Models: R

RawUsage

The vendor's own usage object, exactly as it reported it. Only with include=rawUsage.

• provider: str
• model: str
• usage: dict[str, Any]

Reason

• verdict: Union[Literal['yes', 'no'], str]
• reason: str
• judge_class_id: str | None (judgeClassId on the wire) (optional)
• restricted: Optional[Literal[True]] (optional)

RecordDeploymentProblemBody

• code: Literal['endpoint-url-invalid', 'endpoint-host-not-allowed', 'endpoint-name-mismatch', 'endpoint-unreachable', 'endpoint-info-mismatch', 'image-not-allowed', 'tenant-not-provisioned', 'capacity-unavailable', 'service-start-failed', 'pack-env-ambiguous', 'pack-env-secret-not-yet', 'pack-env-missing', 'pack-env-secret-unreadable', 'pack-env-secrets-unaudited', 'pack-env-secret-too-large', 'pack-env-secret-capacity']

RecordPackEnvBody

• revision: str
• held: Optional[Annotated[Union[Literal['pack-env-ambiguous', 'pack-env-secret-not-yet', 'pack-env-missing', 'pack-env-secret-unreadable', 'pack-env-update-failed', 'pack-env-secrets-unaudited', 'pack-env-secret-too-large', 'pack-env-secret-redeploy'], str], <kindgi.client._open.OpenEnum object at 0x10700bbd0>]] (optional)
• applied_revision: str | None (appliedRevision on the wire) (optional)

RecordedSecretScopeOrg

Where a secret an item names is read, recorded when the item is registered: the first of the item's own scope, its project's org and the tenant that has the secret and that the registrant administers. Else, the broadest they administer; for a deployment's tools, deployed or promoted, where that deployment's secrets sync writes (POST /v1/deployments/{deploymentId}/secrets), when the registrant administers it: its project, or the tenant for a deploy that names none and for a promotion into the Default project, which are stored with no project. The runtime reads the secret there only: a secret removed from it is missing, never read from a broader scope, and one set later elsewhere changes nothing until it's recorded again: a tool by publishing a new version, an MCP endpoint by unregistering it and registering it again, a webhook trigger by an update that names its secret.

• kind: Literal['org']
• org_id: uuid.UUID (orgId on the wire)

RecordedSecretScopeProject

Where a secret an item names is read, recorded when the item is registered: the first of the item's own scope, its project's org and the tenant that has the secret and that the registrant administers. Else, the broadest they administer; for a deployment's tools, deployed or promoted, where that deployment's secrets sync writes (POST /v1/deployments/{deploymentId}/secrets), when the registrant administers it: its project, or the tenant for a deploy that names none and for a promotion into the Default project, which are stored with no project. The runtime reads the secret there only: a secret removed from it is missing, never read from a broader scope, and one set later elsewhere changes nothing until it's recorded again: a tool by publishing a new version, an MCP endpoint by unregistering it and registering it again, a webhook trigger by an update that names its secret.

• kind: Literal['project']
• project_id: uuid.UUID (projectId on the wire)

RecordedSecretScopeTenant

Where a secret an item names is read, recorded when the item is registered: the first of the item's own scope, its project's org and the tenant that has the secret and that the registrant administers. Else, the broadest they administer; for a deployment's tools, deployed or promoted, where that deployment's secrets sync writes (POST /v1/deployments/{deploymentId}/secrets), when the registrant administers it: its project, or the tenant for a deploy that names none and for a promotion into the Default project, which are stored with no project. The runtime reads the secret there only: a secret removed from it is missing, never read from a broader scope, and one set later elsewhere changes nothing until it's recorded again: a tool by publishing a new version, an MCP endpoint by unregistering it and registering it again, a webhook trigger by an update that names its secret.

• kind: Literal['tenant']

RecordedSecretScopeUnrecognized

A kind this client doesn't know yet, from a newer runtime: the object as it came, every field kept.

• kind: str

Reference

• name: str
• ref: str
• version: int

RefreshResult

• session_token: str (sessionToken on the wire)
• session_id: str (sessionId on the wire)
• expires_at: AwareDatetime (expiresAt on the wire)

RefusedItem

• path: str
• message: str

RegisterGuardrailBody

Guardrail spec. Validated server-side via @kindgi/guardrails.validateGuardrailSpec. Metadata-only registration: the check id must reference an implementation already available to the runtime.

