Models: S

SamlIdentityProviderConfig

A SAML 2.0 identity provider people sign in with: its metadata XML, or its entity ID, single sign-on URL and signing certificates. Keys are given as references, never as keys.

• provider_id: str (providerId on the wire)
• display_name: str | None (displayName on the wire) (optional)
• domains: list[kindgi.client.Domain] | None (optional)
• join: Optional[Annotated[Union[Literal['invite', 'domain'], str], <kindgi.client._open.OpenEnum object at 0x1073beed0>]] (optional)
• sign_in: kindgi.client.IdentityProviderSignIn1 | kindgi.client.IdentityProviderSignIn2 | None (signIn on the wire) (optional)
• metadata: dict[str, Any] | None (optional)
• kind: Literal['saml']
• idp_metadata_xml: str | None (idpMetadataXml on the wire) (optional)
• idp_entity_id: str | None (idpEntityId on the wire) (optional)
• idp_sso_url: AnyUrl | None (idpSsoUrl on the wire) (optional)
• idp_certificates: list[kindgi.client.IdpCertificate] | None (idpCertificates on the wire) (optional)
• sp_signing_key_ref: str | None (spSigningKeyRef on the wire) (optional)
• sp_decryption_key_ref: str | None (spDecryptionKeyRef on the wire) (optional)
• want_assertions_signed: bool | None (wantAssertionsSigned on the wire) (optional)
• attribute_mapping: kindgi.client.AttributeMapping | None (attributeMapping on the wire) (optional)

Sampling

• models: list[kindgi.client.CorrectedComparisonSummarySamplingModel]

ScheduleCollectionPage

• data: list[kindgi.client.ScheduleRecord]
• next_cursor: str | None (nextCursor on the wire) (optional)
• has_more: bool (hasMore on the wire)

ScheduleDefinition

What a schedule's version runs, when and as whom, as its record names them, and never its state (status, next or last fire). The versions keep every input the trigger has had, so a secret pasted into its input stays in an earlier version after you edit it out: rotate it.

• flow_id: str | None (flowId on the wire) (optional)
• flow_version: str | None (flowVersion on the wire) (optional)
• agent_id: str | None (agentId on the wire) (optional)
• agent_version: str | None (agentVersion on the wire) (optional)
• improve: kindgi.client.ImproveScheduleTarget | None (optional)
• project_id: uuid.UUID (projectId on the wire)
• owner: kindgi.client.TriggerOwner
• cron_expression: str (cronExpression on the wire)
• timezone: str | None (optional)
• input: Any | None (optional)
• catch_up: Union[Literal['latest', 'skip'], str] (catchUp on the wire)
• overlap: Union[Literal['skip', 'allow'], str]
• starting_deadline_seconds: int (startingDeadlineSeconds on the wire)
• label: str | None
• tools_allowed_unattended: list[kindgi.client.ToolsAllowedUnattendedItem] | None (toolsAllowedUnattended on the wire) (optional)

ScheduleFire

One fire of a schedule (an occurrence, or a run-now) and what came of it. pending while its run is being started.

• fire_id: str (fireId on the wire)
• schedule_id: str (scheduleId on the wire)
• trigger_id: str (triggerId on the wire)
• scheduled_for: AwareDatetime | None (scheduledFor on the wire) (optional)
• fired_at: AwareDatetime (firedAt on the wire)
• outcome: Union[Literal['pending', 'started', 'skipped-overlap', 'skipped-erasure', 'skipped', 'refused', 'failed'], str]
• run_id: uuid.UUID | None (runId on the wire) (optional)
• version: int | None (optional)
• improve_run_id: uuid.UUID | None (improveRunId on the wire) (optional)
• detail: str | None (optional)
• counts_toward_pause: bool | None (countsTowardPause on the wire) (optional)
• missed_count: int | None (missedCount on the wire) (optional)
• manual: bool | None (optional)

ScheduleFirePage

• data: list[kindgi.client.ScheduleFire]
• has_more: bool (hasMore on the wire)
• next_cursor: str | None (nextCursor on the wire) (optional)

ScheduleRecord

A schedule: what it runs (a flow at a version, or an agent), when (a cron expression in a timezone), as whom (its owner), and what it does after a gap or while a run is still going.

• schedule_id: str (scheduleId on the wire)
• trigger_id: str (triggerId on the wire)
• flow_id: str | None (flowId on the wire) (optional)
• flow_version: str | None (flowVersion on the wire) (optional)
• agent_id: str | None (agentId on the wire) (optional)
• agent_version: str | None (agentVersion on the wire) (optional)
• improve: kindgi.client.ImproveScheduleTarget | None (optional)
• project_id: uuid.UUID | None (projectId on the wire) (optional)
• owner: kindgi.client.TriggerOwner | None (optional)
• cron_expression: str (cronExpression on the wire)
• timezone: str | None (optional)
• input: Any | None (optional)
• catch_up: Optional[Annotated[Union[Literal['latest', 'skip'], str], <kindgi.client._open.OpenEnum object at 0x1073beed0>]] (catchUp on the wire) (optional)
• overlap: Optional[Annotated[Union[Literal['skip', 'allow'], str], <kindgi.client._open.OpenEnum object at 0x1073beed0>]] (optional)
• starting_deadline_seconds: int | None (startingDeadlineSeconds on the wire) (optional)
• label: str | None
• status: Union[Literal['active', 'paused'], str]
• status_reason: str | None (statusReason on the wire) (optional)
• paused_until: AwareDatetime | None (pausedUntil on the wire) (optional)
• paused_reason: Optional[Annotated[Union[Literal['month-cap'], str], <kindgi.client._open.OpenEnum object at 0x1073beed0>]] (pausedReason on the wire) (optional)
• version: int | None (optional)
• tools_allowed_unattended: list[kindgi.client.ToolsAllowedUnattendedItem] | None (toolsAllowedUnattended on the wire) (optional)
• next_fire_at: AwareDatetime | None (nextFireAt on the wire)
• upcoming: list[AwareDatetime] | None (optional)
• last_fired_at: AwareDatetime | None (lastFiredAt on the wire)
• created_at: AwareDatetime (createdAt on the wire)
• updated_at: AwareDatetime (updatedAt on the wire)

