# Models: S > API models starting with S. ## `SamlIdentityProviderConfig` A SAML 2.0 identity provider people sign in with: its metadata XML, or its entity ID, single sign-on URL and signing certificates. Keys are given as references, never as keys. - `provider_id: str` (`providerId` on the wire) - `display_name: str | None` (`displayName` on the wire) (optional) - `domains: list[kindgi.client.Domain] | None` (optional) - `join: Optional[Annotated[Union[Literal['invite', 'domain'], str], ]]` (optional) - `sign_in: kindgi.client.IdentityProviderSignIn1 | kindgi.client.IdentityProviderSignIn2 | None` (`signIn` on the wire) (optional) - `metadata: dict[str, Any] | None` (optional) - `kind: Literal['saml']` - `idp_metadata_xml: str | None` (`idpMetadataXml` on the wire) (optional) - `idp_entity_id: str | None` (`idpEntityId` on the wire) (optional) - `idp_sso_url: AnyUrl | None` (`idpSsoUrl` on the wire) (optional) - `idp_certificates: list[kindgi.client.IdpCertificate] | None` (`idpCertificates` on the wire) (optional) - `sp_signing_key_ref: str | None` (`spSigningKeyRef` on the wire) (optional) - `sp_decryption_key_ref: str | None` (`spDecryptionKeyRef` on the wire) (optional) - `want_assertions_signed: bool | None` (`wantAssertionsSigned` on the wire) (optional) - `attribute_mapping: kindgi.client.AttributeMapping | None` (`attributeMapping` on the wire) (optional) ## `Sampling` - `models: list[kindgi.client.Model3]` ## `ScheduleCollectionPage` - `data: list[kindgi.client.ScheduleRecord]` - `next_cursor: str | None` (`nextCursor` on the wire) (optional) - `has_more: bool` (`hasMore` on the wire) ## `ScheduleFire` One fire of a schedule (an occurrence, or a `run-now`) and what came of it. `pending` while its run is being started. - `fire_id: str` (`fireId` on the wire) - `schedule_id: str` (`scheduleId` on the wire) - `trigger_id: str` (`triggerId` on the wire) - `scheduled_for: AwareDatetime | None` (`scheduledFor` on the wire) (optional) - `fired_at: AwareDatetime` (`firedAt` on the wire) - `outcome: Union[Literal['pending', 'started', 'skipped-overlap', 'skipped-erasure', 'skipped', 'refused', 'failed'], str]` - `run_id: uuid.UUID | None` (`runId` on the wire) (optional) - `pass_id: uuid.UUID | None` (`passId` on the wire) (optional) - `detail: str | None` (optional) - `counts_toward_pause: bool | None` (`countsTowardPause` on the wire) (optional) - `missed_count: int | None` (`missedCount` on the wire) (optional) - `manual: bool | None` (optional) ## `ScheduleFirePage` - `data: list[kindgi.client.ScheduleFire]` - `has_more: bool` (`hasMore` on the wire) - `next_cursor: str | None` (`nextCursor` on the wire) (optional) ## `ScheduleRecord` A schedule: what it runs (a flow at a version, or an agent), when (a cron expression in a timezone), as whom (its owner), and what it does after a gap or while a run is still going. - `schedule_id: str` (`scheduleId` on the wire) - `trigger_id: str` (`triggerId` on the wire) - `flow_id: str | None` (`flowId` on the wire) (optional) - `flow_version: str | None` (`flowVersion` on the wire) (optional) - `agent_id: str | None` (`agentId` on the wire) (optional) - `agent_version: str | None` (`agentVersion` on the wire) (optional) - `improve: kindgi.client.ImproveScheduleTarget | None` (optional) - `project_id: uuid.UUID | None` (`projectId` on the wire) (optional) - `owner: kindgi.client.TriggerOwner | None` (optional) - `cron_expression: str` (`cronExpression` on the wire) - `timezone: str | None` (optional) - `input: Any | None` (optional) - `catch_up: Optional[Annotated[Union[Literal['latest', 'skip'], str], ]]` (`catchUp` on the wire) (optional) - `overlap: Optional[Annotated[Union[Literal['skip', 'allow'], str], ]]` (optional) - `starting_deadline_seconds: int | None` (`startingDeadlineSeconds` on