• id: str
• project_id: uuid.UUID (projectId on the wire)
• name: str | None (optional)
• description: str | None (optional)
• kind: str
• check: str
• config: dict[str, Any] | None (optional)
• action: kindgi.client.GuardrailAction
• severity: Optional[Literal['info', 'warn', 'error', 'critical']] (optional)
• scope: kindgi.client.GuardrailScope | None (optional)
• budget: kindgi.client.Budget | None (optional)
• judge_capabilities: dict[str, Any] | None (judgeCapabilities on the wire) (optional)

RegisterGuardrailResult

• guardrail_id: str (guardrailId on the wire)

RegisterIdentityProviderBody

• root: kindgi.client.OidcIdentityProviderConfig | kindgi.client.SamlIdentityProviderConfig

RegisterIdentityProviderResult

• provider_id: str (providerId on the wire)
• provider: Optional[Annotated[kindgi.client.OidcIdentityProviderConfig | kindgi.client.SamlIdentityProviderConfig | kindgi.client.IdentityProviderConfigUnrecognized, <kindgi.client._open.OpenUnion object at 0x107ad6790>]] (optional)

RegisterMCPEndpointBody

• endpoint_id: str (endpointId on the wire)
• name: str
• transport: Union[Literal['stdio', 'http-sse', 'streamable-http'], str]
• config: kindgi.client.Config3 | kindgi.client.Config4 | kindgi.client.Config5
• secret_ref: kindgi.client.MCPEndpointSecretRef | None (secretRef on the wire) (optional)
• auth: Optional[Annotated[kindgi.client.MCPBasicAuth | kindgi.client.MCPOAuth2ClientCredentialsAuth | kindgi.client.MCPHeaderAuth | kindgi.client.MCPEndpointAuthUnrecognized, <kindgi.client._open.OpenUnion object at 0x107c7e590>]] (optional)
• instructions: str | None (optional)
• metadata: dict[str, Any] | None (optional)
• send_traceparent: bool | None (sendTraceparent on the wire) (optional)
• scope_kind: Literal['tenant', 'org', 'project'] (scopeKind on the wire)
• scope_id: str | None (scopeId on the wire) (optional)

RegisterMCPEndpointResult

• endpoint_id: str (endpointId on the wire)

RegisterProviderBody

• metadata: kindgi.client.ProviderMetadata
• adapter_id: str
• secret_ref: kindgi.client.SecretRef | None (optional)
• adapter_config: dict[str, str | float | bool] | None (optional)
• send_traceparent: bool | None (optional)

RegisterProviderResult

• provider_id: str (providerId on the wire)

RegisterReviewerBody

Register a reviewer for the caller's tenant. Idempotent w.r.t. (tenantId, userId) — re-registering rotates role/displayName rather than inserting a duplicate.

• user_id: uuid.UUID (userId on the wire)
• role: Literal['standard', 'senior', 'admin']
• display_name: str | None (displayName on the wire) (optional)

RegisterScheduleBody

Name what it runs: flowId with flowVersion, agentId (with an optional agentVersion), or improve (improvement passes). Registering needs write on the project and execute on what it runs (publish on the agent for improve); its runs act as the caller.

• flow_id: str | None (flowId on the wire) (optional)
• flow_version: str | None (flowVersion on the wire) (optional)
• agent_id: str | None (agentId on the wire) (optional)
• agent_version: str | None (agentVersion on the wire) (optional)
• improve: kindgi.client.ImproveScheduleTarget | None (optional)
• project_id: uuid.UUID | None (projectId on the wire) (optional)
• run_as_service_account_id: str | None (runAsServiceAccountId on the wire) (optional)
• config: kindgi.client.Config6
• catch_up: Optional[Literal['latest', 'skip']] (catchUp on the wire) (optional)
• overlap: Optional[Literal['skip', 'allow']] (optional)
• starting_deadline_seconds: int | None (startingDeadlineSeconds on the wire) (optional)
• label: str | None (optional)

RegisterSiteBody

• display_name: str (displayName on the wire)
• origin: str
• approvals_url: str (approvalsUrl on the wire)
• allowed_roles: list[kindgi.client.AllowedRole] | None (allowedRoles on the wire) (optional)
• role_map: dict[str, kindgi.client.SiteRoleGrant] | None (roleMap on the wire) (optional)
• reviewer_ceiling: Optional[Literal['standard', 'senior']] (reviewerCeiling on the wire) (optional)
• vouching: bool | None (optional)
• people_cap: int | None (peopleCap on the wire) (optional)
• new_people_per_day: int | None (newPeoplePerDay on the wire) (optional)

RegisterSiteResult

• site: kindgi.client.Site
• enrollment: kindgi.client.SiteEnrollmentCode

RegisterToolBody

ToolManifest — Tool minus its runtime handler. Validated server-side via @kindgi/tools.validateToolManifest. Metadata-only registration: the handler is not uploaded and must already be available to the runtime.