ScheduleUnregisterResult

• schedule_id: str (scheduleId on the wire)
• unregistered: bool

ScheduleVersion

One version of a schedule: what it was from createdAt until the next. A fire's run uses the newest when it starts, and keeps it.

• schedule_id: str (scheduleId on the wire)
• trigger_id: str (triggerId on the wire)
• version: int
• created_at: AwareDatetime (createdAt on the wire)
• created_by: str | None (createdBy on the wire) (optional)
• cause: Union[Literal['register', 'edit', 'owner', 'first-fire', 'unversioned-edit', 'pin'], str]
• definition: kindgi.client.ScheduleDefinition

ScheduleVersionPage

Newest first.

• data: list[kindgi.client.ScheduleVersion]
• has_more: bool (hasMore on the wire)
• next_cursor: str | None (nextCursor on the wire) (optional)

ScopeOrg

Discriminated Scope primitive (Tenant / Org / Project). Source of truth: Scope in @kindgi/platform.

• kind: Literal['org']
• tenant_id: str (tenantId on the wire)
• org_id: str (orgId on the wire)

ScopeProject

Discriminated Scope primitive (Tenant / Org / Project). Source of truth: Scope in @kindgi/platform.

• kind: Literal['project']
• tenant_id: str (tenantId on the wire)
• project_id: str (projectId on the wire)

ScopeSegment

• key: str
• value: str

ScopeTenant

Discriminated Scope primitive (Tenant / Org / Project). Source of truth: Scope in @kindgi/platform.

• kind: Literal['tenant']
• tenant_id: str (tenantId on the wire)

ScopeUnrecognized

A kind this client doesn't know yet, from a newer runtime: the object as it came, every field kept.

• kind: str

SecondFactor

• required: bool
• on_previous_secret: int (onPreviousSecret on the wire)
• unusable: int

SecondFactor1

• required: bool

SecondFactorConfirmBody

A code from the new key, as the authenticator app shows it.

• code: str

SecondFactorKey

A new key to set up, shown this once: uri for an authenticator app (as a QR code), key to type in. Nothing changes until it is confirmed.

• key: str
• uri: str

SecondFactorProof

Exactly one: a code from the authenticator app, or one of the recovery codes (used up by this).

• code: str | None (optional)
• recovery_code: str | None (recoveryCode on the wire) (optional)

SecondFactorRecoveryCodes

The 10 recovery codes, shown this once. Each signs in once in place of a code from the app; any earlier ones stop working.

• recovery_codes: list[str] (recoveryCodes on the wire)

SecondFactorRemoved

false when there was none to remove.

• removed: bool

SecondFactorStatus

A person's second factor, and whether their workspace requires one. With setUp, since, recoveryCodesLeft and usable are given; without it, started. Never a key or a code.

• set_up: bool (setUp on the wire)
• started: bool | None (optional)
• since: AwareDatetime | None (optional)
• recovery_codes_left: int | None (recoveryCodesLeft on the wire) (optional)
• usable: bool | None (optional)
• required: bool

SecretCollectionPage

• data: list[kindgi.client.SecretRecord]
• has_more: bool | None (hasMore on the wire) (optional)
• next_cursor: str | None (nextCursor on the wire) (optional)

SecretListPage

• data: list[kindgi.client.SecretRecord]
• next_cursor: str | None (nextCursor on the wire) (optional)

SecretRecord

• scope: kindgi.client.ScopeTenant | kindgi.client.ScopeOrg | kindgi.client.ScopeProject | kindgi.client.ScopeUnrecognized
• env_name: str (envName on the wire)
• name: str
• current_version: int (currentVersion on the wire)
• created_at: AwareDatetime (createdAt on the wire)
• updated_at: AwareDatetime (updatedAt on the wire)
• revoked_at: AwareDatetime | None (revokedAt on the wire) (optional)
• revoke_reason: str | None (revokeReason on the wire) (optional)
• tags: dict[str, str] | None (optional)
• rotation_due_at: AwareDatetime | None (rotationDueAt on the wire) (optional)

SecretRef

The workspace secret holding the adapter's credential (an API key, a service-account key). Absent when the adapter needs none or finds its own (a cloud's default credentials).

• env_name: str (envName on the wire)
• name: str

SecretRef1

The secret the provider's key resolves from, by name only, never its value. Present when the registration has one. Only a caller allowed to check the provider sees it. kindgi dev uses it to keep a provider's key out of the pack service's environment. A runtime before 0.1.6 leaves it out.