the wire) (optional) - `label: str | None` - `status: Union[Literal['active', 'paused'], str]` - `status_reason: str | None` (`statusReason` on the wire) (optional) - `next_fire_at: AwareDatetime | None` (`nextFireAt` on the wire) - `upcoming: list[AwareDatetime] | None` (optional) - `last_fired_at: AwareDatetime | None` (`lastFiredAt` on the wire) - `created_at: AwareDatetime` (`createdAt` on the wire) - `updated_at: AwareDatetime` (`updatedAt` on the wire) ## `ScheduleUnregisterResult` - `schedule_id: str` (`scheduleId` on the wire) - `unregistered: bool` ## `ScopeOrg` Discriminated Scope primitive (Tenant / Org / Project). Source of truth: `Scope` in `@kindgi/platform`. - `kind: Literal['org']` - `tenant_id: str` (`tenantId` on the wire) - `org_id: str` (`orgId` on the wire) ## `ScopeProject` Discriminated Scope primitive (Tenant / Org / Project). Source of truth: `Scope` in `@kindgi/platform`. - `kind: Literal['project']` - `tenant_id: str` (`tenantId` on the wire) - `project_id: str` (`projectId` on the wire) ## `ScopeSegment` - `key: str` - `value: str` ## `ScopeTenant` Discriminated Scope primitive (Tenant / Org / Project). Source of truth: `Scope` in `@kindgi/platform`. - `kind: Literal['tenant']` - `tenant_id: str` (`tenantId` on the wire) ## `ScopeUnrecognized` A `kind` this client doesn't know yet, from a newer runtime: the object as it came, every field kept. - `kind: str` ## `SecondFactor` - `required: bool` - `on_previous_secret: int` (`onPreviousSecret` on the wire) - `unusable: int` ## `SecondFactor1` - `required: bool` ## `SecondFactorConfirmBody` A code from the new key, as the authenticator app shows it. - `code: str` ## `SecondFactorKey` A new key to set up, shown this once: `uri` for an authenticator app (as a QR code), `key` to type in. Nothing changes until it is confirmed. - `key: str` - `uri: str` ## `SecondFactorProof` Exactly one: a code from the authenticator app, or one of the recovery codes (used up by this). - `code: str | None` (optional) - `recovery_code: str | None` (`recoveryCode` on the wire) (optional) ## `SecondFactorRecoveryCodes` The 10 recovery codes, shown this once. Each signs in once in place of a code from the app; any earlier ones stop working. - `recovery_codes: list[str]` (`recoveryCodes` on the wire) ## `SecondFactorRemoved` `false` when there was none to remove. - `removed: bool` ## `SecondFactorStatus` A person's second factor, and whether their workspace requires one. With `setUp`, `since`, `recoveryCodesLeft` and `usable` are given; without it, `started`. Never a key or a code. - `set_up: bool` (`setUp` on the wire) - `started: bool | None` (optional) - `since: AwareDatetime | None` (optional) - `recovery_codes_left: int | None` (`recoveryCodesLeft` on the wire) (optional) - `usable: bool | None` (optional) - `required: bool` ## `SecretCollectionPage` - `data: list[kindgi.client.SecretRecord]` - `has_more: bool | None` (`hasMore` on the wire) (optional) - `next_cursor: str | None` (`nextCursor` on the wire) (optional) ## `SecretListPage` - `data: list[kindgi.client.SecretRecord]` - `next_cursor: str | None` (`nextCursor` on the wire) (optional) ## `SecretRecord` - `scope: kindgi.client.ScopeTenant | kindgi.client.ScopeOrg | kindgi.client.ScopeProject | kindgi.client.ScopeUnrecognized` - `env_name: str` (`envName` on the wire) - `name: str` - `current_version: int` (`currentVersion` on the wire) - `created_at: AwareDatetime` (`createdAt` on the wire) - `updated_at: AwareDatetime` (`updatedAt` on the wire) - `revoked_at: AwareDatetime | None` (`revokedAt` on the wire) (optional) - `revoke_reason: str | None` (`revokeReason` on the wire) (optional) - `tags: dict[str, str] | None` (optional) - `rotation_due_at: AwareDatetime | None` (`rotationDueAt` on the