• id: str
• project_id: uuid.UUID (projectId on the wire)
• description: str
• version: str | None (optional)
• input: dict[str, Any]
• output: dict[str, Any]
• needs: list[kindgi.client.ToolNeed] | None (optional)
• effects: list[kindgi.client.ToolEffect] | None (optional)
• transport: Optional[Literal['auto', 'native', 'mcp']] (optional)
• mcp_endpoint: str | None (mcpEndpoint on the wire) (optional)
• metadata: dict[str, Any] | None (optional)
• mutating: bool | None (optional)
• needs_approval_when_unattended: bool | None (needsApprovalWhenUnattended on the wire) (optional)
• sandbox: Optional[Annotated[Union[Literal['none', 'context-isolated', 'strict'], str], <kindgi.client._open.OpenEnum object at 0x10700bbd0>]] (optional)
• limits: kindgi.client.RuntimeLimits | None (optional)
• network: Optional[Annotated[kindgi.client.NetworkPolicy1 | kindgi.client.NetworkPolicy2 | kindgi.client.NetworkPolicyUnrecognized, <kindgi.client._open.OpenUnion object at 0x107ac6c50>]] (optional)
• needs_spec: kindgi.client.TypedNeeds | None (needsSpec on the wire) (optional)
• code_artifact_ref: Optional[Annotated[kindgi.client.CodeArtifactRefOci | kindgi.client.CodeArtifactRefFilesystem | kindgi.client.CodeArtifactRefUnrecognized, <kindgi.client._open.OpenUnion object at 0x107ac6f90>]] (codeArtifactRef on the wire) (optional)
• spec: kindgi.client.ToolSpec | None (optional)

RegisterToolResult

• tool_id: str (toolId on the wire)

RegisterWebhookTriggerBody

• flow_id: str (flowId on the wire)
• flow_version: str (flowVersion on the wire)
• project_id: uuid.UUID | None (projectId on the wire) (optional)
• config: kindgi.client.Config8 | None (optional)
• hmac_secret_name: str (hmacSecretName on the wire)
• generate_secret: bool | None (generateSecret on the wire) (optional)
• signature: Optional[Annotated[kindgi.client.WebhookSignatureHmacSha256 | kindgi.client.WebhookSignatureStandardWebhooks | kindgi.client.WebhookSignatureUnrecognized, <kindgi.client._open.OpenUnion object at 0x107c05b50>]] (optional)
• delivery_id_header: str | None (deliveryIdHeader on the wire) (optional)
• body_limit_bytes: int | None (bodyLimitBytes on the wire) (optional)
• rate_limit_per_minute: int | None (rateLimitPerMinute on the wire) (optional)
• label: str | None (optional)
• run_as_service_account_id: str | None (runAsServiceAccountId on the wire) (optional)

ReinstateAgentVersionResult

• agent_id: str (agentId on the wire)
• version: str
• was_tombstoned: bool (wasTombstoned on the wire)

ReinstateBlockResult

• block_id: str (blockId on the wire)
• version: str
• was_tombstoned: bool (wasTombstoned on the wire)

ReinstateEvalSuiteVersionResult

• suite_id: str (suiteId on the wire)
• version: str
• was_tombstoned: bool (wasTombstoned on the wire)

ReinstateFlowVersionResult

• flow_id: str (flowId on the wire)
• version: str
• was_tombstoned: bool (wasTombstoned on the wire)

ReinstatePolicyVersionResult

• policy_id: str (policyId on the wire)
• version: str
• was_tombstoned: bool (wasTombstoned on the wire)

ReinstateToolVersionResult

• tool_id: str (toolId on the wire)
• version: str
• was_tombstoned: bool (wasTombstoned on the wire)

Remember

Lets the agent remember: its turns offer the built-in tool kindgi_remember (built-in tools are kindgi_<verb>; an agent cannot list one in tools, and a published tool cannot use the prefix). The model picks the type, the text (up to 2,000 characters), an optional slot key and when it stops being true; the scope comes from here and the run. Every remembered fact is unverified, attributed to the agent version and the call that wrote it, and expires after keepDays unless a person verifies it. A person approves it before any read sees it when the scope is wider than one person (same-project, tenant) or the text reads like an instruction.

• types: list[kindgi.client.Type]
• scope: Union[Literal['same-user', 'same-conversation', 'same-project', 'tenant'], str]
• keep_days: int | None (keepDays on the wire) (optional)

Replay

Each knob left out of the block is 0. No block: no replay checks.

