

note

This page is generated by tools/docs/gen_sdk_reference.py from the SDK sources and the OpenAPI text folders. Do not edit it by hand: change the source and regenerate.

Class LicenseService

LicenseService groups the endpoints of: Licence entitlement, activation and history.

LicenseService.Activate

Activate(ctx context.Context, body any, opts ...CallOption) (json.RawMessage, error)

Activate a licence. Verifies a signed licence locally and stores it. Requires the role platform_admin and the policy decision license.activate.

Route: /v1/license/activations (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
body	any		yes	The signed licence received from the publisher.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Activate a licence". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

LicenseService.Get

Get(ctx context.Context, opts ...CallOption) (json.RawMessage, error)

Read the licence state. Non sensitive licence status of the installation: state, edition, product, term, validity and grace dates, days remaining, whether a renewal is scheduled, the actions restricted now, the capabilities a licence never restricts, and the banner the portal shows (level none, info, warning or critical, with an English and French message). No customer identifier, support reference or token is returned. Any authenticated principal may call it, subject to the policy decision license.read (403 policy_denied).

Route: /v1/license (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Read the licence state". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

LicenseService.History

History(ctx context.Context, opts ...CallOption) (*Page, error)

List the licence history. Licence history of the installation, newest event first: activations, rejected activations, actions refused after grace and expiry notices. The answer also gives the installation identity (installation id, installation group and when and by whom it was bound), every stored licence with its customer id, support reference and environments, and the support contracts. Requires the role platform_admin (403 forbidden) and the policy decision license.history.read. A malformed cursor answers 400 invalid_cursor.

Route: /v1/license/history (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (*Page, error). A Page: Page is one page of a cursor paginated collection {"items": [...], "next_cursor": "..."|null}. The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

Class ApplicationsService

ApplicationsService groups the endpoints of: Governed applications, deployments and third party agents.

ApplicationsService.ActivateDeployment

ActivateDeployment(ctx context.Context, appID string, deploymentID string, opts ...CallOption) (json.RawMessage, error)

Activate an approved deployment. Activates the deployment once its approval is approved (separation of duties is enforced by the approvals domain; a missing approval is audited as a denial): the previous active deployment of the environment is retired and the application becomes active. 409 application_suspended; 404 application_deployment_not_found. Needs tenant_admin, developer or application_owner. Audited as application.deployment.activate with the approver.

Route: /v1/applications/{app_id}/deployments/{deployment_id}/activate (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
appID	string		yes	Identifier (UUID) or name of the application.
deploymentID	string		yes	Identifier (UUID) of the deployment.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Activate an approved deployment". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

ApplicationsService.Create

Create(ctx context.Context, body any, opts ...CallOption) (json.RawMessage, error)

Register an application. Creates the application (201). An external_agent is always of origin third_party. Owner defaults to the caller, project to the X-Project header. A name already used answers 409 conflict. Needs tenant_admin, developer or application_owner. Audited as application.create.

Route: /v1/applications (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
body	any		yes	Name, kind, origin, owner, project, environments, risk level and granted resources.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Register an application". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

ApplicationsService.CreateDeployment

CreateDeployment(ctx context.Context, appID string, body any, opts ...CallOption) (json.RawMessage, error)

Request a deployment. Records a deployment of a version in one environment of the application and opens an application_deployment approval for tenant_admin or security_officer (201, the deployment carries approval_id). The environment must be declared by the application (400 invalid_request); the same version in the same environment answers 409 conflict; a suspended or retired application answers 409 application_suspended. Needs tenant_admin, developer or application_owner. Audited as application.deployment.create.

Route: /v1/applications/{app_id}/deployments (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
appID	string		yes	Identifier (UUID) or name of the application.
body	any		yes	Version, environment and reason shown to the approvers.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Request a deployment". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

ApplicationsService.CreateExternalAgent

CreateExternalAgent(ctx context.Context, appID string, body any, opts ...CallOption) (json.RawMessage, error)

Register a third party agent identity. Creates an API key with the role agent, bound to the application and its project, with the scopes tools:invoke, models:invoke plus the requested ones (201). The key is in api_key and is shown only once. Needs tenant_admin. Audited as application.external_agent.register.

Route: /v1/applications/{app_id}/external-agents (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
appID	string		yes	Identifier (UUID) or name of the application.
body	any		yes	Name of the identity and extra scopes.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Register a third party agent identity". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

ApplicationsService.DeveloperKit

DeveloperKit(ctx context.Context, opts ...CallOption) (json.RawMessage, error)

Get the developer kit. Developer kit of an application, an agent or a project: values, states and actions, never a secret. Give exactly one of application_id, agent_id or project (400 invalid_request otherwise). The answer holds the subject (with the models, tools, MCP servers, knowledge bases and evaluation suites it uses), the nine rows, the env entries of an environment file (the API key is only a placeholder marked secret), a summary of ready rows and the next_steps (create a key, run the tests, run the red team). An unknown application or agent, or a project without application, answers 404 not_found. Requires a tenant principal (403 tenant_required) with developer, application_owner or tenant_admin (403 forbidden).

Route: /v1/developer/kit (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Get the developer kit". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

ApplicationsService.Get

Get(ctx context.Context, appID string, opts ...CallOption) (json.RawMessage, error)

Get an application. Returns the application and its deployments, oldest first. 404 application_not_found.

Route: /v1/applications/{app_id} (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
appID	string		yes	Identifier (UUID) or name of the application.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Get an application". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

ApplicationsService.List

List(ctx context.Context, opts ...CallOption) (json.RawMessage, error)

List the applications. Applications of the tenant in name order, with kind, origin, status, environments and granted resources. One page only.

Route: /v1/applications (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "List the applications". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

ApplicationsService.SetStatus

SetStatus(ctx context.Context, appID string, body any, opts ...CallOption) (json.RawMessage, error)

Suspend or retire an application. Sets the application to suspended or retired and its active deployments too; every gateway call of its external agents is refused from then on. Needs tenant_admin or security_officer. Audited as application.suspended or application.retired.

Route: /v1/applications/{app_id}/status (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
appID	string		yes	Identifier (UUID) or name of the application.
body	any		yes	Target status and reason.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Suspend or retire an application". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

Class BreakGlassService

BreakGlassService groups the endpoints of: Emergency break-glass grants.

BreakGlassService.Create

Create(ctx context.Context, body any, opts ...CallOption) (json.RawMessage, error)

Request a break glass elevation. Requests an exceptional, time bound elevation for the beneficiary (the caller by default). Open to any member of the tenant.

Route: /v1/break-glass (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
body	any		yes	Roles, scopes, reason, duration, beneficiary and incident reference.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Request a break glass elevation". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

BreakGlassService.Get

Get(ctx context.Context, grantID string, opts ...CallOption) (json.RawMessage, error)

Get a break glass grant. Returns one grant: requester, beneficiary, roles, scopes, reason, incident, duration, status, approval and dates. Visible to its requester and beneficiary and to tenant_admin, security_officer and auditor; anyone else gets 404 break_glass_not_found.

Route: /v1/break-glass/{grant_id} (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
grantID	string		yes	Identifier (UUID) of the break glass grant.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Get a break glass grant". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

BreakGlassService.IssueContext

IssueContext(ctx context.Context, grantID string, body any, opts ...CallOption) (json.RawMessage, error)

Get an execution context for a break glass grant. Returns a signed ExecutionContext carrying the active elevation, whose lifetime never exceeds the grant expiry. Only the beneficiary may ask (403 forbidden); the grant must be active (409 break_glass_not_active); each audience must be known (400 context_wrong_audience). Downstream services verify it like any execution context.

Route: /v1/break-glass/{grant_id}/context (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
grantID	string		yes	Identifier (UUID) of the break glass grant.
body	any		yes	Optional audiences and lifetime of the context.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Get an execution context for a break glass grant". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

BreakGlassService.List

List(ctx context.Context, opts ...CallOption) (json.RawMessage, error)

List the break glass grants. Lists break glass grants, newest first: all of them for tenant_admin, security_officer and auditor, otherwise those the caller requested or benefits from. Active grants past their expiry are marked expired (audited once). An unknown status answers 400.

Route: /v1/break-glass (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "List the break glass grants". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

BreakGlassService.Revoke

Revoke(ctx context.Context, grantID string, body any, opts ...CallOption) (json.RawMessage, error)

Revoke a break glass grant. Ends a pending or active grant and revokes the delegations created under it. Allowed to the requester, a tenant_admin or a security_officer (403 forbidden). A grant already closed answers 409 break_glass_closed. Writes the audit event break_glass.revoke.

Route: /v1/break-glass/{grant_id}/revoke (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
grantID	string		yes	Identifier (UUID) of the break glass grant.
body	any		yes	Optional reason.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Revoke a break glass grant". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

Class DelegationsService

DelegationsService groups the endpoints of: Delegations of authority and chain authorization.

DelegationsService.Authorize

Authorize(ctx context.Context, body any, opts ...CallOption) (json.RawMessage, error)

Authorize an action under a delegation. Computes the effective permission of an action: user AND agent AND delegation AND resource restriction AND relationship (OpenFGA or the builtin tuples) AND policy (OPA or builtin). Give delegation_id, or run_id to use the delegation of a run (400 invalid_request without either; 403 delegation_required for a run without delegation).

Route: /v1/delegations/authorize (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
body	any		yes	Action, delegation or run, and the scope, resource, relation, audience and classification to check.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Authorize an action under a delegation". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

DelegationsService.Create

Create(ctx context.Context, body any, opts ...CallOption) (json.RawMessage, error)

Create a delegation. Creates a root delegation from the caller to a delegate. Open to members of the tenant; an agent cannot create a root delegation by itself (403 delegation_root_forbidden).