• env_name: str (envName on the wire)
• name: str

SecretResolveOutcome

• name: str
• version_id: int (versionId on the wire)
• value: str
• scope: Optional[Annotated[kindgi.client.ScopeTenant | kindgi.client.ScopeOrg | kindgi.client.ScopeProject | kindgi.client.ScopeUnrecognized, <kindgi.client._open.OpenUnion object at 0x10803a090>]] (optional)

SecretRevokeOutcome

• revoked: bool
• hard: bool
• recoverable_until: AwareDatetime | None (recoverableUntil on the wire) (optional)

SecretRevokeResult

• revoked: bool
• hard: bool
• recoverable_until: AwareDatetime | None (recoverableUntil on the wire) (optional)

SecretRotateOutcome

• root: kindgi.client.SecretRotateOutcomeOk | kindgi.client.SecretRotateOutcomeRotationPending

SecretRotateOutcomeOk

• kind: Literal['ok']
• new_version_id: int (newVersionId on the wire)
• old_version_id: int (oldVersionId on the wire)
• old_version_revoked_at: AwareDatetime | None (oldVersionRevokedAt on the wire) (optional)

SecretRotateOutcomeRotationPending

• kind: Literal['rotation-pending']
• resume_token: str (resumeToken on the wire)
• provider: str

SecretRotateRequest

• scope: Optional[Annotated[kindgi.client.ScopeTenant | kindgi.client.ScopeOrg | kindgi.client.ScopeProject | kindgi.client.ScopeUnrecognized, <kindgi.client._open.OpenUnion object at 0x1080eb5d0>]] (optional)
• env_name: str | None (envName on the wire) (optional)
• new_value: str | None (newValue on the wire) (optional)
• revoke_old_after_ms: int | None (revokeOldAfterMs on the wire) (optional)

SecretRotateResponseAsync

• kind: Literal['async']
• rotation_id: uuid.UUID (rotationId on the wire)
• status_url: str (statusUrl on the wire)
• events_url: str (eventsUrl on the wire)

SecretRotateResponseSync

• kind: Literal['sync']
• new_version_id: int (newVersionId on the wire)
• old_version_id: int (oldVersionId on the wire)
• old_version_revoked_at: AwareDatetime | None (oldVersionRevokedAt on the wire) (optional)

SecretSetInput

• scope: kindgi.client.ScopeTenant | kindgi.client.ScopeOrg | kindgi.client.ScopeProject | kindgi.client.ScopeUnrecognized
• env_name: str (envName on the wire)
• name: str
• value: str
• write_mode: Literal['create-new', 'add-version'] (writeMode on the wire)
• tags: dict[str, str] | None (optional)
• rotation_due_at: AwareDatetime | None (rotationDueAt on the wire) (optional)
• if_version: int | None (ifVersion on the wire) (optional)

SecretSetOutcome

• root: kindgi.client.SecretSetOutcomeOk | kindgi.client.SecretSetOutcomeAlreadyExists | kindgi.client.SecretSetOutcomeVersionConflict | kindgi.client.SecretSetOutcomeError

SecretSetOutcomeAlreadyExists

• kind: Literal['already-exists']
• record: kindgi.client.SecretRecord

SecretSetOutcomeError

• kind: Literal['error']
• code: str
• message: str

SecretSetOutcomeOk

• kind: Literal['ok']
• record: kindgi.client.SecretRecord
• version_id: int (versionId on the wire)

SecretSetOutcomeVersionConflict

• kind: Literal['version-conflict']
• current_version: int (currentVersion on the wire)

SecretSetRequest

• scope: kindgi.client.ScopeTenant | kindgi.client.ScopeOrg | kindgi.client.ScopeProject | kindgi.client.ScopeUnrecognized
• env_name: str (envName on the wire)
• name: str
• value: str
• write_mode: Literal['create-new', 'add-version'] (writeMode on the wire)
• tags: dict[str, str] | None (optional)
• rotation_due_at: AwareDatetime | None (rotationDueAt on the wire) (optional)
• if_version: int | None (ifVersion on the wire) (optional)
• app_env_file: bool | None (appEnvFile on the wire) (optional)

SecretSetResponse

• record: kindgi.client.SecretRecord
• version_id: int (versionId on the wire)

SecretVersionCollectionPage

• data: list[kindgi.client.SecretVersionRecord]
• has_more: bool | None (hasMore on the wire) (optional)
• next_cursor: str | None (nextCursor on the wire) (optional)

SecretVersionRecord

• scope: kindgi.client.ScopeTenant | kindgi.client.ScopeOrg | kindgi.client.ScopeProject | kindgi.client.ScopeUnrecognized
• env_name: str (envName on the wire)
• name: str
• version_id: int (versionId on the wire)
• created_at: AwareDatetime (createdAt on the wire)
• value: str | None (optional)
• revoked_at: AwareDatetime | None (revokedAt on the wire) (optional)

Secrets

• name: str
• ref: str

Secrets1

• name: str
• value: str

ServedEnv

The env this runtime serves (KINDGI_ENV): where the values its tools read are kept. With refusesOtherEnvs, it's the only one: a secret, env value or secret reference under another env is refused (409 env-not-served), so a client defaults to envName. Absent when the runtime serves no env, and from older servers.

• env_name: str (envName on the wire)
• refuses_other_envs: bool (refusesOtherEnvs on the wire)

ServiceAccount

A named, non-human principal (service_account:<id>) for an app, a pipeline or a schedule. It acts through API keys minted for it.