• max_diverged: int | None (maxDiverged on the wire) (optional)
• max_errors: int | None (maxErrors on the wire) (optional)
• max_refused_writes: int | None (maxRefusedWrites on the wire) (optional)
• max_stopped: int | None (maxStopped on the wire) (optional)

ReplayMemoryErasuresBody

• erasures: list[kindgi.client.MemoryErasureLedgerEntry]

ReplayMemoryErasuresResult

• replayed: list[uuid.UUID]
• restored: list[uuid.UUID]
• unmatched: list[kindgi.client.UnmatchedItem]

RequestedApproval

The approval an approval.requested event names. What it is about stays behind sign-in: no context, no tool call or run input.

• approval_id: str (approvalId on the wire)
• project_id: str | None (projectId on the wire) (optional)
• required_role: Union[Literal['standard', 'senior', 'admin'], str] (requiredRole on the wire)
• title: str | None (optional)
• assigned_to: str | None (assignedTo on the wire) (optional)
• created_at: AwareDatetime (createdAt on the wire)
• expires_at: AwareDatetime | None (expiresAt on the wire) (optional)
• url: str | None (optional)

RequestedBy

• kind: Union[Literal['user', 'service'], str]
• id: str

RescoreEvalRunBody

Body of POST /v1/eval-runs/{runId}/rescore: optional.

• project_id: str | None (projectId on the wire) (optional)

Restricted

The same weights, counting only judgments recorded while their class was restricted (Judgment.restricted), for a comparison weighted restricted-only. Absent from a test set built before restrictions.

• yes_weight: float (yesWeight on the wire)
• total_weight: float (totalWeight on the wire)

Resume

How the run went on, when this call resumed it (the runtime resumes inline): ok, or failed with the run's error, e.g. tool-version-unresolvable when a tool version the turn started with is gone, or rate-limit-exceeded when a budget kept per tenant refused work the turn needed. The decision stands either way.

• kind: Literal['ok']

Resume1

How the run went on, when this call resumed it (the runtime resumes inline): ok, or failed with the run's error, e.g. tool-version-unresolvable when a tool version the turn started with is gone, or rate-limit-exceeded when a budget kept per tenant refused work the turn needed. The decision stands either way.

• kind: Literal['failed']
• code: str
• message: str

ResumeMemoryErasureBody

• force: bool | None (optional)

ResumeRunBody

• waitpoint_id: str (waitpointId on the wire)
• value: Any | None (optional)

Retention

• keep_until: AwareDatetime | None (keepUntil on the wire) (optional)
• keep_days: int | None (keepDays on the wire) (optional)
• legal_hold: bool | None (legalHold on the wire) (optional)

RetentionPolicyConflict

• domain: Union[Literal['org', 'agent', 'flow', 'tool', 'eval_suite', 'guardrail', 'mcp_endpoint', 'env', 'secret', 'run', 'artifact', 'policy', 'judgment', 'judge_class', 'provider', 'memory', 'conversation', 'api_key', 'service_account', '*'], str]
• policy_ids: list[str] (policyIds on the wire)
• applied_policy_id: str (appliedPolicyId on the wire)

RetentionScheduledItem

• domain: Union[Literal['org', 'agent', 'flow', 'tool', 'eval_suite', 'guardrail', 'mcp_endpoint', 'env', 'secret', 'run', 'artifact', 'policy', 'judgment', 'judge_class', 'provider', 'memory', 'conversation', 'api_key', 'service_account', '*'], str]
• id: str
• unregistered_at: AwareDatetime (unregisteredAt on the wire)
• purge_at: AwareDatetime (purgeAt on the wire)
• past_grace: bool (pastGrace on the wire)
• policy_id: str | None (policyId on the wire) (optional)
• policy_version: str | None (policyVersion on the wire) (optional)
• grace_seconds: int (graceSeconds on the wire)
• limit_applied: Optional[Literal[True]] (limitApplied on the wire) (optional)