Route: /v1/delegations (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
body	any		yes	Delegate, rights, limits and expiry of the delegation.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Create a delegation". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

DelegationsService.Get

Get(ctx context.Context, delegationID string, opts ...CallOption) (json.RawMessage, error)

Get a delegation. Returns the delegation with the verification of its chain from the root (every link active, not expired, same tenant, covered by its parent). Visible to its root, creator and the person acted for, and to tenant_admin, security_officer, auditor and agent; otherwise 404 delegation_not_found.

Route: /v1/delegations/{delegation_id} (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
delegationID	string		yes	Identifier (UUID) of the delegation.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Get a delegation". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

DelegationsService.List

List(ctx context.Context, opts ...CallOption) (*Page, error)

List the delegations. Lists delegations, newest first, paginated: all of them for tenant_admin, security_officer and auditor, otherwise those the caller is the root, the creator or the person acted for. An unknown status answers 400.

Route: /v1/delegations (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (*Page, error). A Page: Page is one page of a cursor paginated collection {"items": [...], "next_cursor": "..."|null}. The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

DelegationsService.Restrict

Restrict(ctx context.Context, delegationID string, body any, opts ...CallOption) (json.RawMessage, error)

Restrict a delegation for a sub-delegate. Creates a child delegation, always covered by its parent: a sub-agent never gets wider rights. Allowed to the root or creator of the parent, an agent, a tenant_admin or a security_officer (403 forbidden).

Route: /v1/delegations/{delegation_id}/restrict (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
delegationID	string		yes	Identifier (UUID) of the parent delegation.
body	any		yes	Sub-delegate and narrower rights.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Restrict a delegation for a sub-delegate". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

DelegationsService.Revoke

Revoke(ctx context.Context, delegationID string, body any, opts ...CallOption) (json.RawMessage, error)

Revoke a delegation. Revokes the delegation and every descendant; their execution contexts are revoked with them, effective at the next action. Allowed to its root, creator or the person acted for, and to tenant_admin and security_officer (403 forbidden). Writes the audit event delegation.revoke.

Route: /v1/delegations/{delegation_id}/revoke (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
delegationID	string		yes	Identifier (UUID) of the delegation.
body	any		yes	Optional reason.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Revoke a delegation". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

DelegationsService.RevokePrincipal

RevokePrincipal(ctx context.Context, body any, opts ...CallOption) (json.RawMessage, error)

Revoke every delegation of a principal. Revokes every active delegation rooted at a principal or acting for it, with their descendants and execution contexts, for example at user offboarding or after an account compromise. Needs tenant_admin or security_officer. Writes the audit event delegation.revoke_principal.

Route: /v1/delegations/revoke-principal (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
body	any		yes	Principal and reason.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Revoke every delegation of a principal". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

DelegationsService.Verify

Verify(ctx context.Context, token string, audience string, opts ...CallOption) (json.RawMessage, error)

Verify a signed execution context. Checks a token and returns valid, context_id, kid, alg, the claims and the context document. Checks, in order: structure and canonical form (context_malformed), algorithm and signature (context_invalid_signature), known non revoked key (context_unknown_key), issuer (context_wrong_issuer), audience (context_wrong_audience), lifetime (context_expired), tenant of the caller (403 context_tenant_mismatch), issuance record (context_revoked), digest of the document and delegation chain (a revoked delegation gives context_revoked). Refusals answer 401 unless stated and are audited; a success binds the verified identity to the audit events of the request.

Route: /v1/context/verify (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
token	string		yes	The JWS compact token (10 to 65536 characters).
audience	string		yes	Audience the verifier expects (up to 200 characters). Default: the first platform audience.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Verify a signed execution context". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

Class MandatesService

MandatesService groups the endpoints of: Agent mandates.

MandatesService.Create

Create(ctx context.Context, body any, opts ...CallOption) (json.RawMessage, error)

Request a mandate for an agent. Requests a mandate so that an agent (optionally one of its schedules) runs autonomously under a service identity. Needs tenant_admin, developer or security_officer.

Route: /v1/mandates (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
body	any		yes	Agent, service identity, schedule, rights, purpose and lifetime of the mandate.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Request a mandate for an agent". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

MandatesService.Get

Get(ctx context.Context, mandateID string, opts ...CallOption) (json.RawMessage, error)

Get a mandate. Returns one mandate: agent, schedule, service identity, scopes, audience, resources, classification ceiling, depth, purpose, status, approval and expiry. Open to any member of the tenant. Answers 404 mandate_not_found.

Route: /v1/mandates/{mandate_id} (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
mandateID	string		yes	Identifier (UUID) of the mandate.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Get a mandate". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

MandatesService.List

List(ctx context.Context, opts ...CallOption) (json.RawMessage, error)

List the mandates. Lists the mandates of the tenant, newest first, optionally for one agent, with their effective status (pending, approved, rejected, revoked or expired). Open to any member of the tenant.

Route: /v1/mandates (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "List the mandates". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

MandatesService.Revoke

Revoke(ctx context.Context, mandateID string, body any, opts ...CallOption) (json.RawMessage, error)

Revoke a mandate. Revokes the mandate and the delegations rooted at it: the next scheduled run of the agent is refused (mandate_required). Allowed to the requester, a tenant_admin or a security_officer (403 forbidden). A revoked or rejected mandate answers 409 mandate_closed. Writes the audit event mandate.revoke.

Route: /v1/mandates/{mandate_id}/revoke (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
mandateID	string		yes	Identifier (UUID) of the mandate.
body	any		yes	Optional reason.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Revoke a mandate". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

Class SOCService

SOCService groups the endpoints of: SOC detections, containment orders, kill switches, receipts and four eyes recovery.

SOCService.AddEvidence

AddEvidence(ctx context.Context, incidentID string, body any, opts ...CallOption) (json.RawMessage, error)

Seal evidence on an incident. Appends a sealed record to the evidence chain of the incident: the content hash and the hash of the previous record, so that a removed, reordered or modified record breaks the chain. Records can never be updated nor deleted. Needs security_officer, soc_analyst or tenant_admin. Writes the audit event soc.evidence.seal and a custody entry. Answers 201 with seq, kind, content_sha256, prev_hash, hash, sealed_by and sealed_at.

Route: /v1/soc/incidents/{incident_id}/evidence (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
incidentID	string		yes	Identifier (UUID) of the incident.
body	any		yes	Kind and content of the evidence.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Seal evidence on an incident". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

SOCService.ApproveOrder

ApproveOrder(ctx context.Context, orderID string, opts ...CallOption) (json.RawMessage, error)

Approve a containment order. Approves an order waiting for a second person and applies it (kill switch written, adapter run). Needs security_officer or tenant_admin (SOC lead), who is not the requester (409 separation_of_duties). An order that is not pending answers 409 order_not_pending; an unknown one 404.

Route: /v1/soc/orders/{order_id}/approve (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
orderID	string		yes	Identifier (UUID) of the containment order.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Approve a containment order". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

SOCService.ApproveRecovery

ApproveRecovery(ctx context.Context, recoveryID string, body any, opts ...CallOption) (json.RawMessage, error)

Approve a recovery. Records one approval of a pending recovery; two distinct SOC leads are required, neither being the requester (409 separation_of_duties), each approving once (409 already_approved). Needs security_officer or tenant_admin (SOC lead). A request that is not pending answers 409 recovery_not_pending.

Route: /v1/soc/recoveries/{recovery_id}/approve (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
recoveryID	string		yes	Identifier (UUID) of the recovery request.
body	any		yes	Optional note of the approval.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Approve a recovery". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

SOCService.Catalog

Catalog(ctx context.Context, opts ...CallOption) (json.RawMessage, error)

Get the SOC catalogue. Returns the allowlists: reactions, the target types allowed per reaction (targets), the detection kinds with their base severity and playbook (detections), the limits of the proportionality guard (response: minimum confidence, maximum automatic blast radius, blast radius needing a manual approval, reactions always needing approval) and the SOC roles. Open to any member of the tenant.

Route: /v1/soc/catalog (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Get the SOC catalogue". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

SOCService.CreateDetection

CreateDetection(ctx context.Context, body any, opts ...CallOption) (json.RawMessage, error)

Report a detection. Ingests a detection. Needs a credential granted the scope soc:detections explicitly (the global * does not count), or security_officer, agent or soc_analyst.

Route: /v1/soc/detections (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
body	any		yes	The detection to ingest.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Report a detection". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

SOCService.CreateOrder

CreateOrder(ctx context.Context, body any, opts ...CallOption) (json.RawMessage, error)

Order a containment. Creates a manual containment order. Needs security_officer, soc_analyst or tenant_admin.

Route: /v1/soc/orders (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
body	any		yes	Reaction, target, incident, reason, parameters and limits of the order.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Order a containment". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

SOCService.CreateRecovery

CreateRecovery(ctx context.Context, body any, opts ...CallOption) (json.RawMessage, error)

Request the recovery of a kill switch. Opens a four eyes recovery request for one active kill switch. Needs security_officer, soc_analyst or tenant_admin. An unknown switch answers 404, a switch no longer suspended 409 kill_switch_not_active, a switch with an open request 409 recovery_already_open. Answers 201 with the request.