• service_account_id: str (serviceAccountId on the wire)
• name: str
• description: str | None (optional)
• grants: list[Annotated[kindgi.client.ServiceAccountGrantTenantAdmin | kindgi.client.ServiceAccountGrantTenantMember | kindgi.client.ServiceAccountGrantProject | kindgi.client.ServiceAccountGrantUnrecognized, <kindgi.client._open.OpenUnion object at 0x107f26b90>]]
• created_by: str | None (createdBy on the wire) (optional)
• created_at: AwareDatetime (createdAt on the wire)
• unregistered_at: AwareDatetime | None (unregisteredAt on the wire) (optional)
• project_id: str | None (projectId on the wire) (optional)

ServiceAccountGrantBody

• root: kindgi.client.ServiceAccountGrantTenantAdmin | kindgi.client.ServiceAccountGrantTenantMember | kindgi.client.ServiceAccountGrantProjectBody

ServiceAccountGrantProject

A role on one project; it replaces the account's role there.

• kind: Literal['project']
• project_id: uuid.UUID (projectId on the wire)
• role: Union[Literal['viewer', 'editor', 'owner', 'admin', 'member'], str]

ServiceAccountGrantProjectBody

A role to give on one project; it replaces the account's role there.

• kind: Literal['project']
• project_id: uuid.UUID (projectId on the wire)
• role: Literal['viewer', 'editor', 'owner', 'admin']

ServiceAccountGrantTenantAdmin

Tenant admin.

• kind: Literal['tenant-admin']

ServiceAccountGrantTenantMember

Tenant member: read the workspace's settings (providers, policies, adapters, signing keys, deployments), not its projects. A service account has it only when granted; a person has it from being added.

• kind: Literal['tenant-member']

ServiceAccountGrantUnrecognized

A kind this client doesn't know yet, from a newer runtime: the object as it came, every field kept.

• kind: str

ServiceAccountPage

• data: list[kindgi.client.ServiceAccount]
• has_more: bool (hasMore on the wire)
• next_cursor: str | None (nextCursor on the wire) (optional)

ServiceAccountUngrantBody

• root: kindgi.client.ServiceAccountGrantTenantAdmin | kindgi.client.ServiceAccountGrantTenantMember | kindgi.client.ServiceAccountUngrantProject

ServiceAccountUngrantProject

Whatever role the account has on one project.

• kind: Literal['project']
• project_id: uuid.UUID (projectId on the wire)

SessionApproval

The reviewer's decision at the turn's session approval gate, when the turn waited on one. A replay of the turn follows it.

• approved: bool
• rationale: str | None (optional)

SetAgentOwnerBody

• user_id: str (userId on the wire)

SetAgentOwnerResult

• agent_id: str (agentId on the wire)
• owner: kindgi.client.AgentOwner

SetAside

The test set's cases set aside for the proof: cases of of. None with fewer than five. Absent from older servers.

• cases: int
• of: int

SetConnectionChoiceBody

Name what the choice is for: agentId or flowId, one of them, and toolId for a tool's own. A company choice is a project admin's; a person's (person) is theirs alone.

• project_id: uuid.UUID (projectId on the wire)
• agent_id: str | None (agentId on the wire) (optional)
• flow_id: str | None (flowId on the wire) (optional)
• tool_id: str | None (toolId on the wire) (optional)
• need: str | None (optional)
• connection_id: uuid.UUID (connectionId on the wire)
• connection_ids: list[uuid.UUID] | None (connectionIds on the wire) (optional)
• person: kindgi.client.ConnectionChoicePerson | None (optional)

SetPackEndpointBody

• url: str
• auth: Literal['google-id-token', 'token']
• token: str
• pack_env_revision: str | None (packEnvRevision on the wire) (optional)

SetPackSuspendedBody

• suspended: bool
• reason: str | None (optional)

SetTenantImagePrefixBody

• prefix: str

SetTenantSuspendedBody

• suspended: bool
• reason: str | None (optional)

SettingsBlockContent

• values: dict[str, Any]
• schema_: dict[str, Any] | None (schema on the wire) (optional)

ShouldCallItem

• tool: str
• args: dict[str, Any] | None (optional)

SignIn

How a person signs in at the app.

• kind: Union[Literal['oauth2', 'github-app'], str]
• tenant: kindgi.client.ConnectionEntrySignInTenant | None (optional)

SignInEvent

One sign-in audit event, flattened: who signed in or out, how, from where, and what was refused.

• id: str
• timestamp: AwareDatetime
• kind: Union[Literal['signed-in', 'signed-out', 'sign-in-refused', 'sign-in-link-sent', 'sign-in-link-capped', 'sessions-revoked', 'sessions-ended', 'second-factor-set-up', 'second-factor-removed', 'recovery-codes-replaced'], str]
• outcome: str
• user_id: str | None (userId on the wire) (optional)
• method: str | None (optional)
• client_address: str | None (clientAddress on the wire) (optional)
• reason: str | None (optional)
• session_id: str | None (sessionId on the wire) (optional)
• by_user_id: str | None (byUserId on the wire) (optional)

SignInOption

One way to sign in, as a sign-in page shows it.

• provider_id: str (providerId on the wire)
• display_name: str (displayName on the wire)
• sign_in_url: str (signInUrl on the wire)
• owner: Optional[Annotated[Union[Literal['tenant', 'deployment'], str], <kindgi.client._open.OpenEnum object at 0x1073beed0>]] (optional)

SignInOptions

• data: list[kindgi.client.SignInOption]
• methods: kindgi.client.Methods | None (optional)
• legal: kindgi.client.Legal | None (optional)
• links: list[kindgi.client.ConsoleLink] | None (optional)

Signature

Runtime-side signature attached at emission time (if the deployment signs on write). Independent of the export-time signature returned by the export route.