RetentionScheduledPage

• data: list[kindgi.client.RetentionScheduledItem]
• has_more: bool | None (hasMore on the wire) (optional)
• next_cursor: str | None (nextCursor on the wire) (optional)
• domains_missing_adapter: list[Annotated[Union[Literal['org', 'agent', 'flow', 'tool', 'eval_suite', 'guardrail', 'mcp_endpoint', 'env', 'secret', 'run', 'artifact', 'policy', 'judgment', 'judge_class', 'provider', 'memory', 'conversation', 'api_key', 'service_account', '*'], str], <kindgi.client._open.OpenEnum object at 0x10700bbd0>]] (domainsMissingAdapter on the wire)
• unpoliced_domains: list[Annotated[Union[Literal['org', 'agent', 'flow', 'tool', 'eval_suite', 'guardrail', 'mcp_endpoint', 'env', 'secret', 'run', 'artifact', 'policy', 'judgment', 'judge_class', 'provider', 'memory', 'conversation', 'api_key', 'service_account', '*'], str], <kindgi.client._open.OpenEnum object at 0x10700bbd0>]] (unpolicedDomains on the wire)
• conflicts: list[kindgi.client.RetentionPolicyConflict] | None (optional)

RetentionSweepBody

• domain: Optional[Annotated[Union[Literal['org', 'agent', 'flow', 'tool', 'eval_suite', 'guardrail', 'mcp_endpoint', 'env', 'secret', 'run', 'artifact', 'policy', 'judgment', 'judge_class', 'provider', 'memory', 'conversation', 'api_key', 'service_account', '*'], str], <kindgi.client._open.OpenEnum object at 0x10700bbd0>]] (optional)
• max_per_domain: int | None (maxPerDomain on the wire) (optional)

RetentionSweepDomainBody

• max_per_domain: int | None (maxPerDomain on the wire) (optional)

RetentionSweepResult

• per_domain: list[kindgi.client.PerDomainItem] (perDomain on the wire)
• total_purged: int (totalPurged on the wire)
• conflicts: list[kindgi.client.RetentionPolicyConflict] | None (optional)

RetrievalHit

• fact: kindgi.client.Fact
• score: float | None (optional)

RetrievalIntent

• source: Optional[Annotated[Union[Literal['facts', 'conversations'], str], <kindgi.client._open.OpenEnum object at 0x10700bbd0>]] (optional)
• types: list[str] | None (optional)
• roles: list[Annotated[Union[Literal['user', 'agent'], str], <kindgi.client._open.OpenEnum object at 0x10700bbd0>]] | None (optional)
• scope: Union[Literal['same-conversation', 'same-user', 'same-segment', 'same-project', 'tenant'], str]
• limit: int | None (optional)
• mode: Optional[Annotated[Union[Literal['keyword', 'semantic', 'both'], str], <kindgi.client._open.OpenEnum object at 0x10700bbd0>]] (optional)

RetrieveIntent

Retrieval intent — mirrors RetrievalIntent from @kindgi/agents, widened for direct-HTTP use. mode: "list" returns a plain scoped list (no query), newest first. mode: "keyword" runs full-text search. mode: "semantic" searches by meaning — it needs embeddings on the deployment; without them the route answers 422 semantic-unavailable. mode: "both" runs both and fuses them by rank (reciprocal rank fusion), as semantic needing embeddings.

• mode: Literal['list', 'keyword', 'semantic', 'both']
• query: str | None (optional)
• type: str | None (optional)
• scope: kindgi.client.FactScope | None (optional)
• limit: int | None (optional)
• embedding_model: str | None (embeddingModel on the wire) (optional)

RetrieveMemoryBody

Retrieval intent — mirrors RetrievalIntent from @kindgi/agents, widened for direct-HTTP use. mode: "list" returns a plain scoped list (no query), newest first. mode: "keyword" runs full-text search. mode: "semantic" searches by meaning — it needs embeddings on the deployment; without them the route answers 422 semantic-unavailable. mode: "both" runs both and fuses them by rank (reciprocal rank fusion), as semantic needing embeddings.

• mode: Literal['list', 'keyword', 'semantic', 'both']
• query: str | None (optional)
• type: str | None (optional)
• scope: kindgi.client.FactScope | None (optional)
• limit: int | None (optional)
• embedding_model: str | None (embeddingModel on the wire) (optional)

RetrieveMemoryResult

• results: list[kindgi.client.RetrievalHit]

Retry

The attempts a retry asks for. In 0.1 nothing acts on it: there's no second attempt.

• max_attempts: int (maxAttempts on the wire)

ReviewDecision

• id: str
• approval_id: uuid.UUID (approvalId on the wire)
• reviewer_id: uuid.UUID (reviewerId on the wire)
• decision: Union[Literal['approve', 'reject', 'escalate', 'withdraw'], str]
• rationale: str | None (optional)
• reviewer_role_at_decision: Union[Literal['standard', 'senior', 'admin'], str] (reviewerRoleAtDecision on the wire)
• decided_at: AwareDatetime (decidedAt on the wire)

ReviewDecisionKind

• root: Literal['approve', 'reject', 'escalate', 'withdraw']

Reviewer

Reviewer roster row. Deactivation is soft (audit trail survives offboarding). deactivatedAt present → reviewer no longer receives approvals.