wire) (optional) ## `SecretRef` The tenant secret holding the adapter's credential (an API key, a service-account key). Absent when the adapter needs none or finds its own (a cloud's default credentials). - `env_name: str` (`envName` on the wire) - `name: str` ## `SecretRef1` The secret the provider's key resolves from, by name only, never its value. Present when the registration has one. Only a caller allowed to check the provider sees it. `kindgi dev` uses it to keep a provider's key out of the pack service's environment. A runtime before 0.1.6 leaves it out. - `env_name: str` (`envName` on the wire) - `name: str` ## `SecretResolveOutcome` - `name: str` - `version_id: int` (`versionId` on the wire) - `value: str` - `scope: Optional[Annotated[kindgi.client.ScopeTenant | kindgi.client.ScopeOrg | kindgi.client.ScopeProject | kindgi.client.ScopeUnrecognized, ]]` (optional) ## `SecretRevokeOutcome` - `revoked: bool` - `hard: bool` ## `SecretRevokeResult` - `revoked: bool` - `hard: bool` ## `SecretRotateOutcome` - `root: kindgi.client.SecretRotateOutcomeOk | kindgi.client.SecretRotateOutcomeRotationPending` ## `SecretRotateOutcomeOk` - `kind: Literal['ok']` - `new_version_id: int` (`newVersionId` on the wire) - `old_version_id: int` (`oldVersionId` on the wire) - `old_version_revoked_at: AwareDatetime | None` (`oldVersionRevokedAt` on the wire) (optional) ## `SecretRotateOutcomeRotationPending` - `kind: Literal['rotation-pending']` - `resume_token: str` (`resumeToken` on the wire) - `provider: str` ## `SecretRotateRequest` - `scope: Optional[Annotated[kindgi.client.ScopeTenant | kindgi.client.ScopeOrg | kindgi.client.ScopeProject | kindgi.client.ScopeUnrecognized, ]]` (optional) - `env_name: str | None` (`envName` on the wire) (optional) - `new_value: str | None` (`newValue` on the wire) (optional) - `revoke_old_after_ms: int | None` (`revokeOldAfterMs` on the wire) (optional) ## `SecretRotateResponseAsync` - `kind: Literal['async']` - `rotation_id: uuid.UUID` (`rotationId` on the wire) - `status_url: str` (`statusUrl` on the wire) - `events_url: str` (`eventsUrl` on the wire) ## `SecretRotateResponseSync` - `kind: Literal['sync']` - `new_version_id: int` (`newVersionId` on the wire) - `old_version_id: int` (`oldVersionId` on the wire) - `old_version_revoked_at: AwareDatetime | None` (`oldVersionRevokedAt` on the wire) (optional) ## `SecretSetInput` - `scope: kindgi.client.ScopeTenant | kindgi.client.ScopeOrg | kindgi.client.ScopeProject | kindgi.client.ScopeUnrecognized` - `env_name: str` (`envName` on the wire) - `name: str` - `value: str` - `write_mode: Literal['create-new', 'add-version']` (`writeMode` on the wire) - `tags: dict[str, str] | None` (optional) - `rotation_due_at: AwareDatetime | None` (`rotationDueAt` on the wire) (optional) - `if_version: int | None` (`ifVersion` on the wire) (optional) ## `SecretSetOutcome` - `root: kindgi.client.SecretSetOutcomeOk | kindgi.client.SecretSetOutcomeAlreadyExists | kindgi.client.SecretSetOutcomeVersionConflict | kindgi.client.SecretSetOutcomeError` ## `SecretSetOutcomeAlreadyExists` - `kind: Literal['already-exists']` - `record: kindgi.client.SecretRecord` ## `SecretSetOutcomeError` - `kind: Literal['error']` - `code: str` - `message: str` ## `SecretSetOutcomeOk` - `kind: Literal['ok']` - `record: kindgi.client.SecretRecord` - `version_id: int` (`versionId` on the wire) ## `SecretSetOutcomeVersionConflict` - `kind: Literal['version-conflict']` - `current_version: int` (`currentVersion` on the wire) ## `SecretSetRequest` - `scope: kindgi.client.ScopeTenant | kindgi.client.ScopeOrg | kindgi.client.ScopeProject | kindgi.client.ScopeUnrecognized` - `env_name: str` (`envName` on the wire) - `name: str` - `value: str` - `write_mode: Literal['create-new', 'add-version']` (`writeMode` on