• algorithm: Literal['ed25519']
• key_id: str (keyId on the wire)
• value: str
• signed_at: AwareDatetime (signedAt on the wire)

Signature1

• algorithm: Literal['ed25519']
• key_id: str (keyId on the wire)
• value: str
• signed_at: AwareDatetime (signedAt on the wire)

SignedComplianceEvidenceBundle

Signed compliance evidence. Body: { bundleSchemaVersion, tenantId, filter, records, recordCount, exportedAt }.

• tenant_id: uuid.UUID (tenantId on the wire)
• kind: Optional[Literal['compliance']] (optional)
• bundle: str
• bundle_schema_version: str (bundleSchemaVersion on the wire)
• algorithm: Union[Literal['ed25519', 'ecdsa-p256-sha256'], str]
• signing_key_id: str (signingKeyId on the wire)
• signature: str
• public_key: str (publicKey on the wire)
• canonicalization: Literal['sorted-key-json']
• exported_at: AwareDatetime (exportedAt on the wire)

Site

A site that signs its own people in to one project: it vouches for whoever is signed in there, so they ask the project's agents and decide its approvals as themselves. Each person it signs in is a person of the workspace, shown as "<name>, via <displayName>".

• site_id: uuid.UUID (siteId on the wire)
• project_id: uuid.UUID (projectId on the wire)
• display_name: str (displayName on the wire)
• origin: str
• approvals_url: str (approvalsUrl on the wire)
• allowed_roles: list[kindgi.client.AllowedRole] (allowedRoles on the wire)
• role_map: dict[str, kindgi.client.SiteRoleGrant] (roleMap on the wire)
• reviewer_ceiling: Union[Literal['standard', 'senior'], str] (reviewerCeiling on the wire)
• vouching: bool
• people_cap: int (peopleCap on the wire)
• new_people_per_day: int (newPeoplePerDay on the wire)
• keys: list[kindgi.client.SiteKey]
• audience: str | None (optional)
• created_at: AwareDatetime (createdAt on the wire)
• created_by: str | None (createdBy on the wire) (optional)
• paused_at: AwareDatetime | None (pausedAt on the wire) (optional)
• unregistered_at: AwareDatetime | None (unregisteredAt on the wire) (optional)

SiteCollectionPage

• data: list[kindgi.client.Site]
• next_cursor: str | None (nextCursor on the wire) (optional)
• has_more: bool (hasMore on the wire)

SiteEnrollmentCode

A one-time code the site posts with its public key (POST /v1/auth/sites/enroll). Shown once. Using it replaces the site's keys and ends its live sessions.

• code: str
• expires_at: AwareDatetime (expiresAt on the wire)

SiteKey

One of the site's live public keys. Kindgi never has a private half.

• kid: str
• thumbprint: str
• added_at: AwareDatetime (addedAt on the wire)

SitePersonRestoreResult

A site's person let back in after a removal made in Kindgi (POST /v1/projects/{projectId}/sites/{siteId}/people/{userId}/restore).

• user: kindgi.client.UserRecord

SiteRoleGrant

What a person with one of the site's roles gets in the site's project. Reading the project comes with every role; nothing above it ever does.

• ask: bool
• reviewer: Optional[Annotated[Union[Literal['standard', 'senior'], str], <kindgi.client._open.OpenEnum object at 0x1073beed0>]] (optional)

SiteSignInBody

• statement: str

SiteSignInResult

• token: str
• expires_at: AwareDatetime (expiresAt on the wire)
• user_id: str (userId on the wire)
• actor: str
• project_id: uuid.UUID (projectId on the wire)

SourceFreshness

• ttl_seconds: int | None (ttlSeconds on the wire) (optional)
• last_verified_at: AwareDatetime | None (lastVerifiedAt on the wire) (optional)
• etag: str | None (optional)
• source_version: str | None (sourceVersion on the wire) (optional)

SourceRefresh

• strategy: Union[Literal['on-read', 'background', 'manual'], str]
• handler: str | None (optional)
• priority: int | None (optional)

StartConnectBody

Optional, and a GitHub App's only: the installation to attach, or a new one. Leave it out for any other app.

• installation_id: str | None (installationId on the wire) (optional)
• new_installation: bool | None (newInstallation on the wire) (optional)

StartImproveRunBody

Start an Improve run for an agent in a project, or check one first. It starts from the version the project runs, learns from the project's corrections, and searches and proves on the project's test set. A field not listed here is refused (400 bad-input, naming it).

• agent_id: str (agentId on the wire)
• project_id: uuid.UUID (projectId on the wire)
• tiers: list[Literal['settings', 'prompt']] | None (optional)
• model: kindgi.client.StartImproveRunBodyModel | None (optional)
• candidates: int | None (optional)
• group_weights: Optional[Literal['as-recorded', 'experts-only']] (groupWeights on the wire) (optional)
• objective: Optional[Literal['passRate', 'weightedPrecisionAtK']] (optional)
• budget: kindgi.client.Budget2 | None (optional)

StartImproveRunBodyModel

For the prompt tier: the workspace's provider and model that drafts the templates. Omit it for the model of the version's own model-settings block.