• id: uuid.UUID
• tenant_id: uuid.UUID (tenantId on the wire)
• user_id: uuid.UUID (userId on the wire)
• role: Union[Literal['standard', 'senior', 'admin'], str]
• display_name: str | None (displayName on the wire) (optional)
• created_at: AwareDatetime (createdAt on the wire)
• deactivated_at: AwareDatetime | None (deactivatedAt on the wire) (optional)

ReviewerCollectionPage

• data: list[kindgi.client.Reviewer]
• next_cursor: str | None (nextCursor on the wire) (optional)
• has_more: bool (hasMore on the wire)

RevokeSessionsResult

• user_id: str (userId on the wire)
• revoked_count: int (revokedCount on the wire)

RevokeSigningKeyBody

• reason: str | None (optional)

RevokeSigningKeyResult

• key_id: str (keyId on the wire)
• revoked: bool

RevokeSystemKeyResult

The revoked system key, and the keys revoked with it because they were minted from it.

• id: str
• label: str | None (optional)
• scopes: list[Annotated[Union[Literal['system:tenants', 'system:tenants:create', 'system:tenants:image-prefix', 'system:tenants:production', 'system:tenants:limits', 'system:tenants:contacts', 'system:tenants:purge', 'system:suspend', 'system:deployments', 'system:pack-env', 'system:usage:read', 'system:license', 'kindgi:system'], str], <kindgi.client._open.OpenEnum object at 0x10700bbd0>]]
• created_at: AwareDatetime (createdAt on the wire)
• expires_at: AwareDatetime | None (expiresAt on the wire) (optional)
• revoked_at: AwareDatetime | None (revokedAt on the wire) (optional)
• minted_by: str (mintedBy on the wire)
• also_revoked: list[str] (alsoRevoked on the wire)

RevokeTokenResult

• token_id: uuid.UUID (tokenId on the wire)
• revoked: Literal[True]

RoleActions

What a project role allows on the project and on every object of each type in it, by object type.

• project: list[Annotated[Union[Literal['read', 'write', 'admin', 'delete'], str], <kindgi.client._open.OpenEnum object at 0x10700bbd0>]]
• agent: list[Annotated[Union[Literal['read', 'write', 'delete', 'admin', 'execute', 'publish', 'promote'], str], <kindgi.client._open.OpenEnum object at 0x10700bbd0>]]
• flow: list[Annotated[Union[Literal['read', 'write', 'delete', 'admin', 'execute', 'publish'], str], <kindgi.client._open.OpenEnum object at 0x10700bbd0>]]
• tool: list[Annotated[Union[Literal['read', 'write', 'delete', 'admin', 'invoke'], str], <kindgi.client._open.OpenEnum object at 0x10700bbd0>]]
• guardrail: list[Annotated[Union[Literal['read', 'write', 'admin', 'delete'], str], <kindgi.client._open.OpenEnum object at 0x10700bbd0>]]
• eval_suite: list[Annotated[Union[Literal['read', 'write', 'delete', 'admin', 'execute', 'publish'], str], <kindgi.client._open.OpenEnum object at 0x10700bbd0>]]
• trigger: list[Annotated[Union[Literal['read', 'write', 'delete', 'admin', 'fire'], str], <kindgi.client._open.OpenEnum object at 0x10700bbd0>]]
• conversation: list[Annotated[Union[Literal['read', 'write', 'admin', 'delete'], str], <kindgi.client._open.OpenEnum object at 0x10700bbd0>]]
• secret: list[Annotated[Union[Literal['read', 'write', 'delete', 'admin', 'rotate'], str], <kindgi.client._open.OpenEnum object at 0x10700bbd0>]]
• env: list[Annotated[Union[Literal['read', 'write', 'admin', 'delete'], str], <kindgi.client._open.OpenEnum object at 0x10700bbd0>]]
• mcp_endpoint: list[Annotated[Union[Literal['read', 'write', 'admin', 'delete'], str], <kindgi.client._open.OpenEnum object at 0x10700bbd0>]]
• run: list[Annotated[Union[Literal['read', 'cancel', 'delete'], str], <kindgi.client._open.OpenEnum object at 0x10700bbd0>]]

RoleCapabilities

What each project role allows, worked out by the runtime from its authorization model. A client decides an action as capabilities[project.role][type] holding it; the server still checks every call. An object can grant more on itself (an agent's own editor), never less, so this is what the caller may do at the least.