Route: /v1/soc/recoveries (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
body	any		yes	Kill switch and reason.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Request the recovery of a kill switch". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

SOCService.Custody

Custody(ctx context.Context, incidentID string, opts ...CallOption) (json.RawMessage, error)

Read the chain of custody. Returns the custody log of the incident evidence (who sealed, read or exported what, and when) with the verification of both hash chains. Needs security_officer, tenant_admin, auditor or soc_analyst. The read itself is added to the custody log. Answers 404 not_found for an unknown incident.

Route: /v1/soc/incidents/{incident_id}/custody (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
incidentID	string		yes	Identifier (UUID) of the incident.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Read the chain of custody". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

SOCService.ExportEvidence

ExportEvidence(ctx context.Context, incidentID string, opts ...CallOption) (json.RawMessage, error)

Export the evidence of an incident. Returns the incident, its evidence records, both chains verified and the custody log. The bundle is scanned for credentials before any byte leaves: when one is found the export is refused with 422 secret_detected, the refusal is recorded in the custody log and a secret_leak detection is raised. Needs security_officer, tenant_admin, auditor or soc_analyst.

Route: /v1/soc/incidents/{incident_id}/evidence/export (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
incidentID	string		yes	Identifier (UUID) of the incident.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Export the evidence of an incident". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

SOCService.GetOrder

GetOrder(ctx context.Context, orderID string, opts ...CallOption) (json.RawMessage, error)

Get a containment order. Returns the order with its latest kill switch and the receipts received for it. Needs security_officer, tenant_admin, auditor or soc_analyst. Answers 404 not_found.

Route: /v1/soc/orders/{order_id} (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
orderID	string		yes	Identifier (UUID) of the containment order.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Get a containment order". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

SOCService.ListDetections

ListDetections(ctx context.Context, opts ...CallOption) (json.RawMessage, error)

List the detections. Lists the detections of the tenant, newest first, optionally for one incident or one kind. Needs security_officer, tenant_admin, auditor or soc_analyst. The read is audited.

Route: /v1/soc/detections (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "List the detections". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

SOCService.ListEvidence

ListEvidence(ctx context.Context, incidentID string, opts ...CallOption) (json.RawMessage, error)

Read the evidence of an incident. Returns the sealed evidence records of the incident (detections, orders, receipts, notes), the verification of their chain and custody_seq, the custody entry this read created. Needs security_officer, tenant_admin, auditor or soc_analyst. Answers 404 not_found.

Route: /v1/soc/incidents/{incident_id}/evidence (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
incidentID	string		yes	Identifier (UUID) of the incident.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Read the evidence of an incident". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

SOCService.ListKillSwitches

ListKillSwitches(ctx context.Context, opts ...CallOption) (json.RawMessage, error)

List the kill switches. Lists the kill switches of the tenant, newest first, at most 500: by default only those whose desired state is SUSPENDED. Each gives reaction, target, desired and observed state, last receipt and release. Needs security_officer, tenant_admin, auditor or soc_analyst. The read is audited.

Route: /v1/soc/kill-switches (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "List the kill switches". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

SOCService.ListOrders

ListOrders(ctx context.Context, opts ...CallOption) (json.RawMessage, error)

List the containment orders. Lists the containment orders of the tenant, newest first, optionally by status (pending_approval, applied, rejected...) or incident. Each gives reaction, target, blast radius, confidence, severity, mode (manual or automatic), status and the decision of the Response Policy Engine. Needs security_officer, tenant_admin, auditor or soc_analyst.

Route: /v1/soc/orders (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "List the containment orders". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

SOCService.ListRecoveries

ListRecoveries(ctx context.Context, opts ...CallOption) (json.RawMessage, error)

List the recovery requests. Lists the recovery requests of the tenant, newest first, at most 500, optionally by status, with their approvals. Needs security_officer, tenant_admin, auditor or soc_analyst.

Route: /v1/soc/recoveries (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "List the recovery requests". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

SOCService.ListTransactions

ListTransactions(ctx context.Context, opts ...CallOption) (json.RawMessage, error)

List the side effecting transactions. Lists the side effecting tool and connector calls of the tenant, newest first, at most 500: idempotency key, operation, status (in_flight, committed, interrupted, reconciled, compensating, compensated...) and reconciliation. Needs security_officer, tenant_admin, auditor or soc_analyst.

Route: /v1/soc/transactions (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "List the side effecting transactions". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

SOCService.ReauthorizeRecovery

ReauthorizeRecovery(ctx context.Context, recoveryID string, opts ...CallOption) (json.RawMessage, error)

Re-authorize and recover. Final step of a recovery, by one of the approvers (403 reauthorization_by_approver otherwise) once both approvals are in (409 recovery_not_approved). The switch is released, the target is re-evaluated by the policy, which must allow it (403 reauthorization_denied, everything rolled back), and only then the owning plane is restored, for example an agent resumed. A revoked API key stays revoked: issue a new one. Needs security_officer or tenant_admin (SOC lead).

Route: /v1/soc/recoveries/{recovery_id}/reauthorize (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
recoveryID	string		yes	Identifier (UUID) of the recovery request.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Re-authorize and recover". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

SOCService.ReconcileTransaction

ReconcileTransaction(ctx context.Context, transactionID string, body any, opts ...CallOption) (json.RawMessage, error)

Reconcile a transaction. Records the real outcome of a side effecting call whose result is unknown (interrupted by a kill, a crash or a timeout): committed (it happened at the provider) or not_executed. A retry with the same idempotency key then returns the stored result instead of calling the provider again. Needs security_officer or tenant_admin (SOC lead). An unknown outcome answers 400, a transaction that cannot be reconciled 409 transaction_not_reconcilable, an unknown one 404.

Route: /v1/soc/transactions/{transaction_id}/reconcile (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
transactionID	string		yes	Identifier of the side effecting transaction.
body	any		yes	Outcome, provider reference and note.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Reconcile a transaction". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

SOCService.RecordReceipt

RecordReceipt(ctx context.Context, opts ...CallOption) (json.RawMessage, error)

Receive an in-cluster containment receipt. Receipt sent from the cluster (Cilium policy observed, workload scaled to zero) for a cluster reaction: JSON {kill_switch_id, verified, adapter, evidence}. Signed like the platform webhooks: X-EAI-Signature: t=<unix>,v1=<hex HMAC-SHA256(secret, "<t>." + body)>, a 5 minute replay window, X-EAI-Delivery for deduplication and X-EAI-Tenant (tenant slug). Without the configured SOC webhook secret every delivery is refused. Every delivery, accepted or not, is recorded and audited. A verified receipt moves the observed state to SUSPENDED_VERIFIED; a receipt for a reaction that expects none answers 409 receipt_not_expected. No user credential is needed: the signature authenticates the sender. Answers 202 with the kill switch.

Route: /v1/soc/receipts (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Receive an in-cluster containment receipt". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

SOCService.RejectOrder

RejectOrder(ctx context.Context, orderID string, body any, opts ...CallOption) (json.RawMessage, error)

Reject a containment order. Rejects an order waiting for approval, with an optional reason. Needs security_officer or tenant_admin (SOC lead). An order that is not pending answers 409 order_not_pending; an unknown one 404.

Route: /v1/soc/orders/{order_id}/reject (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
orderID	string		yes	Identifier (UUID) of the containment order.
body	any		yes	Optional reason of the decision.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Reject a containment order". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

SOCService.VerifyKillSwitch

VerifyKillSwitch(ctx context.Context, switchID string, opts ...CallOption) (json.RawMessage, error)

Verify a kill switch. Runs the Containment Verifier probe of the switch: on success the observed state becomes SUSPENDED_VERIFIED. Cluster reactions (ISOLATE_NETWORK, TERMINATE_WORKLOAD) are verified only by a signed in-cluster receipt. Needs security_officer, soc_analyst or tenant_admin. Writes the audit event soc.kill_switch.verify. Answers 404 not_found.

Route: /v1/soc/kill-switches/{switch_id}/verify (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
switchID	string		yes	Identifier (UUID) of the kill switch.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Verify a kill switch". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

SOCService.Webhook

Webhook(ctx context.Context, source string, opts ...CallOption) (json.RawMessage, error)

Receive external security findings. Webhook of external detectors: Falco, Tetragon or OpenSearch Security Analytics. The body is one event or a list (at most 200 processed), normalized into detections (Falco priorities and eai_* tags mapped to kinds and severities) and ingested like POST /v1/soc/detections. Signed like the platform webhooks: X-EAI-Signature: t=<unix>,v1=<hex HMAC-SHA256(secret, "<t>." + body)>, a 5 minute replay window, X-EAI-Delivery for deduplication and X-EAI-Tenant (tenant slug). Without the configured SOC webhook secret every delivery is refused. Every delivery, accepted or not, is recorded and audited. An unknown source answers 404. Answers 202 with received and the detections.

Route: /v1/soc/webhooks/{source} (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
source	string		yes	Detector: falco, tetragon or opensearch.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Receive external security findings". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

Class StorageService

StorageService groups the endpoints of: Storage profiles, checks and presigned access.

StorageService.CreateProfile

CreateProfile(ctx context.Context, body any, opts ...CallOption) (json.RawMessage, error)

Create a storage profile. Creates a profile with status unverified and answers 201. Requires tenant_admin for scope tenant (inside a tenant) or platform_admin for scope platform (403 storage_scope_forbidden), and the policy decision storage.profile.create. Audited (storage.profile.create).