• provider_id: str (providerId on the wire)
• model: str

StartRunBody

• root: kindgi.client.StartRunBody1 | kindgi.client.StartRunBody2

StartRunBody1

Start a run. Exactly one of agent or flow MUST be supplied (single Run primitive).

• agent: str
• agent_version: str | None (agentVersion on the wire) (optional)
• project_id: uuid.UUID | None (projectId on the wire) (optional)
• segments: list[kindgi.client.ScopeSegment] | None (optional)
• input: Any
• options: kindgi.client.Options | None (optional)

StartRunBody2

Start a run. Exactly one of agent or flow MUST be supplied (single Run primitive).

• flow: str
• flow_version: str | None (flowVersion on the wire) (optional)
• project_id: uuid.UUID | None (projectId on the wire) (optional)
• segments: list[kindgi.client.ScopeSegment] | None (optional)
• input: Any
• options: kindgi.client.Options | None (optional)

StartRunOptions

• dry_run: bool | None (dryRun on the wire) (optional)
• wait: bool | None (optional)

StartTestRunBody

Exactly one of agentRef or flowRef MUST be supplied. dryRun: true returns a plan preview without invoking the subject. For a corrections test set (a test set), the run is a comparison: agentRef or flowRef with its version is the candidate, replayed on each case without doing anything the past run didn't (a flow stops at a write the replay refuses); baseline (default 'recorded'), reads (default recorded), repetitions (default 1) and k (default 10) set how. With flowRef, versions runs the flow with some of its agents or tools at other versions; an id the flow doesn't use, or a version that isn't published, is refused (400 validation-failed, each under details.issues).

• project_id: uuid.UUID (projectId on the wire)
• agent_ref: kindgi.client.TestRunAgentRef | None (agentRef on the wire) (optional)
• flow_ref: kindgi.client.TestRunFlowRef | None (flowRef on the wire) (optional)
• dry_run: bool | None (dryRun on the wire) (optional)
• correlation_id: str | None (correlationId on the wire) (optional)
• baseline: Union[Annotated[Union[Literal['recorded'], str], <kindgi.client._open.OpenEnum object at 0x1073beed0>], kindgi.client.TestRunBaseline1, kindgi.client.TestRunBaseline2, NoneType] (optional)
• reads: Optional[Literal['recorded', 'live']] (optional)
• repetitions: int | None (optional)
• k: int | None (optional)
• versions: kindgi.client.FlowVersionOverrides | None (optional)
• group_weights: Optional[Literal['as-recorded', 'experts-only']] (groupWeights on the wire) (optional)
• overrides: kindgi.client.TestRunOverrides | None (optional)
• sample: kindgi.client.TestRunSample | None (optional)

StartTestRunResult

• test_run_id: uuid.UUID (testRunId on the wire)
• dry_run_preview: dict[str, Any] | None (dryRunPreview on the wire) (optional)

Step

• run_id: str (runId on the wire)
• node_id: str | None (nodeId on the wire) (optional)
• scope: str | None (optional)
• agent_id: str (agentId on the wire)
• agent_version: str (agentVersion on the wire)
• retrieved: Any | None (optional)
• recalled: Any | None (optional)

StepUsage

• calls: int
• cost_usd: float (costUsd on the wire)
• tokens: kindgi.client.CostTokenTotals

Stopped

Set when the replay stopped at a refused tool call: what it would have done.

• tool_id: str (toolId on the wire)
• arguments: Any
• reason: str | None (optional)

Subject

• kind: Union[Literal['participant', 'external'], str]
• id: str

Subject1

• kind: str | None (optional)
• id: str | None (optional)

SuccessStatus

• min: int
• max: int

SuggestedChange

A suggested change: one block changed in what a project runs, checked on the project's test set, then pinned for the project or added as its Latest.

• id: uuid.UUID
• agent_id: str (agentId on the wire)
• project_id: uuid.UUID | None (projectId on the wire) (optional)
• title: str
• made_by: kindgi.client.SuggestedChangeMadeBy (madeBy on the wire)
• built_on: kindgi.client.BuiltOn (builtOn on the wire)
• version: str | None (optional)
• changes: list[kindgi.client.SuggestedChangeChange]
• why: str
• fixes: list[str]
• correction_count: int | None (correctionCount on the wire) (optional)
• check: kindgi.client.SuggestedChangeCheck
• status: Union[Literal['checking', 'check-failed', 'ready', 'waiting-for-second-person', 'pinned', 'added-as-latest', 'withdrawn'], str]
• note: kindgi.client.SuggestedChangeNote | None (optional)
• pinned: kindgi.client.Pinned | None (optional)
• approval_id: str | None (approvalId on the wire) (optional)
• added_as_latest: kindgi.client.AddedAsLatest | None (addedAsLatest on the wire) (optional)
• withdrawn: kindgi.client.Withdrawn | None (optional)
• created_at: AwareDatetime (createdAt on the wire)
• updated_at: AwareDatetime (updatedAt on the wire)

SuggestedChangeBlockContent

{ values } for a settings block, { template } for a prompt block.

• values: dict[str, Any] | None (optional)
• template: str | None (optional)

SuggestedChangeChange

One change the suggested change makes. block: a new version of a block its project's version pins (blockId). from is the block version what it's built on pins, and to the one it published (absent until it made one). GET /v1/suggested-changes/{suggestedChangeId} adds from's content as the change was drafted or last rebuilt (before) and the new content (after). code: a deploy's new agent version, whole (deploymentId, and imageDigest when the deploy named its image by digest), with no content before and after.