• owner: kindgi.client.RoleActions
• admin: kindgi.client.RoleActions
• editor: kindgi.client.RoleActions
• viewer: kindgi.client.RoleActions

RollbackBody

• scope: kindgi.client.LiveScopeTenant | kindgi.client.LiveScopeOrg | kindgi.client.LiveScopeProject | kindgi.client.LiveScopeSegment | kindgi.client.LiveScopeUnrecognized
• to_version: str | None (toVersion on the wire) (optional)
• reason: str | None (optional)

RolledBack

• at: AwareDatetime
• promotion_id: str (promotionId on the wire)
• by: str
• reason: str | None (optional)

RotationStatus

• rotation_id: uuid.UUID (rotationId on the wire)
• status: Union[Literal['pending', 'succeeded', 'failed'], str]
• started_at: AwareDatetime (startedAt on the wire)
• updated_at: AwareDatetime (updatedAt on the wire)
• new_version_id: int | None (newVersionId on the wire) (optional)
• old_version_id: int | None (oldVersionId on the wire) (optional)
• error: str | None (optional)

Run

• id: uuid.UUID
• tenant_id: uuid.UUID (tenantId on the wire)
• project_id: uuid.UUID | None (projectId on the wire) (optional)
• flow_id: str (flowId on the wire)
• flow_version: str (flowVersion on the wire)
• status: Union[Literal['pending', 'running', 'suspended', 'completed', 'failed', 'cancelled'], str]
• dry_run: bool (dryRun on the wire)
• created_at: AwareDatetime (createdAt on the wire)
• updated_at: AwareDatetime (updatedAt on the wire)
• completed_at: AwareDatetime | None (completedAt on the wire) (optional)
• failure_message: str | None (failureMessage on the wire) (optional)
• failure: kindgi.client.RunFailure | None (optional)
• output: Any | None (optional)
• content_erased_at: AwareDatetime | None (contentErasedAt on the wire) (optional)
• parent_run_id: uuid.UUID | None (parentRunId on the wire) (optional)
• parent_node_id: str | None (parentNodeId on the wire) (optional)
• agent: kindgi.client.RunAgent | None (optional)
• waiting_for: kindgi.client.RunWaitingFor | None (waitingFor on the wire) (optional)
• trigger: kindgi.client.RunTrigger | None (optional)
• started_by: Optional[Annotated[Union[Literal['person', 'key', 'schedule', 'webhook', 'event'], str], <kindgi.client._open.OpenEnum object at 0x10700bbd0>]] (startedBy on the wire) (optional)
• replay_of: uuid.UUID | None (replayOf on the wire) (optional)
• eval_run_id: str | None (evalRunId on the wire) (optional)
• versions: kindgi.client.FlowVersionOverrides | None (optional)
• segments: list[kindgi.client.ScopeSegment] | None (optional)
• trace_id: str | None (traceId on the wire) (optional)
• public_access_token: str | None (publicAccessToken on the wire) (optional)
• public_access_token_expires_at: AwareDatetime | None (publicAccessTokenExpiresAt on the wire) (optional)

RunAgent

Set on an agent's turn (an agent run, or the turn a flow's agent step started): the agent, the version that ran and the conversation. Absent on other runs, and on turns that ran before Kindgi 0.1.3.

• id: str
• version: str
• conversation_id: uuid.UUID (conversationId on the wire)
• via: Optional[Annotated[Union[Literal['explicit', 'flow-pin', 'conversation', 'live', 'latest'], str], <kindgi.client._open.OpenEnum object at 0x10700bbd0>]] (optional)
• live_scope: Optional[Annotated[kindgi.client.LiveScopeTenant | kindgi.client.LiveScopeOrg | kindgi.client.LiveScopeProject | kindgi.client.LiveScopeSegment | kindgi.client.LiveScopeUnrecognized, <kindgi.client._open.OpenUnion object at 0x107c39850>]] (liveScope on the wire) (optional)

RunCollectionPage

• data: list[kindgi.client.Datum]
• next_cursor: str | None (nextCursor on the wire) (optional)
• has_more: bool (hasMore on the wire)

RunEvent

• event_id: str (eventId on the wire)
• run_id: str (runId on the wire)
• tenant_id: str (tenantId on the wire)
• timestamp: AwareDatetime
• kind: Union[Literal['run.queued', 'run.started', 'run.step-started', 'run.step-completed', 'run.step-failed', 'run.step-retry-scheduled', 'run.iteration-started', 'run.iteration-completed', 'run.tool-invoked', 'run.tool-result', 'run.model-token', 'run.artifact-produced', 'run.guardrail-violated', 'run.wait-suspended', 'run.wait-resumed', 'run.approval-requested', 'run.approval-completed', 'run.completed', 'run.failed', 'run.cancelled'], str]
• sequence: int | None (optional)
• node_id: str | None (nodeId on the wire) (optional)
• payload: Any | None (optional)

RunFailure

Why a failed run failed; present only on a failed run. An agent turn's failure carries its own code (budget-exceeded, capability-routing-failed, model-invocation-failed, …; rate-limit-exceeded when a budget kept per tenant refused work the turn needed, with details naming the budget); any other failure is run-failed, with the run's failure message.