Route: /v1/storage/profiles (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
body	any		yes	The new storage profile. Unknown fields are refused.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Create a storage profile". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

StorageService.Delete

Delete(ctx context.Context, profileID string, key string, versionID string, opts ...CallOption) (json.RawMessage, error)

Delete an object of a profile. Deletes one object (or one version of it) inside the presign prefixes of the profile. A profile serving audit_worm or evidence never deletes through the API (409 storage_object_protected); a retention refusal of the backend is returned as is. Requires tenant_admin, developer or agent (platform profile: platform_admin) and the policy decision storage.object.delete; audited with the full key and version. Other errors: 403 storage_key_out_of_scope, 422 storage_key_invalid, 409 storage_profile_disabled.

Route: /v1/storage/profiles/{profile_id}/objects/delete (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
profileID	string		yes	Identifier (UUID) of the storage profile.
key	string		yes	Key of the object relative to the profile key prefix, 1 to 1024 characters, inside a presign prefix; no control character, no leading /, no . or .. segment.
versionID	string		yes	Version of the object to delete on a versioned bucket, 1 to 1024 characters. Omit it to delete the current version.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Delete an object of a profile". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

StorageService.DeleteObject

DeleteObject(ctx context.Context, profileID string, body any, opts ...CallOption) (json.RawMessage, error)

Delete an object of a profile. Deletes one object (or one version of it) inside the presign prefixes of the profile. A profile serving audit_worm or evidence never deletes through the API (409 storage_object_protected); a retention refusal of the backend is returned as is. Requires tenant_admin, developer or agent (platform profile: platform_admin) and the policy decision storage.object.delete; audited with the full key and version. Other errors: 403 storage_key_out_of_scope, 422 storage_key_invalid, 409 storage_profile_disabled.

Route: /v1/storage/profiles/{profile_id}/objects/delete (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
profileID	string		yes	Identifier (UUID) of the storage profile.
body	any		yes	Key, and optionally version, of the object to delete.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Delete an object of a profile". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

StorageService.DeleteProfile

DeleteProfile(ctx context.Context, profileID string, opts ...CallOption) error

Delete a storage profile. Deletes the profile (the bucket and its objects are not touched) and answers 204. Requires tenant_admin for a tenant profile, platform_admin for a platform profile (403 storage_scope_forbidden), and the policy decision storage.profile.delete. The audit event storage.profile.delete records the provider, bucket and the number of audit exports that used it. Unknown id: 404 storage_profile_not_found.

Route: /v1/storage/profiles/{profile_id} (DELETE).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
profileID	string		yes	Identifier (UUID) of the storage profile.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: error. Error of the call (a typed error of the SDK), nil on success.

Raises: error, the typed errors of the transport (Errors).

StorageService.GetProfile

GetProfile(ctx context.Context, profileID string, opts ...CallOption) (json.RawMessage, error)

Get a storage profile. One storage profile with its status, discovered capabilities, verification time, missing and needed capabilities and last error. Never a secret value. Same readers as the list. Unknown id: 404 storage_profile_not_found.

Route: /v1/storage/profiles/{profile_id} (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
profileID	string		yes	Identifier (UUID) of the storage profile.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Get a storage profile". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

StorageService.List

List(ctx context.Context, profileID string, opts ...CallOption) (*Page, error)

List the objects of a profile. Objects stored under a prefix inside the presign prefixes of the profile: key relative to the profile key prefix (usable with presign and delete), stored key, size, ETag, content type, SHA-256, version, last modification and storage class. Requires tenant_admin, developer, agent or auditor (platform profile: platform_admin) and the policy decision storage.object.list; the listing is audited. Errors: 422 storage_prefix_required when prefix is omitted and the profile has not exactly one presign prefix, 403 storage_key_out_of_scope outside the presign prefixes, 409 storage_profile_disabled.

Route: /v1/storage/profiles/{profile_id}/objects (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
profileID	string		yes	Identifier (UUID) of the storage profile.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (*Page, error). A Page: Page is one page of a cursor paginated collection {"items": [...], "next_cursor": "..."|null}. The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

StorageService.ListObjects

ListObjects(ctx context.Context, profileID string, opts ...CallOption) (json.RawMessage, error)

List the objects of a profile. Objects stored under a prefix inside the presign prefixes of the profile: key relative to the profile key prefix (usable with presign and delete), stored key, size, ETag, content type, SHA-256, version, last modification and storage class. Requires tenant_admin, developer, agent or auditor (platform profile: platform_admin) and the policy decision storage.object.list; the listing is audited. Errors: 422 storage_prefix_required when prefix is omitted and the profile has not exactly one presign prefix, 403 storage_key_out_of_scope outside the presign prefixes, 409 storage_profile_disabled.

Route: /v1/storage/profiles/{profile_id}/objects (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
profileID	string		yes	Identifier (UUID) of the storage profile.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "List the objects of a profile". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

StorageService.ListProfileChecks

ListProfileChecks(ctx context.Context, profileID string, opts ...CallOption) (json.RawMessage, error)

List the verifications of a profile. History of the capability verifications of the profile, newest first: status, capabilities found, missing capabilities, whether a write probe ran, error, duration in milliseconds and who ran it. One page only (next_cursor is always null). Same readers as the list.

Route: /v1/storage/profiles/{profile_id}/checks (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
profileID	string		yes	Identifier (UUID) of the storage profile.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "List the verifications of a profile". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

StorageService.ListProfiles

ListProfiles(ctx context.Context, opts ...CallOption) (json.RawMessage, error)

List the storage profiles. Storage profiles visible to the caller, ordered by scope then name, each with its needed_capabilities (required capabilities plus those its purposes need). One page only: next_cursor is always null. Requires platform_admin, or a tenant principal with tenant_admin, security_officer, developer or auditor.

Route: /v1/storage/profiles (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "List the storage profiles". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

StorageService.PresignProfile

PresignProfile(ctx context.Context, profileID string, body any, opts ...CallOption) (json.RawMessage, error)

Issue a presigned URL. Issues a presigned URL to read (GET) or write (PUT) one object directly in the bucket, and answers 201 with the grant id, URL, method, full key, lifetime and expiry. The key must be inside the presign prefixes (403 storage_key_out_of_scope) and the profile must have a verified, recent presign capability (409 storage_capability_missing). The lifetime may not exceed EAI_STORAGE_PRESIGN_MAX_SECONDS (3600 by default, never more than 604800; 422 storage_presign_expiry_invalid). Requires tenant_admin, developer or agent (platform profile: platform_admin) and the policy decision storage.presign.read or storage.presign.write. The grant is recorded with a SHA-256 of the URL (never the URL itself) and audited.

Route: /v1/storage/profiles/{profile_id}/presign (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
profileID	string		yes	Identifier (UUID) of the storage profile.
body	any		yes	Object, direction and lifetime of the presigned URL.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Issue a presigned URL". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

StorageService.UpdateProfile

UpdateProfile(ctx context.Context, profileID string, body any, opts ...CallOption) (json.RawMessage, error)

Update a storage profile. Changes the given fields; the merged profile is validated like a new one. A change of provider, endpoint, region, bucket, auth, credential_ref, encryption or options clears the capabilities and sets the status back to unverified; status: disabled disables the profile, status: active on a disabled profile makes it unverified. Adding the purpose audit_worm without such a change requires a verified object lock capability (409 storage_capability_missing). Requires tenant_admin (platform profile: platform_admin) and the policy decision storage.profile.update; audited with the changed fields.

Route: /v1/storage/profiles/{profile_id} (PATCH).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
profileID	string		yes	Identifier (UUID) of the storage profile.
body	any		yes	Fields to change; omitted fields keep their value.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Update a storage profile". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

StorageService.VerifyProfile

VerifyProfile(ctx context.Context, profileID string, body any, opts ...CallOption) (json.RawMessage, error)

Verify the capabilities of a profile. Discovers the capabilities of the bucket by real calls and stores them. Requires tenant_admin or security_officer (platform profile: platform_admin) and the policy decision storage.profile.verify. A disabled profile answers 409 storage_profile_disabled.

Route: /v1/storage/profiles/{profile_id}/verify (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
profileID	string		yes	Identifier (UUID) of the storage profile.
body	any		yes	Verification options; the body may be omitted.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Verify the capabilities of a profile". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

Class MarketplaceService

MarketplaceService groups the endpoints of: Marketplace publishers, packages, preflight and installations.

MarketplaceService.AdvanceChange

AdvanceChange(ctx context.Context, changeID string, body any, opts ...CallOption) (json.RawMessage, error)

Advance a change to the next stage. Moves the change to the next stage. Needs tenant_admin, developer or security_officer. Gates per target stage: 1. test: only the author (or tenant_admin) leaves draft (403 change_not_author). 2. security_review: evidence.tests must pass (passed > 0, no failed, no errors), else 422 change_evidence_missing. 3. business_approval: approval change.security_review by a security_officer. 4. staging: approval change.business_approval by a tenant_admin. 5. production: passing staging_smoke, then approval change.production with a quorum of two. 6. monitoring: passing production_smoke. Without approval_id, a gated stage answers 202 with the approval to obtain; call again with the approved id to get 200. The author never approves. A closed change answers 409 change_closed.

Route: /v1/marketplace/changes/{change_id}/advance (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
changeID	string		yes	Identifier (UUID) of the change request.
body	any		yes	Evidence to add and the approved request, when the stage needs one.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Advance a change to the next stage". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

MarketplaceService.ApplyInstallation

ApplyInstallation(ctx context.Context, installationID string, opts ...CallOption) (json.RawMessage, error)

Apply an approved installation. Executes the pending install or upgrade once its approval is approved: the policy and the preflight are checked again, the objects of the pack are created inside a savepoint, the objects of the former version that are no longer part of it are removed and a smoke test runs. A failed smoke test rolls everything back and answers 422 smoke_failed. Needs tenant_admin. 409 installation_state when nothing is pending. Audited as marketplace.install or marketplace.upgrade.