the wire) - `tags: dict[str, str] | None` (optional) - `rotation_due_at: AwareDatetime | None` (`rotationDueAt` on the wire) (optional) - `if_version: int | None` (`ifVersion` on the wire) (optional) - `app_env_file: bool | None` (`appEnvFile` on the wire) (optional) ## `SecretSetResponse` - `record: kindgi.client.SecretRecord` - `version_id: int` (`versionId` on the wire) ## `SecretVersionCollectionPage` - `data: list[kindgi.client.SecretVersionRecord]` - `has_more: bool | None` (`hasMore` on the wire) (optional) - `next_cursor: str | None` (`nextCursor` on the wire) (optional) ## `SecretVersionRecord` - `scope: kindgi.client.ScopeTenant | kindgi.client.ScopeOrg | kindgi.client.ScopeProject | kindgi.client.ScopeUnrecognized` - `env_name: str` (`envName` on the wire) - `name: str` - `version_id: int` (`versionId` on the wire) - `created_at: AwareDatetime` (`createdAt` on the wire) - `value: str | None` (optional) - `revoked_at: AwareDatetime | None` (`revokedAt` on the wire) (optional) ## `Secrets` - `name: str` - `ref: str` ## `Secrets1` - `name: str` - `value: str` ## `ServedEnv` The env this runtime serves (`KINDGI_ENV`): where the values its tools read are kept. With `refusesOtherEnvs`, it's the only one: a secret, env value or secret reference under another env is refused (`409 env-not-served`), so a client defaults to `envName`. Absent when the runtime serves no env, and from older servers. - `env_name: str` (`envName` on the wire) - `refuses_other_envs: bool` (`refusesOtherEnvs` on the wire) ## `ServiceAccount` A named, non-human principal (`service_account:`) for an app, a pipeline or a schedule. It acts through API keys minted for it. - `service_account_id: str` (`serviceAccountId` on the wire) - `name: str` - `description: str | None` (optional) - `grants: list[Annotated[kindgi.client.ServiceAccountGrantTenantAdmin | kindgi.client.ServiceAccountGrantTenantMember | kindgi.client.ServiceAccountGrantProject | kindgi.client.ServiceAccountGrantUnrecognized, ]]` - `created_by: str | None` (`createdBy` on the wire) (optional) - `created_at: AwareDatetime` (`createdAt` on the wire) - `unregistered_at: AwareDatetime | None` (`unregisteredAt` on the wire) (optional) ## `ServiceAccountGrantBody` - `root: kindgi.client.ServiceAccountGrantTenantAdmin | kindgi.client.ServiceAccountGrantTenantMember | kindgi.client.ServiceAccountGrantProjectBody` ## `ServiceAccountGrantProject` A role on one project; it replaces the account's role there. - `kind: Literal['project']` - `project_id: uuid.UUID` (`projectId` on the wire) - `role: Union[Literal['viewer', 'editor', 'owner', 'admin', 'member'], str]` ## `ServiceAccountGrantProjectBody` A role to give on one project; it replaces the account's role there. - `kind: Literal['project']` - `project_id: uuid.UUID` (`projectId` on the wire) - `role: Literal['viewer', 'editor', 'owner', 'admin']` ## `ServiceAccountGrantTenantAdmin` Tenant admin. - `kind: Literal['tenant-admin']` ## `ServiceAccountGrantTenantMember` Tenant member: read the tenant's settings (providers, policies, adapters, signing keys, deployments), not its projects. A service account has it only when granted; a person has it from being added. - `kind: Literal['tenant-member']` ## `ServiceAccountGrantUnrecognized` A `kind` this client doesn't know yet, from a newer runtime: the object as it came, every field kept. - `kind: str` ## `ServiceAccountPage` - `data: list[kindgi.client.ServiceAccount]` - `has_more: bool` (`hasMore` on the wire) - `next_cursor: str | None` (`nextCursor` on the wire) (optional) ## `ServiceAccountUngrantBody` - `root: kindgi.client.ServiceAccountGrantTenantAdmin | kindgi.client.ServiceAccountGrantTenantMember | kindgi.client.ServiceAccountUngrantProject` ## `ServiceAccountUngrantProject` Whatever