• kind: Union[Literal['block', 'code'], str]
• block_id: str | None (blockId on the wire) (optional)
• deployment_id: str | None (deploymentId on the wire) (optional)
• image_digest: str | None (imageDigest on the wire) (optional)
• from_: str | None (from on the wire) (optional)
• to: str | None (optional)
• before: kindgi.client.SuggestedChangeBlockContent | None (optional)
• after: kindgi.client.SuggestedChangeBlockContent | None (optional)

SuggestedChangeCheck

The suggested change's check: its version (with) and the version it's built on (now) run the same cases of its project's test set, frozen when the check started. status: not-started (it never ran), running, done or failed. A check from before suggested changes were for a project compared its version with the recorded outputs only, so it has no now.

• status: Union[Literal['not-started', 'running', 'done', 'failed'], str]
• test_set_id: str | None (testSetId on the wire) (optional)
• test_set_version: str | None (testSetVersion on the wire) (optional)
• now: kindgi.client.SuggestedChangeCheckSide | None (optional)
• with_: kindgi.client.SuggestedChangeCheckSide | None (with on the wire) (optional)
• newly_failing: list[str] | None (newlyFailing on the wire) (optional)
• started_at: AwareDatetime | None (startedAt on the wire) (optional)

SuggestedChangeCheckSide

How one version did on the check's cases: its test run, and once that finished, the corrections it passed (every repetition did) of those it was checked on.

• test_run_id: uuid.UUID (testRunId on the wire)
• passing: int | None (optional)
• of: int | None (optional)
• cost_per_conversation: str | None (costPerConversation on the wire) (optional)

SuggestedChangeCollectionPage

• data: list[kindgi.client.SuggestedChange]
• has_more: bool (hasMore on the wire)
• next_cursor: str | None (nextCursor on the wire) (optional)

SuggestedChangeMadeBy

Who or what made the suggested change. improve-run: an Improve run (improveRunId, and scheduleId when a schedule started it). person: a person (userId). service: a service account (id). deploy: a deploy, for a project its new version reaches (deploymentId, and who deployed, by). offer: a change pinned in another project, offered to this one (fromProjectId, pinChangeId). One made before this was recorded reads it from its drafter.

• kind: Union[Literal['improve-run', 'person', 'service', 'deploy', 'offer'], str]
• improve_run_id: str | None (improveRunId on the wire) (optional)
• schedule_id: str | None (scheduleId on the wire) (optional)
• user_id: str | None (userId on the wire) (optional)
• id: str | None (optional)
• deployment_id: str | None (deploymentId on the wire) (optional)
• by: kindgi.client.PinActor | None (optional)
• from_project_id: uuid.UUID | None (fromProjectId on the wire) (optional)
• pin_change_id: str | None (pinChangeId on the wire) (optional)

SuggestedChangeNote

Why a ready suggested change's pin didn't go through: gate-refused, rejected (a second person), expired (the approval), or superseded (its project's version or release gate changed before the approval). pinChangeId is that pin's change in the pin history. Or, on a deploy's suggested change, not-running: the version its project runs (version) isn't running to be checked against, and has no finished run on the same cases, so its check has no now.

• kind: Union[Literal['gate-refused', 'rejected', 'expired', 'superseded', 'not-running'], str]
• pin_change_id: str | None (pinChangeId on the wire) (optional)
• version: str | None (optional)

SuggestedChangePinAnswer

A suggested change's pin, as PinAnswer, and the suggested change it pinned.

• pin: kindgi.client.Pin
• test_runs: list[kindgi.client.PinTestRun] (testRuns on the wire)
• fixed: list[str]
• reopened: list[str]
• suggested_change: kindgi.client.SuggestedChange (suggestedChange on the wire)

SuggestedChangePinBody

• reason: str | None (optional)
• stop_following_latest: bool | None (stopFollowingLatest on the wire) (optional)

SuggestedChangeReasonBody

• reason: str | None (optional)

SupersedeFactBody

The fact's next revision: new content, and optionally new retention, subjects and times (absent ones keep their current values). Its scope and type stay. expectVersion: only if the current revision is still this one.

• content: Any
• expect_version: int | None (expectVersion on the wire) (optional)
• retention: kindgi.client.Retention | None (optional)
• subjects: list[kindgi.client.FactSubject] | None (optional)
• valid_from: AwareDatetime | None (validFrom on the wire) (optional)
• valid_until: AwareDatetime | None (validUntil on the wire) (optional)
• observed_at: AwareDatetime | None (observedAt on the wire) (optional)

SuppressedRefusals

Refusals and skipped deliveries this minute past the 20 recorded in its history, which only counted.

• since: AwareDatetime
• count: int

SystemDeploymentEntry

A deployment as whatever runs its pack service needs it: ids and the image, nothing of the tenant beyond its id. Name the service packServiceName(tenantId, deploymentId) (@kindgi/api). In the missing and ready lists, warm says whether to keep an instance of its service running. In the missing list, problem is the last problem recorded for it (PUT …/endpoint/problem), absent until one is; its since is when that code was first recorded, as recording the same code again keeps it, so a pass can space its tries by it. In the retire list, reason says why the service should go.