Route: /v1/marketplace/installations/{installation_id}/apply (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
installationID	string		yes	Identifier (UUID) of the installation.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Apply an approved installation". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

MarketplaceService.AuthorizeInstallation

AuthorizeInstallation(ctx context.Context, installationID string, body any, opts ...CallOption) (json.RawMessage, error)

Check a runtime permission. Runtime permission check used by the pack MCP servers and connectors: allowed only when the installation is installed, the permission was granted, is not suspended and is not an external export denied by the data protection settings. Otherwise 403 with permission_not_granted, permission_suspended, installation_suspended or external_export_denied, recorded as an authorize_denied event. Needs tenant_admin, developer, agent or service.

Route: /v1/marketplace/installations/{installation_id}/authorize (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
installationID	string		yes	Identifier (UUID) of the installation.
body	any		yes	Permission scope to check.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Check a runtime permission". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

MarketplaceService.CreateChange

CreateChange(ctx context.Context, body any, opts ...CallOption) (json.RawMessage, error)

Open a change request. Opens a change of a prompt, skill, connector, rule, model, policy, tool, agent or pack at stage draft. Needs tenant_admin or developer; the policy change.create is evaluated. Audited as change.create.

Route: /v1/marketplace/changes (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
body	any		yes	Kind, object name, version and title of the change.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Open a change request". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

MarketplaceService.CreateInstallation

CreateInstallation(ctx context.Context, body any, opts ...CallOption) (json.RawMessage, error)

Request the installation of a pack. Opens an installation request and answers 202 with the installation, the approval_id, the quorum and the preflight report. Needs tenant_admin. Steps: 1. The preflight runs (see POST /v1/marketplace/preflight); a failure answers 403 permission_unsafe, 422 config_invalid, 422 permission_not_requested, 409 package_suspended or 422 preflight_failed. 2. An approval marketplace.install is opened for tenant_admin or security_officer: quorum 1 by default, at least 2 when a sensitive permission is granted or the environment is prod. 3. Once approved, call POST .../installations/{id}/apply. 409 installation_exists when the package is already installed or suspended in this environment.

Route: /v1/marketplace/installations (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
body	any		yes	Package, version, environment, granted permissions, configuration and secret references.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Request the installation of a pack". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

MarketplaceService.CreatePackage

CreatePackage(ctx context.Context, body any, opts ...CallOption) (json.RawMessage, error)

Publish a package version. Publishes a pack archive as a new version (201). Needs tenant_admin or developer; the policy marketplace.publish is evaluated. Steps: 1. The archive is decoded (422 marketplace_archive_invalid) and scanned by ClamAV and YARA-X before unpacking (422 file_blocked, 503 file_scan_unavailable). 2. Every gate runs: schema, signature, SBOM, vulnerability scan, tests, evaluations, licence, permissions, documentation, secrets, provenance, privacy, security, approvals, configuration, resilience. Any failure answers 422 publication_gate_failed with the result of each gate. 3. The package is created on first publication. 409 package_suspended when its kill switch is on, 409 marketplace_version_exists for a version already published. Audited as marketplace.publish.

Route: /v1/marketplace/packages (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
body	any		yes	The pack archive and its supply chain evidence.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Publish a package version". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

MarketplaceService.CreatePublisher

CreatePublisher(ctx context.Context, body any, opts ...CallOption) (json.RawMessage, error)

Add a trusted publisher key. Registers a public signing key for the tenant; pack signatures are verified against the active keys. Needs tenant_admin or security_officer. An unreadable key answers 422 publisher_invalid_key. Audited as marketplace.publisher.add.

Route: /v1/marketplace/publishers (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
body	any		yes	Publisher name and public key.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Add a trusted publisher key". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

MarketplaceService.GetChange

GetChange(ctx context.Context, changeID string, opts ...CallOption) (json.RawMessage, error)

Get a change request. Returns the change with its stage, evidence, pending approval and history (one entry per transition with actor and time). 404 change_not_found.

Route: /v1/marketplace/changes/{change_id} (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
changeID	string		yes	Identifier (UUID) of the change request.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Get a change request". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

MarketplaceService.GetInstallation

GetInstallation(ctx context.Context, installationID string, opts ...CallOption) (json.RawMessage, error)

Get an installation. Returns the installation: status, package and version, granted and suspended permissions, configuration, last preflight and smoke results, created objects and assets. 404 installation_not_found.

Route: /v1/marketplace/installations/{installation_id} (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
installationID	string		yes	Identifier (UUID) of the installation.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Get an installation". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

MarketplaceService.GetPackage

GetPackage(ctx context.Context, name string, opts ...CallOption) (json.RawMessage, error)

Get a package and its versions. Returns the package and every version, oldest first, with gate results and a vulnerability summary. 404 marketplace_package_not_found.

Route: /v1/marketplace/packages/{name} (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
name	string		yes	Name of the package.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Get a package and its versions". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

MarketplaceService.GetPackageVersion

GetPackageVersion(ctx context.Context, name string, version string, opts ...CallOption) (json.RawMessage, error)

Get a package version. Returns one version: manifest, digest, file digests, signature and its status, licence, OCI reference, gate results, provenance status and production approval. The archive and the SBOM are not included. 404 marketplace_version_not_found.

Route: /v1/marketplace/packages/{name}/versions/{version} (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
name	string		yes	Name of the package.
version	string		yes	Semantic version, for example 1.2.0.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Get a package version". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

MarketplaceService.InstallationEvents

InstallationEvents(ctx context.Context, installationID string, opts ...CallOption) (json.RawMessage, error)

List the events of an installation. Lifecycle history of the installation, oldest first: requests, installs, upgrades, rollbacks, failed smoke tests, suspensions, resumptions, refused authorizations, with versions, outcome and actor. One page only.

Route: /v1/marketplace/installations/{installation_id}/events (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
installationID	string		yes	Identifier (UUID) of the installation.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "List the events of an installation". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

MarketplaceService.ListChanges

ListChanges(ctx context.Context, opts ...CallOption) (json.RawMessage, error)

List the change requests. Change requests of the tenant, newest first, at most 200, optionally filtered by kind, reference and stage. Any tenant principal may call it.

Route: /v1/marketplace/changes (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "List the change requests". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

MarketplaceService.ListInstallations

ListInstallations(ctx context.Context, opts ...CallOption) (json.RawMessage, error)

List the installations. Installations of the tenant, oldest first, each with package, version and created assets. One page only.

Route: /v1/marketplace/installations (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "List the installations". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

MarketplaceService.ListPackages

ListPackages(ctx context.Context, opts ...CallOption) (json.RawMessage, error)

List the packages. Packages of the catalogue in name order, with status, latest version, publisher and category. One page only.

Route: /v1/marketplace/packages (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "List the packages". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

MarketplaceService.ListPublishers

ListPublishers(ctx context.Context, opts ...CallOption) (json.RawMessage, error)

List the publishers. Trusted signing keys, by name: algorithm, status (active or revoked) and scope (platform for a key shared by every tenant, tenant for a key of this tenant). Public keys are not returned.

Route: /v1/marketplace/publishers (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "List the publishers". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

MarketplaceService.PackageSBOM

PackageSBOM(ctx context.Context, name string, version string, opts ...CallOption) (json.RawMessage, error)

Get the SBOM of a version. Returns the software bill of materials stored at publication, its digest and the vulnerability scan report.

Route: /v1/marketplace/packages/{name}/versions/{version}/sbom (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
name	string		yes	Name of the package.
version	string		yes	Semantic version, for example 1.2.0.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Get the SBOM of a version". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

MarketplaceService.Preflight

Preflight(ctx context.Context, body any, opts ...CallOption) (json.RawMessage, error)

Dry run the installation checks. Dry run of the installation checks, nothing is installed: package active, environment, configuration against the pack configSchema, version available (and in production for prod), platform compatibility, dependencies installed, archive digest, signature, permissions requested and safe, secret references of the connectors, approved model, no name conflict. Returns passed, every check, the granted, not granted and sensitive permissions, the approvals required and the data protection applied. Needs tenant_admin or security_officer. Audited as marketplace.preflight.

Route: /v1/marketplace/preflight (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
body	any		yes	Same body as an installation request.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Dry run the installation checks". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

MarketplaceService.PromotePackageVersion

PromotePackageVersion(ctx context.Context, name string, version string, body any, opts ...CallOption) (json.RawMessage, error)

Promote a version to production. Production gate, required to install a version in prod. Needs tenant_admin or security_officer. Steps: 1. Without approval_id: every stored gate must have passed, the signature must still verify and an OCI artifact digest must be attached (else 422 publication_gate_failed); then a marketplace.promote approval is opened with a quorum of at least two and the answer is 202 with the checks. 2. With the approved approval_id: the version becomes production (200). A version already in production answers 200 at once; 409 package_suspended while the kill switch is on.

Route: /v1/marketplace/packages/{name}/versions/{version}/production (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
name	string		yes	Name of the package.
version	string		yes	Semantic version, for example 1.2.0.
body	any		yes	Approved request, on the second call.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Promote a version to production". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

MarketplaceService.RejectChange

RejectChange(ctx context.Context, changeID string, body any, opts ...CallOption) (json.RawMessage, error)

Reject a change request. Closes the change at stage rejected from any open stage, with the reason kept in history. Needs tenant_admin or security_officer. 409 change_closed if already closed. Audited as change.reject.