role the account has on one project. - `kind: Literal['project']` - `project_id: uuid.UUID` (`projectId` on the wire) ## `SessionApproval` The reviewer's decision at the turn's session approval gate, when the turn waited on one. A replay of the turn follows it. - `approved: bool` - `rationale: str | None` (optional) ## `SetPackEndpointBody` - `url: str` - `auth: Literal['google-id-token', 'token']` - `token: str` - `pack_env_revision: str | None` (`packEnvRevision` on the wire) (optional) ## `SetPackSuspendedBody` - `suspended: bool` - `reason: str | None` (optional) ## `SetTenantImagePrefixBody` - `prefix: str` ## `SetTenantSuspendedBody` - `suspended: bool` - `reason: str | None` (optional) ## `SettingsBlockContent` - `values: dict[str, Any]` - `schema_: dict[str, Any] | None` (`schema` on the wire) (optional) ## `SignInEvent` One sign-in audit event, flattened: who signed in or out, how, from where, and what was refused. - `id: str` - `timestamp: AwareDatetime` - `kind: Union[Literal['signed-in', 'signed-out', 'sign-in-refused', 'sign-in-link-sent', 'sign-in-link-capped', 'sessions-revoked', 'sessions-ended', 'second-factor-set-up', 'second-factor-removed', 'recovery-codes-replaced'], str]` - `outcome: str` - `user_id: str | None` (`userId` on the wire) (optional) - `method: str | None` (optional) - `client_address: str | None` (`clientAddress` on the wire) (optional) - `reason: str | None` (optional) - `session_id: str | None` (`sessionId` on the wire) (optional) - `by_user_id: str | None` (`byUserId` on the wire) (optional) ## `SignInOption` One way to sign in, as a sign-in page shows it. - `provider_id: str` (`providerId` on the wire) - `display_name: str` (`displayName` on the wire) - `sign_in_url: str` (`signInUrl` on the wire) - `owner: Optional[Annotated[Union[Literal['tenant', 'deployment'], str], ]]` (optional) ## `SignInOptions` - `data: list[kindgi.client.SignInOption]` - `methods: kindgi.client.Methods | None` (optional) - `legal: kindgi.client.Legal | None` (optional) ## `Signature` Runtime-side signature attached at emission time (if the deployment signs on write). Independent of the export-time signature returned by the export route. - `algorithm: Literal['ed25519']` - `key_id: str` (`keyId` on the wire) - `value: str` - `signed_at: AwareDatetime` (`signedAt` on the wire) ## `Signature1` - `algorithm: Literal['ed25519']` - `key_id: str` (`keyId` on the wire) - `value: str` - `signed_at: AwareDatetime` (`signedAt` on the wire) ## `SignedComplianceEvidenceBundle` Signed compliance evidence. Body: `{ bundleSchemaVersion, tenantId, filter, records, recordCount, exportedAt }`. - `tenant_id: uuid.UUID` (`tenantId` on the wire) - `kind: Optional[Literal['compliance']]` (optional) - `bundle: str` - `bundle_schema_version: str` (`bundleSchemaVersion` on the wire) - `algorithm: Union[Literal['ed25519', 'ecdsa-p256-sha256'], str]` - `signing_key_id: str` (`signingKeyId` on the wire) - `signature: str` - `public_key: str` (`publicKey` on the wire) - `canonicalization: Literal['sorted-key-json']` - `exported_at: AwareDatetime` (`exportedAt` on the wire) ## `Site` A site that signs its own people in to one project: it vouches for whoever is signed in there, so they ask the project's agents and decide its approvals as themselves. Each person it signs in is a person of the tenant, shown as "\, via \". - `site_id: uuid.UUID` (`siteId` on the wire) - `project_id: uuid.UUID` (`projectId` on the wire) - `display_name: str` (`displayName` on the wire) - `origin: str` - `approvals_url: str` (`approvalsUrl` on the wire) - `allowed_roles: list[kindgi.client.AllowedRole]` (`allowedRoles` on the wire) - `role_map: dict[str, kindgi.client.SiteRoleGrant]` (`roleMap` on the wire) - `reviewer_ceiling: Union[Literal['standard', 