• tenant_id: uuid.UUID (tenantId on the wire)
• deployment_id: str (deploymentId on the wire)
• pack_id: str (packId on the wire)
• project_id: str | None (projectId on the wire) (optional)
• image_ref: str (imageRef on the wire)
• image_digest: str (imageDigest on the wire)
• artifact_version: str (artifactVersion on the wire)
• activated_at: AwareDatetime (activatedAt on the wire)
• warm: bool | None (optional)
• problem: kindgi.client.DeploymentEndpointProblem | None (optional)
• reason: Optional[Annotated[Union[Literal['superseded', 'tenant-closing', 'tenant-suspended', 'project-suspended', 'pack-suspended'], str], <kindgi.client._open.OpenEnum object at 0x1073beed0>]] (optional)

SystemDeploymentPage

• data: list[kindgi.client.SystemDeploymentEntry]
• next_cursor: str | None (nextCursor on the wire) (optional)
• has_more: bool (hasMore on the wire)

SystemKey

A system key (kgi_sy_…): the operator's, acting in no tenant. Never its secret.

• id: str
• label: str | None (optional)
• scopes: list[Literal['system:tenants', 'system:tenants:create', 'system:tenants:image-prefix', 'system:tenants:production', 'system:tenants:limits', 'system:tenants:contacts', 'system:tenants:purge', 'system:suspend', 'system:deployments', 'system:pack-env', 'system:env-refs', 'system:usage:read', 'system:license', 'kindgi:system']]
• created_at: AwareDatetime (createdAt on the wire)
• expires_at: AwareDatetime | None (expiresAt on the wire) (optional)
• revoked_at: AwareDatetime | None (revokedAt on the wire) (optional)
• minted_by: str (mintedBy on the wire)

SystemKeyList

• data: list[kindgi.client.Datum2]

SystemOpenapiResponse

SystemPackEnv

What the deployment's pack service is to be given: where each declared name is set, and the values when nothing stands in the way, plain ones in env and, when asked for (secrets=values), secrets in secrets; and the names set to a cloud secret, with its path, in cloudSecrets. Each value given out is on the audit record: env-resolved as the deployment's system read, and secret-resolved (caller pack-env, with the request id as its correlationId and the system key's id), written before the answer.

• revision: str
• names: list[kindgi.client.PackEnvNameStatus]
• problem: Optional[Annotated[Union[Literal['pack-env-ambiguous', 'pack-env-secret-not-yet', 'pack-env-missing', 'pack-env-secret-unreadable'], str], <kindgi.client._open.OpenEnum object at 0x1073beed0>]] (optional)
• env: dict[str, str] | None (optional)
• secrets: dict[str, kindgi.client.PackEnvSecretValue] | None (optional)
• cloud_secrets: dict[str, str] | None (cloudSecrets on the wire) (optional)

SystemPackEnvEntry

A deployment whose pack service runs on declared env values that changed since: ids, the image, and the revision it runs. Never a value. Name the service packServiceName(tenantId, deploymentId) (@kindgi/api).

• tenant_id: uuid.UUID (tenantId on the wire)
• deployment_id: str (deploymentId on the wire)
• pack_id: str (packId on the wire)
• project_id: str | None (projectId on the wire) (optional)
• image_ref: str (imageRef on the wire)
• image_digest: str (imageDigest on the wire)
• artifact_version: str (artifactVersion on the wire)
• activated_at: AwareDatetime (activatedAt on the wire)
• applied_revision: str | None (appliedRevision on the wire) (optional)
• held: kindgi.client.SystemPackEnvHold | None (optional)

SystemPackEnvHold

Only when it's held at its current revision for a cause the platform fixes, not the owner: it's listed every time, as the revision doesn't move when that's fixed. Read its values again when your back-off says. Absent otherwise.

• code: Union[Literal['pack-env-secret-unreadable', 'pack-env-secrets-unaudited'], str]
• since: AwareDatetime

SystemPackEnvPage

• data: list[kindgi.client.SystemPackEnvEntry]
• next_cursor: str | None (nextCursor on the wire) (optional)
• has_more: bool (hasMore on the wire)

SystemTenant

A tenant, as the operator sees it: never its content.

• id: uuid.UUID
• name: str
• slug: str
• state: Union[Literal['active', 'suspended', 'closing'], str]
• created_at: AwareDatetime (createdAt on the wire)
• test: bool
• production_allowed: bool (productionAllowed on the wire)
• image_prefix: str | None (imagePrefix on the wire) (optional)
• closing_at: AwareDatetime | None (closingAt on the wire) (optional)
• suspended_at: AwareDatetime | None (suspendedAt on the wire) (optional)
• suspended_reason: str | None (suspendedReason on the wire) (optional)

SystemTenantList

• data: list[kindgi.client.SystemTenant]
• has_more: bool (hasMore on the wire)
• next_cursor: str | None (nextCursor on the wire) (optional)

SystemTenantPurge

• tenant_id: uuid.UUID (tenantId on the wire)
• complete: bool
• already_purged: bool (alreadyPurged on the wire)
• purged_at: AwareDatetime | None (purgedAt on the wire) (optional)
• deleted: list[kindgi.client.TenantTableRows]
• objects_deleted: int (objectsDeleted on the wire)
• authz_store_deleted: bool (authzStoreDeleted on the wire)
• left: list[kindgi.client.TenantTableRows]
• objects_left: int (objectsLeft on the wire)
• left_because: str | None (leftBecause on the wire) (optional)

SystemWhoami

• key_id: str (keyId on the wire)
• scopes: list[str]
• expires_at: AwareDatetime | None (expiresAt on the wire) (optional)