Route: /v1/marketplace/changes/{change_id}/reject (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
changeID	string		yes	Identifier (UUID) of the change request.
body	any		yes	Reason of the rejection.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Reject a change request". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

MarketplaceService.RevokePublisher

RevokePublisher(ctx context.Context, name string, opts ...CallOption) (json.RawMessage, error)

Revoke a publisher. Revokes every key of the tenant registered under this name; signatures made with them no longer verify. Needs tenant_admin or security_officer. 404 publisher_not_found. Platform keys cannot be revoked here. Audited as marketplace.publisher.revoke.

Route: /v1/marketplace/publishers/{name}/revoke (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
name	string		yes	Name of the publisher.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Revoke a publisher". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

MarketplaceService.RollbackInstallation

RollbackInstallation(ctx context.Context, installationID string, opts ...CallOption) (json.RawMessage, error)

Roll back to the previous version. Reinstalls the previous version with its previous grant, inside a savepoint with a smoke test (422 smoke_failed keeps the current version). Needs tenant_admin. 409 installation_state unless installed; 409 rollback_unavailable when there is no previous version. Audited as marketplace.rollback.

Route: /v1/marketplace/installations/{installation_id}/rollback (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
installationID	string		yes	Identifier (UUID) of the installation.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Roll back to the previous version". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

MarketplaceService.SetInstallationStatus

SetInstallationStatus(ctx context.Context, installationID string, body any, opts ...CallOption) (json.RawMessage, error)

Suspend or resume an installation. Needs tenant_admin or security_officer. - status: suspended: immediate. Without permissions, the whole installation is suspended (tools blocked, agents suspended, MCP servers disabled, assets suspended); with permissions, only those granted capabilities (422 permission_not_granted for others). Answers 200. - status: installed: resume. Without approval_id, opens a marketplace.resume approval with a quorum of two and answers 202; with the approved id, lifts the suspension and answers 200. Refused with 409 package_suspended while the package kill switch is on. 409 installation_state for a state that does not allow the change.

Route: /v1/marketplace/installations/{installation_id}/status (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
installationID	string		yes	Identifier (UUID) of the installation.
body	any		yes	Target status, reason, capabilities to suspend and approval for a resumption.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Suspend or resume an installation". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

MarketplaceService.SetPackageStatus

SetPackageStatus(ctx context.Context, name string, body any, opts ...CallOption) (json.RawMessage, error)

Set the kill switch of a package. Needs tenant_admin or security_officer. - status: suspended: immediate. Every installed installation of the package is suspended; installs, upgrades, publications and promotions are refused. Answers 200 with suspended_installations. - status: active: lifts the kill switch. Without approval_id, opens a marketplace.package.resume approval with a quorum of two (202); with the approved id, the package and the installations it suspended resume (200 with resumed_installations). 409 installation_state when lifting a package that is not suspended.

Route: /v1/marketplace/packages/{name}/status (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
name	string		yes	Name of the package.
body	any		yes	Target status, reason and approval for a lifting.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Set the kill switch of a package". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

MarketplaceService.Supervision

Supervision(ctx context.Context, installationID string, opts ...CallOption) (json.RawMessage, error)

Supervise an installed pack. Activity, quality, costs and incidents of an installed pack, aggregated from the objects it created: tool invocations and runs per state, refused authorizations, evaluation results, last smoke result, run success rate, run costs per currency, and the incidents naming its objects (50 most recent).

Route: /v1/marketplace/installations/{installation_id}/supervision (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
installationID	string		yes	Identifier (UUID) of the installation.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Supervise an installed pack". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

MarketplaceService.UninstallInstallation

UninstallInstallation(ctx context.Context, installationID string, opts ...CallOption) (json.RawMessage, error)

Uninstall a pack. Removes every object and asset the installation created and sets it to uninstalled (grants, suspensions and previous version cleared). Allowed from installed, failed, pending_approval or suspended (else 409 installation_state). Needs tenant_admin; the policy marketplace.uninstall is evaluated. The answer lists removed. Audited as marketplace.uninstall.

Route: /v1/marketplace/installations/{installation_id}/uninstall (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
installationID	string		yes	Identifier (UUID) of the installation.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Uninstall a pack". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

MarketplaceService.UpgradeInstallation

UpgradeInstallation(ctx context.Context, installationID string, body any, opts ...CallOption) (json.RawMessage, error)

Request the upgrade of an installation. Opens an upgrade request to a higher version (202 with approval, quorum and preflight), then apply it with POST .../apply once approved. The installation must be installed and the version strictly higher (else 409 installation_state). Configuration and secret references default to the current ones. Needs tenant_admin. Preflight failures answer as for an installation request.

Route: /v1/marketplace/installations/{installation_id}/upgrade (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
installationID	string		yes	Identifier (UUID) of the installation.
body	any		yes	Target version, granted permissions, configuration and secret references.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Request the upgrade of an installation". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

Class EvidenceService

EvidenceService groups the endpoints of: Evidence chain, seals, holds, retention and run components.

EvidenceService.AccessLog

AccessLog(ctx context.Context, opts ...CallOption) (json.RawMessage, error)

Read the audit access log. Returns the latest accesses to the audit trail, newest first: actor, roles, kind (read, search, verify, export, payload_decrypt, seal_read), query, number of results, reason and the audit event written. Needs auditor or security_officer. Reading the log is itself recorded.

Route: /v1/evidence/access-log (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Read the audit access log". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

EvidenceService.Alerts

Alerts(ctx context.Context, opts ...CallOption) (json.RawMessage, error)

List the integrity alerts. Lists the integrity alerts of the tenant opened by the monitor: chain_broken, sequence_gap, seal_invalid, outbox_missing or clock_skew, refreshed while the problem persists. Needs auditor, security_officer or tenant_admin.

Route: /v1/evidence/alerts (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "List the integrity alerts". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

EvidenceService.Bundle

Bundle(ctx context.Context, opts ...CallOption) (json.RawMessage, error)

Export an offline evidence bundle. Returns bundle (events, seals and public keys of the tenant) and manifest (format, counts, SHA-256 of the canonical bundle, alg: Ed25519, key id, public key and signature by the seal key). An external auditor verifies it offline with python -m eai.domains.evidence.verify. Needs auditor or security_officer. Answers 503 audit_seal_key_unavailable without signing key. The export is recorded in the access log.

Route: /v1/evidence/bundle (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Export an offline evidence bundle". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

EvidenceService.CreateHold

CreateHold(ctx context.Context, body any, opts ...CallOption) (json.RawMessage, error)

Place an evidence legal hold. Places a legal hold on the payloads of the tenant for a case and an optional period of event time: while it is active, the payload retention purge and erasures skip the events it covers. time_to must be after time_from (400 invalid_request). Needs auditor, security_officer or tenant_admin. Writes the audit event audit.legal_hold.create. Answers 201 with the hold.

Route: /v1/evidence/holds (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
body	any		yes	Case, reason and optional period of the hold.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Place an evidence legal hold". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

EvidenceService.CreateSeal

CreateSeal(ctx context.Context, opts ...CallOption) (json.RawMessage, error)

Seal the audit chain now. Writes a seal over the events written since the previous seal (up to the platform maximum per seal) and returns it (201). Needs security_officer or auditor. Answers 409 audit_nothing_to_seal when no event is waiting, 503 audit_seal_key_unavailable without signing key.

Route: /v1/evidence/seals (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Seal the audit chain now". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

EvidenceService.EventPayload

EventPayload(ctx context.Context, eventID string, body any, opts ...CallOption) (json.RawMessage, error)

Decrypt the payload of an audit event. Returns the decrypted sensitive fields of one event in payload, with access_event_id, the audit event that records this access. Only auditor or security_officer held explicitly: platform_admin is not enough (403 forbidden). A reason is required. Errors: 404 not_found (no payload), 410 audit_payload_purged (expired or erased), 409 audit_payload_tampered (ciphertext digest mismatch), 503 audit_payload_key_unavailable.

Route: /v1/evidence/events/{event_id}/payload (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
eventID	string		yes	Identifier (UUID) of the audit event.
body	any		yes	Reason of the decryption, written to the access log.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Decrypt the payload of an audit event". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

EvidenceService.Gateway

Gateway(ctx context.Context, opts ...CallOption) (json.RawMessage, error)

Get the Audit Gateway status. Returns the delivery state of the audit events of the tenant to the SIEM: configured targets, pending and delivered counts, max_attempts of a pending event and oldest_pending. Needs auditor, security_officer or tenant_admin.

Route: /v1/evidence/gateway (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Get the Audit Gateway status". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

EvidenceService.ListHolds

ListHolds(ctx context.Context, opts ...CallOption) (json.RawMessage, error)

List the evidence legal holds. Lists the legal holds of the tenant with their case, period, reason, status and release approvals. Needs auditor, security_officer or tenant_admin.

Route: /v1/evidence/holds (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "List the evidence legal holds". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

EvidenceService.ListSeals

ListSeals(ctx context.Context, opts ...CallOption) (json.RawMessage, error)

List the audit seals. Lists the seals of the tenant chain: number, sequence range, Merkle root, first and last hashes, previous seal hash, key id, signature and date. Needs auditor, security_officer or tenant_admin. The read is recorded in the access log.

Route: /v1/evidence/seals (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "List the audit seals". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

EvidenceService.RecordRunComponents

RecordRunComponents(ctx context.Context, runID string, body any, opts ...CallOption) (json.RawMessage, error)

Record the components of a run. Records, append only, the versions of the components used by an agent run, or by one step of it with step_seq (tool call, model call). Each report is audited with the versions field of the Audit Event. Needs tenant_admin, agent_operator or developer. Answers 201 with the recorded items, or 404 not_found for an unknown run.

