diff --git a/apps/docs/content/docs/integrations/aws-credentials.mdx b/apps/docs/content/docs/integrations/aws-credentials.mdx new file mode 100644 index 00000000000..22e15c86786 --- /dev/null +++ b/apps/docs/content/docs/integrations/aws-credentials.mdx @@ -0,0 +1,59 @@ +--- +title: AWS credentials +description: Save an AWS identity once and use it across every AWS block, with access keys, an assumed IAM role, or a keyless role that trusts Sim through OpenID Connect +--- + +import { Callout } from '@/components/ui/callout' +import { Step, Steps } from '@/components/ui/steps' + +An AWS credential holds one AWS identity for the whole workspace. Every AWS block (S3, DynamoDB, Lambda, SQS, Athena, CloudWatch, and the rest) can select it instead of taking access keys typed into the block. + + +Blocks that already use access keys keep working exactly as they are. Selecting a saved credential is optional; clear it and the block goes back to its own keys. + + +## Choose how Sim signs in + +| Option | What Sim stores | When to use it | +| --- | --- | --- | +| **IAM role (keyless, via Sim OIDC)** | Nothing secret: only the role ARN | Recommended. No long-lived keys to rotate or leak. | +| **Access keys that assume an IAM role** | An access key pair, used only to assume the role | Your AWS account doesn't allow OIDC providers, or you need an external ID. | +| **Access keys** | An access key pair | The same behavior as keys typed into a block, shared across blocks. | + +Every option resolves on Sim's servers at run time. Keys and session tokens never appear in block outputs, logs, or anything a model sees. Each assumed-role session is named `sim-`, so runs are traceable in CloudTrail. + +## Set up a keyless IAM role [#keyless-role] + + + + In Sim, open **Integrations**, add an **AWS credential**, and choose **IAM role (keyless, via Sim OIDC)**. Keep the dialog open; it shows the values for the next steps. + + + In the AWS IAM console, open **Identity providers → Add provider**, choose **OpenID Connect**, and enter the **Identity provider URL** and **Audience** from the dialog. You only do this once per AWS account. + + + Create a role (or edit an existing one) and set its trust policy to the **Role trust policy** shown in the dialog. It trusts only this credential's **Subject**, so no other Sim credential, workspace, or customer can assume the role. + + + Attach the permissions your workflows need to the role, then paste its ARN into the dialog and save. Sim verifies the connection by assuming the role before saving it. + + + + +The subject is unique to the credential. Reconnecting a keyless credential with a new subject means updating the role's trust policy to match. + + +## Use access keys + +Create an IAM user (or use an existing one) with an access key, choose **Access keys** or **Access keys that assume an IAM role**, and enter the key pair. For an assumed role, add the role ARN and, if the role's trust policy requires one, the external ID. Sim checks the keys with `sts:GetCallerIdentity` before saving. + +## Self-hosted deployments + +Keyless roles need two things on a self-hosted deployment: + +- `WORKLOAD_IDENTITY_SIGNING_KEY`: a PKCS#8 PEM RSA private key that signs Sim's tokens. +- An issuer AWS can reach over the public internet. It defaults to `/oidc/workload`; set `WORKLOAD_IDENTITY_ISSUER` to pin it. Trust policies reference this URL, so never change it once roles trust it. + +To rotate the signing key, move the old key to `WORKLOAD_IDENTITY_PREVIOUS_KEY` and set a new `WORKLOAD_IDENTITY_SIGNING_KEY`. Both keys stay published until you remove the old one. + +Without a signing key, the keyless option is unavailable and access keys work as usual. diff --git a/apps/docs/content/docs/integrations/databricks-credentials.mdx b/apps/docs/content/docs/integrations/databricks-credentials.mdx new file mode 100644 index 00000000000..f86a8d257cb --- /dev/null +++ b/apps/docs/content/docs/integrations/databricks-credentials.mdx @@ -0,0 +1,41 @@ +--- +title: Databricks connections +description: Save a Databricks workspace connection with a personal access token, a service principal OAuth secret, or a keyless service principal that trusts Sim through OpenID Connect +--- + +import { Callout } from '@/components/ui/callout' +import { Step, Steps } from '@/components/ui/steps' + +A Databricks connection holds a workspace host and how Sim authenticates to it. The Databricks block can select a saved connection instead of taking a host and token typed into the block. + + +Blocks that already use a host and personal access token keep working exactly as they are. Selecting a saved connection is optional. + + +## Choose how Sim signs in + +| Option | What Sim stores | When to use it | +| --- | --- | --- | +| **Service principal (keyless, via Sim OIDC)** | Nothing secret: the host and the service principal's application