• code: str
• message: str
• cause: Any | None (optional)
• reason: str | None (optional)
• details: dict[str, Any] | None (optional)

RunFailureGroups

• from_: AwareDatetime (from on the wire)
• to: AwareDatetime
• groups: list[kindgi.client.FailureGroup]
• outcomes: list[kindgi.client.FailureGroup]
• unrecorded: list[kindgi.client.FailureGroup]
• total: int

RunFinishedEvent

• id: str
• type: Literal['run.finished']
• created_at: AwareDatetime (createdAt on the wire)
• data: kindgi.client.Data

RunId

• root: str

RunJournalPage

• data: list[kindgi.client.Datum1]
• has_more: bool (hasMore on the wire)
• next_cursor: str | None (nextCursor on the wire) (optional)

RunProgress

A run's progress: status and timing, without its input, output, failure message or tenant. Safe to show in a browser.

• id: uuid.UUID
• flow_id: str (flowId on the wire)
• flow_version: str (flowVersion on the wire)
• status: Union[Literal['pending', 'running', 'suspended', 'completed', 'failed', 'cancelled'], str]
• created_at: AwareDatetime (createdAt on the wire)
• updated_at: AwareDatetime (updatedAt on the wire)
• completed_at: AwareDatetime | None (completedAt on the wire) (optional)
• parent_run_id: uuid.UUID | None (parentRunId on the wire) (optional)

RunProgressEvent

A run event without its payload: what happened, on which node, when.

• event_id: str (eventId on the wire)
• run_id: str (runId on the wire)
• timestamp: AwareDatetime
• kind: str
• sequence: int
• node_id: str | None (nodeId on the wire) (optional)

RunStatus

• root: Literal['pending', 'running', 'suspended', 'completed', 'failed', 'cancelled']

RunTreeUsage

The model calls of the run tree (this run and every run it started) that the cost ledger had recorded when this run finished: a child run still running then isn't in it. calls counts failed calls too. Absent when the runtime records no usage.

• calls: int
• cost_usd: float (costUsd on the wire)
• tokens: kindgi.client.CostTokenTotals

RunTrigger

Set on a run a trigger started: the trigger and the fire that started it. Absent on other runs. The runtime fires schedules only; event and webhook are kept for event triggers and inbound webhooks, which aren't served yet.

• trigger_id: uuid.UUID (triggerId on the wire)
• kind: Union[Literal['schedule', 'event', 'webhook'], str]
• fire_id: str (fireId on the wire)
• scheduled_for: AwareDatetime | None (scheduledFor on the wire) (optional)

RunWaitingApproval

An approval the run waits for, as a run reader sees it: its identity and state. Its subject's details, description, context and decision stay on GET /v1/approvals/{approvalId}, behind the reviewer gate.

• approval_id: uuid.UUID (approvalId on the wire)
• status: str
• required_role: str (requiredRole on the wire)
• title: str | None (optional)
• created_at: AwareDatetime (createdAt on the wire)
• expires_at: AwareDatetime | None (expiresAt on the wire) (optional)
• subject_kind: str (subjectKind on the wire)
• tool: kindgi.client.RunWaitingApprovalTool | None (optional)

RunWaitingApprovalTool

For a tool call held for review: which tool and which call. Never the call's arguments.

• id: str
• version: str
• call_id: str (callId on the wire)

RunWaitingFor

Set on a suspended run by GET /v1/runs/{runId} (not the list): what it waits for, its journal's open waits. approvals: those still to be decided, linked to the waits. other: the rest. Absent from a runtime before Kindgi 0.1.6, or when the journal can't be read; kindgi runs resume then works it out itself.

• approvals: list[kindgi.client.RunWaitingApproval]
• other: list[kindgi.client.OtherItem]

RuntimeLimits

Sandbox-enforced resource caps at dispatch. Optional additive field.

• mem_mb: int (memMB on the wire)
• cpu_ms: int (cpuMs on the wire)