'senior'], str]` (`reviewerCeiling` on the wire) - `vouching: bool` - `people_cap: int` (`peopleCap` on the wire) - `new_people_per_day: int` (`newPeoplePerDay` on the wire) - `keys: list[kindgi.client.SiteKey]` - `audience: str | None` (optional) - `created_at: AwareDatetime` (`createdAt` on the wire) - `created_by: str | None` (`createdBy` on the wire) (optional) - `paused_at: AwareDatetime | None` (`pausedAt` on the wire) (optional) - `unregistered_at: AwareDatetime | None` (`unregisteredAt` on the wire) (optional) ## `SiteCollectionPage` - `data: list[kindgi.client.Site]` - `next_cursor: str | None` (`nextCursor` on the wire) (optional) - `has_more: bool` (`hasMore` on the wire) ## `SiteEnrollmentCode` A one-time code the site posts with its public key (`POST /v1/auth/sites/enroll`). Shown once. Using it replaces the site's keys and ends its live sessions. - `code: str` - `expires_at: AwareDatetime` (`expiresAt` on the wire) ## `SiteKey` One of the site's live public keys. Kindgi never has a private half. - `kid: str` - `thumbprint: str` - `added_at: AwareDatetime` (`addedAt` on the wire) ## `SiteRoleGrant` What a person with one of the site's roles gets in the site's project. Reading the project comes with every role; nothing above it ever does. - `ask: bool` - `reviewer: Optional[Annotated[Union[Literal['standard', 'senior'], str], ]]` (optional) ## `SiteSignInBody` - `statement: str` ## `SiteSignInResult` - `token: str` - `expires_at: AwareDatetime` (`expiresAt` on the wire) - `user_id: str` (`userId` on the wire) - `actor: str` - `project_id: uuid.UUID` (`projectId` on the wire) ## `SourceFreshness` - `ttl_seconds: int | None` (`ttlSeconds` on the wire) (optional) - `last_verified_at: AwareDatetime | None` (`lastVerifiedAt` on the wire) (optional) - `etag: str | None` (optional) - `source_version: str | None` (`sourceVersion` on the wire) (optional) ## `SourceRefresh` - `strategy: Union[Literal['on-read', 'background', 'manual'], str]` - `handler: str | None` (optional) - `priority: int | None` (optional) ## `StartEvalRunBody` Exactly one of `agentRef` or `flowRef` MUST be supplied. `dryRun: true` returns a plan preview without invoking the subject. For a `judged` suite (a test set), the run is a comparison: `agentRef` or `flowRef` with its `version` is the candidate, replayed on each case without doing anything the past run didn't (a flow stops at a write the replay refuses); `baseline` (default `'recorded'`), `reads` (default `recorded`), `repetitions` (default 1) and `k` (default 10) set how. With `flowRef`, `versions` runs the flow with some of its agents or tools at other versions; an id the flow doesn't use, or a version that isn't published, is refused (`400 validation-failed`, each under `details.issues`). - `project_id: uuid.UUID` (`projectId` on the wire) - `agent_ref: kindgi.client.EvalRunAgentRef | None` (`agentRef` on the wire) (optional) - `flow_ref: kindgi.client.EvalRunFlowRef | None` (`flowRef` on the wire) (optional) - `dry_run: bool | None` (`dryRun` on the wire) (optional) - `correlation_id: str | None` (`correlationId` on the wire) (optional) - `baseline: Union[Annotated[Union[Literal['recorded'], str], ], kindgi.client.EvalBaseline1, kindgi.client.EvalBaseline2, NoneType]` (optional) - `reads: Optional[Literal['recorded', 'live']]` (optional) - `repetitions: int | None` (optional) - `k: int | None` (optional) - `versions: kindgi.client.FlowVersionOverrides | None` (optional) - `class_weights: Optional[Literal['as-recorded', 'restricted-only']]` (`classWeights` on the wire) (optional) - `overrides: kindgi.client.EvalOverrides | None` (optional) - `sample: kindgi.client.EvalSample | None` (optional) ## `StartEvalRunResult` - `run_id: uuid.UUID` (`runId` on the wire) - `dry_run_preview: dict[str, Any] | None` (`dryRunPreview` on the wire) (optional) ## `StartRunBody` - `root: kindgi.client.StartRunBody1 | kindgi.client.StartRunBody2` ## `StartRunBody1` Start a run. Exactly one of `agent` or `flow` MUST be supplied (single Run primitive). - `agent: str` - `agent_version: str | None` (`agentVersion` on the wire) (optional) - `project_id: uuid.UUID | None` (`projectId` on the wire) (optional) - `segments: list[kindgi.client.ScopeSegment] | None` (optional) - `input: Any` - `options: kindgi.client.Options | None` (optional) ## `StartRunBody2` Start a run. Exactly one of `agent` or `flow` MUST be supplied (single Run primitive). - `flow: str` - `flow_version: str | None` (`flowVersion` on the wire) (optional) - `project_id: uuid.UUID | None` (`projectId` on the wire) (optional) - `segments: list[kindgi.client.ScopeSegment] | None` (optional) - `input: Any` - `options: kindgi.client.Options | None` (optional) ## `StartRunOptions` - `dry_run: bool | None` (`dryRun` on the wire) (optional) - `wait: bool | None` (optional) ## `Step` - `run_id: str` (`runId` on the wire) - `node_id: str | None` (`nodeId` on the wire) (optional) - `scope: str | None` (optional) - `agent_id: str` (`agentId` on the wire) - `agent_version: str` (`agentVersion` on the wire) - `retrieved: Any | None` (optional) - `recalled: Any | None` (optional) ## `Stopped` Set when the replay stopped at a refused write: what it would have done. - `tool_id: str` (`toolId` on the wire) - `arguments: Any` - `reason: str | None` (optional) ## `Subject` - `kind: Union[Literal['participant', 'external'], str]` - `id: str` ## `Subject1` - `kind: str | None` (optional) - `id: str | None` (optional) ## `SuccessStatus` - `min: int` - `max: int` ## `Suite` - `id: str` - `version: str | None` (optional) ## `Suite1` - `id: str` - `version: str` ## `SupersedeFactBody` The fact's next revision: new `content`, and optionally new `retention`, `subjects` and times (absent ones keep their current values). Its scope and type stay. `expectVersion`: only if the current revision is still this one. - `content: Any` - `expect_version: int | None` (`expectVersion` on the wire) (optional) - `retention: kindgi.client.Retention | None` (optional) - `subjects: list[kindgi.client.FactSubject] | None` (optional) - `valid_from: AwareDatetime | None` (`validFrom` on the wire) (optional) - `valid_until: AwareDatetime | None` (`validUntil` on the wire) (optional) - `observed_at: AwareDatetime | None` (`observedAt` on the wire) (optional) ## `SuppressedRefusals` Refusals and skipped deliveries this minute past the 20 recorded in its history, which only counted. - `since: AwareDatetime` - `count: int` ## `SystemDeploymentEntry` A deployment as whatever runs its pack service needs it: ids and the image, nothing of the tenant beyond its id. Name the service `packServiceName(tenantId, deploymentId)` (`@kindgi/api`). In the `retire` list, `reason` says why the service should go. - `tenant_id: uuid.UUID` (`tenantId` on the wire) - `deployment_id: str` (`deploymentId` on the wire) - `pack_id: str` (`packId` on the wire) - `project_id: str | None` (`projectId` on the wire) (optional) - `image_ref: str` (`imageRef` on the wire) - `image_digest: str` (`imageDigest` on the wire) - `artifact_version: str` (`artifactVersion` on the wire) - `activated_at: AwareDatetime` (`activatedAt` on the wire) - `reason: Optional[Annotated[Union[Literal['superseded', 'tenant-closing', 'tenant-suspended', 'project-suspended', 'pack-suspended'], str], ]]` (optional) ## `SystemDeploymentPage` - `data: list[kindgi.client.SystemDeploymentEntry]` - `next_cursor: str | None` (`nextCursor` on the wire) (optional) - `has_more: bool` (`hasMore` on the wire) ## `SystemKey` A system key (`kgi_sy_…`): the operator's, acting in no