ID | Recommended. No secret to rotate or leak. | +| **Service principal OAuth secret** | The application ID and an OAuth secret | Machine-to-machine access where federation isn't set up. Sim exchanges the secret for a short-lived token on each run. | +| **Personal access token** | A personal access token | The same behavior as a token typed into the block, shared across blocks. | + +Every option resolves on Sim's servers at run time; tokens never appear in block outputs, logs, or anything a model sees. + +## Set up a keyless service principal [#keyless-service-principal] + + + + In Sim, add a **Databricks connection**, choose **Service principal (keyless, via Sim OIDC)**, and enter the workspace host and the service principal's **application ID**. + + + A Databricks account admin runs the **Federation policy** command from the dialog with the service principal's numeric ID. The policy trusts Sim's issuer, the Sim audience, and this connection's subject only. + + + Make sure the service principal can access the workspace and the resources your workflows use, then save. Sim verifies the connection by exchanging a token and reading the service principal's identity. + + + +## Self-hosted deployments + +Keyless connections need `WORKLOAD_IDENTITY_SIGNING_KEY` set and an issuer Databricks can reach over the public internet. See [AWS credentials](/integrations/aws-credentials#self-hosted-deployments) for the same settings. diff --git a/apps/docs/content/docs/integrations/databricks.mdx b/apps/docs/content/docs/integrations/databricks.mdx index 991e2f0b68e..9244369174a 100644 --- a/apps/docs/content/docs/integrations/databricks.mdx +++ b/apps/docs/content/docs/integrations/databricks.mdx @@ -21,6 +21,8 @@ Cluster operations support creating, configuring, starting, restarting, resizing Genie operations create and update spaces, answer natural-language questions, manage conversation history, and retrieve generated SQL, results, and charts. Reuse the conversation ID for follow-ups. Use a space's `etag` when updating it to avoid overwriting concurrent changes. Agent mode supports research reports and response cancellation; it must be enabled in your workspace. {/* MANUAL-CONTENT-END */} +Connection guides: [Databricks connections](/integrations/databricks-credentials). + ## Use the block [#usage-instructions] Execute parameterized SQL and retrieve result chunks, create and manage jobs, submit and repair runs, manage compute clusters and SQL warehouses, and create or update Genie spaces. Ask Genie questions or run agent research, inspect conversations, and retrieve query results and charts. Connect with a personal access token and workspace host URL. diff --git a/apps/docs/content/docs/integrations/meta.json b/apps/docs/content/docs/integrations/meta.json index 15dd2516e0a..e58780b050c 100644 --- a/apps/docs/content/docs/integrations/meta.json +++ b/apps/docs/content/docs/integrations/meta.json @@ -21,6 +21,7 @@ "atlassian-service-account", "attio", "attio-service-account", + "aws-credentials", "azure_data_explorer", "azure_devops", "bitbucket", @@ -56,6 +57,7 @@ "cursor", "dagster", "databricks", + "databricks-credentials", "datadog", "datagma", "daytona", diff --git a/apps/docs/content/docs/platform/self-hosting/environment-variables.mdx b/apps/docs/content/docs/platform/self-hosting/environment-variables.mdx index 4a06caf31d4..16728f04a4b 100644 --- a/apps/docs/content/docs/platform/self-hosting/environment-variables.mdx +++ b/apps/docs/content/docs/platform/self-hosting/environment-variables.mdx @@ -160,6 +160,18 @@ Google, GitHub, and Microsoft sign-in, their callback URLs, and the `DISABLE_*_A OAuth integrations require a provider application and its credentials on a self-hosted deployment. API-key integrations use the keys supplied in their blocks. The full table, redirect-URI format, and setup steps are in [Integrations and OAuth](/platform/self-hosting/integrations-oauth). +### Keyless cloud credentials [#workload-identity] + +Saved AWS and Databricks credentials can trust Sim through OpenID Connect instead of storing keys. Leave these unset to offer only key- and secret-based credentials. + +| Variable | Description | +| --- | --- | +| `WORKLOAD_IDENTITY_SIGNING_KEY` | PKCS#8 PEM RSA private key that signs Sim's workload-identity tokens: `openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048` | +| `WORKLOAD_IDENTITY_ISSUER` | Issuer URL clouds trust. Defaults to `/oidc/workload` and must be reachable from the public internet. Never change it once trust policies reference it. | +| `WORKLOAD_IDENTITY_PREVIOUS_KEY` | During rotation, the retiring key (private or public PEM), still published so tokens it signed keep verifying | + +See [AWS credentials](/integrations/aws-credentials#self-hosted-deployments). + ## Access control Who may sign up and sign in — the