Route: /v1/evidence/runs/{run_id}/components (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
runID	string		yes	Identifier (UUID) of the agent run.
body	any		yes	Optional step and 1 to 100 components.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Record the components of a run". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

EvidenceService.ReleaseHold

ReleaseHold(ctx context.Context, holdID string, body any, opts ...CallOption) (json.RawMessage, error)

Approve the release of a legal hold. Records one release approval with its reason. The hold is released at the second approval by a distinct approver; the same person twice answers 409 audit_hold_same_approver, a hold no longer active 409 audit_hold_not_active, an unknown hold 404. Needs auditor, security_officer or tenant_admin. Writes audit.legal_hold.release_approve, then audit.legal_hold.release.

Route: /v1/evidence/holds/{hold_id}/release (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
holdID	string		yes	Identifier (UUID) of the legal hold.
body	any		yes	Reason of the approval.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Approve the release of a legal hold". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

EvidenceService.RetentionEvidence

RetentionEvidence(ctx context.Context, opts ...CallOption) (json.RawMessage, error)

List the purge evidence. Lists the purge evidence records of the tenant: kind, cutoff, purged and held counts, purged sequences and the Merkle root of the purged ciphertext digests, never the contents. Needs auditor, security_officer or tenant_admin.

Route: /v1/evidence/retention/evidence (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "List the purge evidence". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

EvidenceService.RunConfiguration

RunConfiguration(ctx context.Context, runID string, opts ...CallOption) (json.RawMessage, error)

Get the execution configuration of a run. Rebuilds the execution configuration of an agent run: agent version and manifest digest, components reported by kind (model, prompt, tool, skill, plugin) with their versions and digests, and the policy decisions recorded for the run. Needs auditor, security_officer or tenant_admin, agent_operator or developer. The read is recorded in the access log. Answers 404 not_found for an unknown run.

Route: /v1/evidence/runs/{run_id}/configuration (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
runID	string		yes	Identifier (UUID) of the agent run.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Get the execution configuration of a run". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

EvidenceService.RunRetention

RunRetention(ctx context.Context, body any, opts ...CallOption) (json.RawMessage, error)

Purge expired audit payloads. Deletes encrypted audit payloads; the events, the chain and the seals stay and keep verifying.

Route: /v1/evidence/retention/run (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
body	any		yes	Kind of purge, cutoff, events and simulation flag.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Purge expired audit payloads". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

EvidenceService.Verify

Verify(ctx context.Context, opts ...CallOption) (json.RawMessage, error)

Verify the chain and every seal. Verifies the whole tenant chain and every seal and returns tenant_id, valid, chain (hash chain result), seals (count and failures), clock (timestamp failures) and events (number checked). Needs auditor, security_officer or tenant_admin. The verification is recorded in the access log.

Route: /v1/evidence/verify (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Verify the chain and every seal". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

EvidenceService.VerifySeal

VerifySeal(ctx context.Context, sealID string, opts ...CallOption) (json.RawMessage, error)

Verify an audit seal. Recomputes the seal from the events it covers and the seals before it and checks its signature. Returns seal, valid and failures. Needs auditor, security_officer or tenant_admin. Answers 404 not_found for an unknown seal. The verification is recorded in the access log.

Route: /v1/evidence/seals/{seal_id}/verify (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
sealID	string		yes	Identifier (UUID) of the seal.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Verify an audit seal". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

Class ContextService

Execution context. Context Authority: issues, verifies and revokes signed ExecutionContext documents, the proof that a call is made by a given principal, agent run and delegation chain, for a given audience and a short time.

ContextService.Issue

Issue(ctx context.Context, body any, opts ...CallOption) (json.RawMessage, error)

Issue a signed execution context. Builds and signs an ExecutionContext for the caller and returns token, context_id, kid, alg, issued_at and expires_at (201). - With run_id: the caller must have created the run, be its root principal or the user it acts for, or hold agent, tenant_admin or security_officer (403 forbidden); the delegation of the run is checked again and the agent manifest is included. - With delegation_id: the delegation must be valid and the caller one of its parties, or agent or tenant_admin. Errors: 400 context_wrong_audience for an audience the platform does not accept, 400 context_ttl_exceeded, 403 delegation_expired, 503 context_authority_unavailable. Audited as context.issue.

Route: /v1/context/issue (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
body	any		yes	Audience, lifetime and the run or delegation the context is for.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Issue a signed execution context". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

ContextService.JWKS

JWKS(ctx context.Context, opts ...CallOption) (json.RawMessage, error)

Get the public verification keys. Public verification keys as a JWKS (active, and retired ones still inside their verification window), each with kid, alg (ES256 or EdDSA) and use: sig. Any authenticated principal may read it. 503 context_authority_unavailable when the key registry cannot be read.

Route: /v1/context/jwks (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Get the public verification keys". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

ContextService.ListKeys

ListKeys(ctx context.Context, opts ...CallOption) (json.RawMessage, error)

List the signing keys. Registry of the context signing keys: kid, algorithm, status, dates of use, retirement and revocation. Needs security_officer or auditor. 503 context_authority_unavailable when the registry cannot be read.

Route: /v1/context/keys (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "List the signing keys". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

ContextService.Revoke

Revoke(ctx context.Context, contextID string, opts ...CallOption) (json.RawMessage, error)

Revoke an execution context. Revokes an issued context before it expires; verifying it then answers context_revoked. Allowed for the principal that issued it, or tenant_admin or security_officer (403 forbidden). Revoking twice keeps the first date. 404 context_not_found. Audited as context.revoke.

Route: /v1/context/{context_id}/revoke (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
contextID	string		yes	Identifier (UUID) of the context, the jti claim of its token.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Revoke an execution context". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

ContextService.RevokeKey

RevokeKey(ctx context.Context, kid string, body any, opts ...CallOption) (json.RawMessage, error)

Revoke a signing key. Revokes a context signing key at once: the contexts it signed no longer verify. Needs platform_admin. 404 signing_key_not_found. Audited as context.key.revoke at platform level.

Route: /v1/context/keys/{kid}/revoke (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
kid	string		yes	Key id, the RFC 7638 thumbprint of the public key.
body	any		yes	Reason of the revocation.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Revoke a signing key". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

ContextService.Verify

Verify(ctx context.Context, body any, opts ...CallOption) (json.RawMessage, error)

Verify a signed execution context. Checks a token and returns valid, context_id, kid, alg, the claims and the context document. Checks, in order: structure and canonical form (context_malformed), algorithm and signature (context_invalid_signature), known non revoked key (context_unknown_key), issuer (context_wrong_issuer), audience (context_wrong_audience), lifetime (context_expired), tenant of the caller (403 context_tenant_mismatch), issuance record (context_revoked), digest of the document and delegation chain (a revoked delegation gives context_revoked). Refusals answer 401 unless stated and are audited; a success binds the verified identity to the audit events of the request.

Route: /v1/context/verify (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
body	any		yes	Token to verify and expected audience.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Verify a signed execution context". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

Class EvaluationsService

Evaluation and red team. Quality of the AI systems of the tenant: evaluation suites, evaluation runs, quality gates before promotion, A/B comparisons against a baseline and red team runs.

EvaluationsService.CreateComparison

CreateComparison(ctx context.Context, body any, opts ...CallOption) (json.RawMessage, error)

Compare a candidate with a baseline. Runs one suite twice, on the baseline and on the candidate (each {type, ref, version}, type model by default, agent or prompt), and stores both runs, the per metric deltas and the verdict. Deltas are oriented by the comparator of each metric (gte: higher is better, lte: lower is better).

Route: /v1/evaluations/comparisons (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
body	any		yes	JSON object: suite_id, baseline, candidate, optional tolerance (0 to 1, default 0) and outputs ({"baseline": [...], "candidate": [...]}, precomputed outputs per case).
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Compare a candidate with a baseline". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

EvaluationsService.GetComparison

GetComparison(ctx context.Context, comparisonID string, opts ...CallOption) (json.RawMessage, error)

Get an A/B comparison. Returns one comparison. Needs tenant_admin, developer, security_officer, auditor, viewer or finops. Answers 404 comparison_not_found.

Route: /v1/evaluations/comparisons/{comparison_id} (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
comparisonID	string		yes	Identifier (UUID) of the comparison.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Get an A/B comparison". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

EvaluationsService.ListComparisons

ListComparisons(ctx context.Context, opts ...CallOption) (json.RawMessage, error)

List the A/B comparisons. Lists the comparisons of the tenant, newest first, at most 200, optionally for one suite. Each gives baseline, candidate, both run ids, per metric deltas, tolerance and verdict. Needs tenant_admin, developer, security_officer, auditor, viewer or finops.

Route: /v1/evaluations/comparisons (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "List the A/B comparisons". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

Class GatewayService

GatewayService groups the endpoints of: AI Gateway, the only path agents use to call models (OpenAI compatible bodies plus the eai extension).

GatewayService.ChatCompletions

ChatCompletions(ctx context.Context, req ChatRequest, opts ...CallOption) (*ChatResponse, error)

Call a chat model. OpenAI compatible chat completion through every control of the gateway; with stream: true the answer is Server-Sent Events, with the cost guardrails checked during the stream. Requires a tenant principal (403 platform_only) whose credential carries the scope models:invoke.