tenant. Never its secret. - `id: str` - `label: str | None` (optional) - `scopes: list[Literal['system:tenants', 'system:tenants:create', 'system:tenants:image-prefix', 'system:tenants:production', 'system:tenants:limits', 'system:tenants:contacts', 'system:tenants:purge', 'system:suspend', 'system:deployments', 'system:pack-env', 'system:license', 'kindgi:system']]` - `created_at: AwareDatetime` (`createdAt` on the wire) - `expires_at: AwareDatetime | None` (`expiresAt` on the wire) (optional) - `revoked_at: AwareDatetime | None` (`revokedAt` on the wire) (optional) - `minted_by: str` (`mintedBy` on the wire) ## `SystemKeyList` - `data: list[kindgi.client.Datum2]` ## `SystemOpenapiResponse` ## `SystemPackEnv` What the deployment's pack service is to be given: where each declared name is set, and the values when nothing stands in the way, plain ones in `env` and, when asked for (`secrets=values`), secrets in `secrets`. Each value given out is on the audit record: `env-resolved` as the deployment's system read, and `secret-resolved` (caller `pack-env`, with the request id as its `correlationId` and the system key's id), written before the answer. - `revision: str` - `names: list[kindgi.client.PackEnvNameStatus]` - `problem: Optional[Annotated[Union[Literal['pack-env-ambiguous', 'pack-env-secret-not-yet', 'pack-env-missing', 'pack-env-secret-unreadable'], str], ]]` (optional) - `env: dict[str, str] | None` (optional) - `secrets: dict[str, kindgi.client.PackEnvSecretValue] | None` (optional) ## `SystemPackEnvEntry` A deployment whose pack service runs on declared env values that changed since: ids, the image, and the revision it runs. Never a value. Name the service `packServiceName(tenantId, deploymentId)` (`@kindgi/api`). - `tenant_id: uuid.UUID` (`tenantId` on the wire) - `deployment_id: str` (`deploymentId` on the wire) - `pack_id: str` (`packId` on the wire) - `project_id: str | None` (`projectId` on the wire) (optional) - `image_ref: str` (`imageRef` on the wire) - `image_digest: str` (`imageDigest` on the wire) - `artifact_version: str` (`artifactVersion` on the wire) - `activated_at: AwareDatetime` (`activatedAt` on the wire) - `applied_revision: str | None` (`appliedRevision` on the wire) (optional) - `held: kindgi.client.SystemPackEnvHold | None` (optional) ## `SystemPackEnvHold` Only when it's held at its current revision for a cause the platform fixes, not the owner: it's listed every time, as the revision doesn't move when that's fixed. Read its values again when your back-off says. Absent otherwise. - `code: Union[Literal['pack-env-secret-unreadable', 'pack-env-secrets-unaudited'], str]` - `since: AwareDatetime` ## `SystemPackEnvPage` - `data: list[kindgi.client.SystemPackEnvEntry]` - `next_cursor: str | None` (`nextCursor` on the wire) (optional) - `has_more: bool` (`hasMore` on the wire) ## `SystemTenant` A tenant, as the operator sees it: never its content. - `id: uuid.UUID` - `name: str` - `slug: str` - `state: Union[Literal['active', 'suspended', 'closing'], str]` - `created_at: AwareDatetime` (`createdAt` on the wire) - `test: bool` - `production_allowed: bool` (`productionAllowed` on the wire) - `image_prefix: str | None` (`imagePrefix` on the wire) (optional) - `closing_at: AwareDatetime | None` (`closingAt` on the wire) (optional) - `suspended_at: AwareDatetime | None` (`suspendedAt` on the wire) (optional) - `suspended_reason: str | None` (`suspendedReason` on the wire) (optional) ## `SystemTenantList` - `data: list[kindgi.client.SystemTenant]` - `has_more: bool` (`hasMore` on the wire) - `next_cursor: str | None` (`nextCursor` on the wire) (optional) ## `SystemWhoami` - `key_id: str` (`keyId` on the wire) - `scopes: list[str]` - `expires_at: AwareDatetime | None` (`expiresAt` on the wire) (optional)