Route: /v1/gateway/chat/completions (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
req	ChatRequest		yes	OpenAI chat request (model is the registry id, messages, stream, max_tokens, tools...) plus the optional eai object: data_classification (public, internal by default, confidential, restricted, secret), agent_id, session_id, run_id, purpose, project_id, effort, max_cost, fallback_policy and allow lists that can only narrow the tenant ones (provider_allow, model_allow, region_allow).
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (*ChatResponse, error). A ChatResponse: ChatResponse is a chat completion with the gateway headers. The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

GatewayService.ChatCompletionsStream

ChatCompletionsStream(ctx context.Context, req ChatRequest, opts ...CallOption) (*ChatStream, error)

Call a chat model. OpenAI compatible chat completion through every control of the gateway; with stream: true the answer is Server-Sent Events, with the cost guardrails checked during the stream. Requires a tenant principal (403 platform_only) whose credential carries the scope models:invoke.

Route: /v1/gateway/chat/completions (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
req	ChatRequest		yes	OpenAI chat request (model is the registry id, messages, stream, max_tokens, tools...) plus the optional eai object: data_classification (public, internal by default, confidential, restricted, secret), agent_id, session_id, run_id, purpose, project_id, effort, max_cost, fallback_policy and allow lists that can only narrow the tenant ones (provider_allow, model_allow, region_allow).
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (*ChatStream, error). A ChatStream: ChatStream reads a streamed chat completion. The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

GatewayService.Embed

Embed(ctx context.Context, body any, opts ...CallOption) (json.RawMessage, error)

Compute embeddings. OpenAI compatible embeddings through the same controls as chat (kill switches, allow lists, classification, DLP on each input, cost guardrails, policy decision, audit). The model must declare the embeddings capability and, when dimensions is given, support it (422 capability_not_supported, 422 embedding_dimensions_invalid). Requires a tenant principal with the scope models:invoke.

Route: /v1/gateway/embeddings (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
body	any		yes	OpenAI embeddings request (model, input as a text or a list, optional dimensions) plus the optional eai object.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Compute embeddings". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

GatewayService.Generate

Generate(ctx context.Context, req ChatRequest, opts ...CallOption) (*ChatResponse, error)

Call a chat model. OpenAI compatible chat completion through every control of the gateway; with stream: true the answer is Server-Sent Events, with the cost guardrails checked during the stream. Requires a tenant principal (403 platform_only) whose credential carries the scope models:invoke.

Route: /v1/gateway/chat/completions (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
req	ChatRequest		yes	OpenAI chat request (model is the registry id, messages, stream, max_tokens, tools...) plus the optional eai object: data_classification (public, internal by default, confidential, restricted, secret), agent_id, session_id, run_id, purpose, project_id, effort, max_cost, fallback_policy and allow lists that can only narrow the tenant ones (provider_allow, model_allow, region_allow).
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (*ChatResponse, error). A ChatResponse: ChatResponse is a chat completion with the gateway headers. The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

GatewayService.Isolation

Isolation(ctx context.Context, opts ...CallOption) (json.RawMessage, error)

Read the isolation mode. Effective isolation mode for the tenant or one of its projects: the project setting when present, else the tenant setting, else connected, with the declared internal hosts. Requires a tenant principal (400 tenant_required) with tenant_admin, platform_admin, security_officer, finops, developer, auditor or viewer.

Route: /v1/llm/isolation (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Read the isolation mode". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

GatewayService.SetIsolation

SetIsolation(ctx context.Context, body any, opts ...CallOption) (json.RawMessage, error)

Set the isolation mode. Sets the isolation mode of the tenant or of one project. In local_only or air_gapped, only local providers (vLLM, Ollama, LM Studio) and the declared internal hosts are reachable: an external route is refused in preflight (403 isolation_external_route) and the outbound call is checked again (403 isolation_egress_denied). Audited (llm.isolation.set). Requires a tenant principal with tenant_admin, platform_admin or security_officer.

Route: /v1/llm/isolation (PUT).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
body	any		yes	mode (connected, local_only or air_gapped), optional project_id (empty for the whole tenant) and internal_hosts (host names, optionally with a port, lowercase letters, digits, dots and dashes).
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Set the isolation mode". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

GatewayService.Stream

Stream(ctx context.Context, req ChatRequest, opts ...CallOption) (*ChatStream, error)

Call a chat model. OpenAI compatible chat completion through every control of the gateway; with stream: true the answer is Server-Sent Events, with the cost guardrails checked during the stream. Requires a tenant principal (403 platform_only) whose credential carries the scope models:invoke.

Route: /v1/gateway/chat/completions (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
req	ChatRequest		yes	OpenAI chat request (model is the registry id, messages, stream, max_tokens, tools...) plus the optional eai object: data_classification (public, internal by default, confidential, restricted, secret), agent_id, session_id, run_id, purpose, project_id, effort, max_cost, fallback_policy and allow lists that can only narrow the tenant ones (provider_allow, model_allow, region_allow).
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (*ChatStream, error). A ChatStream: ChatStream reads a streamed chat completion. The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

GatewayService.Vision

Vision(ctx context.Context, body any, opts ...CallOption) (json.RawMessage, error)

Understand an image. Starts a vision understanding job on an image media or inline image with a prompt (201, the job). The answer goes through the DLP with dlp_mode. detail answers 422 parameter_unsupported when the configured provider cannot honour it; a non image input answers 422 unsupported_media. Needs tenant_admin, developer or agent.

Route: /v1/multimodal/vision (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
body	any		yes	Input image, prompt, model, DLP mode and detail level.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Understand an image". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

Class PoliciesService

Policies. Attribute based policies (ABAC) that decide every sensitive action of the platform, with the Policy Contract v1, the decision log, simulation, revisions and signed OPA bundles.

PoliciesService.CreateBundle

CreateBundle(ctx context.Context, body any, opts ...CallOption) (json.RawMessage, error)

Publish an OPA bundle. Packs the opa policies of the tenant into a signed OPA bundle and stores it as the new current revision. Active policies are decided by OPA; draft ones ship as libraries; disabled ones are left out. No opa policy answers 409 policy_bundle_empty; no signing key in production 503 policy_bundle_signing_unavailable. Needs tenant_admin or security_officer. Writes the audit event policy.bundle_publish. Answers 201 with the bundle record.

Route: /v1/policies/bundles (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
body	any		yes	Optional revision name and data.json content. An empty body generates the revision.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Publish an OPA bundle". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

PoliciesService.DownloadBundle

DownloadBundle(ctx context.Context, revision string, opts ...CallOption) ([]byte, error)

Download an OPA bundle. Returns the bundle OPA polls, as application/gzip: Rego modules, optional data.json, .manifest and .signatures.json (RS256 JWT over the SHA-256 of every file). The ETag header is its SHA-256 and X-Bundle-Revision its revision. Needs tenant_admin, security_officer or auditor. Answers 404 not_found for an unknown revision.

Route: /v1/policies/bundles/{revision}/bundle.tar.gz (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
revision	string		yes	Revision of the bundle, or current for the latest published one.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: ([]byte, error). Decoded JSON answer of the operation "Download an OPA bundle". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

PoliciesService.Engines

Engines(ctx context.Context, opts ...CallOption) (json.RawMessage, error)

Get the policy engines status. Returns the policy services (builtin engine, OPA, OpenFGA) and the policy version or bundle revision each one really runs, read from the engine itself. Needs tenant_admin, security_officer or auditor.

Route: /v1/policies/engines (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Get the policy engines status". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

PoliciesService.Evaluate

Evaluate(ctx context.Context, request any, opts ...CallOption) (*PolicyDecision, error)

Evaluate a policy request. Returns the decision for a Policy Contract request. The body is a Policy Contract ({schema_version, request}) or just its request object (subject, action, resource, context); it is validated against the policy-contract contract (422 validation_error).

Route: /v1/policies/evaluate (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
request	any		yes	Policy Contract document, or its request object alone.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (*PolicyDecision, error). A PolicyDecision: PolicyDecision is the decision part of the Policy Contract v1. The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

PoliciesService.ListBundles

ListBundles(ctx context.Context, opts ...CallOption) (json.RawMessage, error)

List the OPA bundles. Lists the OPA bundles published for the tenant: revision, SHA-256, signature state, policies included and date. Needs tenant_admin, security_officer or auditor.

Route: /v1/policies/bundles (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "List the OPA bundles". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

PoliciesService.Revisions

Revisions(ctx context.Context, policyID string, opts ...CallOption) (json.RawMessage, error)

List the revisions of a policy. Lists the immutable revisions of the policy (one per create, update and delete, written in the same transaction), with their number, operation, author, date and content. Needs tenant_admin, security_officer, auditor or developer. Answers 404 not_found.

Route: /v1/policies/{policy_id}/revisions (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
policyID	string		yes	Identifier (UUID) of the policy.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "List the revisions of a policy". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

PoliciesService.RevisionsDiff

RevisionsDiff(ctx context.Context, policyID string, opts ...CallOption) (json.RawMessage, error)

Compare two revisions of a policy. Returns the differences between two revisions of the policy. Defaults: the previous revision against the latest one. The policy is looked up first (404 not_found), then the revisions (404 not_found). Needs tenant_admin, security_officer, auditor or developer.

Route: /v1/policies/{policy_id}/revisions/diff (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
policyID	string		yes	Identifier (UUID) of the policy.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Compare two revisions of a policy". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

PoliciesService.Simulate

Simulate(ctx context.Context, body any, opts ...CallOption) (json.RawMessage, error)

Simulate a candidate policy. Compares, input by input, the decisions of the active policies with those of the same set where the candidate replaces policy_id (or is added). Nothing is changed.

Route: /v1/policies/simulate (POST).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
body	any		yes	Candidate policy, policy replaced, inputs and number of recorded decisions to replay.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Simulate a candidate policy". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).