allowlists, blocklists, `DISABLE_REGISTRATION`, `DISABLE_INVITATIONS`, `DISABLE_PUBLIC_API`, and `DISABLE_AUTH` — is documented in [Authentication](/platform/self-hosting/authentication). diff --git a/apps/docs/content/integration-navigation.json b/apps/docs/content/integration-navigation.json index 9980d200365..50bb58cefd0 100644 --- a/apps/docs/content/integration-navigation.json +++ b/apps/docs/content/integration-navigation.json @@ -15,6 +15,9 @@ "integration": "attio", "title": "API keys" }, + "aws-credentials": { + "title": "AWS credentials" + }, "box-service-account": { "integration": "box", "title": "Service accounts" @@ -27,6 +30,10 @@ "integration": "clickup", "title": "API tokens" }, + "databricks-credentials": { + "integration": "databricks", + "title": "Databricks connections" + }, "google-service-account": { "title": "Google service accounts" }, diff --git a/apps/sim/app/api/credentials/workload-identity/route.ts b/apps/sim/app/api/credentials/workload-identity/route.ts new file mode 100644 index 00000000000..e9d22dd8a7a --- /dev/null +++ b/apps/sim/app/api/credentials/workload-identity/route.ts @@ -0,0 +1,20 @@ +import { prepareWorkloadIdentityContract } from '@/lib/api/contracts/credentials' +import { + defineInternalJsonRoute, + internalRateLimits, + internalSessionAuth, +} from '@/lib/api/server/routes' +import { internalCredentialErrorPolicy } from '@/lib/credentials/api/route-policies' +import { credentialOperations } from '@/lib/credentials/application/operations' +import { prepareWorkloadIdentity } from '@/lib/credentials/application/prepare-workload-identity' + +export const POST = defineInternalJsonRoute({ + contract: prepareWorkloadIdentityContract, + auth: internalSessionAuth, + operation: credentialOperations.prepareWorkloadIdentity, + rateLimit: internalRateLimits.user({ bucketName: 'credentials.workload_identity.prepare' }), + errorPolicy: internalCredentialErrorPolicy, + mapInput: ({ body }) => body, + useCase: prepareWorkloadIdentity, + present: (result) => result, +}) diff --git a/apps/sim/app/oidc/workload/.well-known/openid-configuration/route.ts b/apps/sim/app/oidc/workload/.well-known/openid-configuration/route.ts new file mode 100644 index 00000000000..0e312e42534 --- /dev/null +++ b/apps/sim/app/oidc/workload/.well-known/openid-configuration/route.ts @@ -0,0 +1,5 @@ +import { withRouteHandler } from '@/lib/core/utils/with-route-handler' +import { workloadIdentityDiscoveryResponse } from '@/lib/credentials/workload-identity/responses' + +/** OpenID Connect discovery for Sim's workload-identity issuer (keyless cloud credentials). */ +export const GET = withRouteHandler(workloadIdentityDiscoveryResponse) diff --git a/apps/sim/app/oidc/workload/jwks/route.ts b/apps/sim/app/oidc/workload/jwks/route.ts new file mode 100644 index 00000000000..b990886e686 --- /dev/null +++ b/apps/sim/app/oidc/workload/jwks/route.ts @@ -0,0 +1,5 @@ +import { withRouteHandler } from '@/lib/core/utils/with-route-handler' +import { workloadIdentityJwksResponse } from '@/lib/credentials/workload-identity/responses' + +/** Public signing keys for Sim's workload-identity issuer. */ +export const GET = withRouteHandler(workloadIdentityJwksResponse) diff --git a/apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/aws-account-modal.tsx b/apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/aws-account-modal.tsx new file mode 100644 index 00000000000..0f94c5d3a17 --- /dev/null +++ b/apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/aws-account-modal.tsx @@ -0,0 +1,381 @@ +'use client' + +import { type ComponentType, useState } from 'react' +import { + ChipCopyInput, + ChipModal, + ChipModalBody, + ChipModalError, + ChipModalField, + ChipModalFooter, + ChipModalHeader, + ChipTextarea, + SecretInput, +} from '@sim/emcn' +import { generateShortId } from '@sim/utils/id' +import { isApiClientError } from '@/lib/api/client/errors' +import { + resourceScopeFields, + resourceScopeFromOwner, + resourceScopeKey, +} from '@/lib/core/resource-scope' +import { AWS_SERVICE_ACCOUNT_PROVIDER_ID } from '@/lib/oauth/types' +import { withBrandIcon } from '@/blocks/brand-icon' +import { + useCreateScopedCredential, + useUpdateScopedCredential, + useWorkloadIdentitySetup, +} from '@/hooks/queries/scoped-credentials' + +interface AwsAccountModalProps { + open: boolean + onOpenChange: (open: boolean) => void + workspaceId?: string + organizationId?: string + serviceIcon: ComponentType<{ className?: string }> + credentialId?: string + initialDisplayName?: string + initialDescription?: string + onCreated?: (credentialId: string) => void +} + +type AwsAuthType = 'oidc_role' | 'access_keys' | 'assume_role' + +const ROLE_ARN_PLACEHOLDER = 'arn:aws:iam::123456789012:role/sim-workflows' +const ACCOUNT_ID_FROM_ROLE_ARN = /^arn:aws[\w-]*:iam::(\d{12}):role\// + +/** The trust policy a customer attaches to the role so it trusts exactly this credential. */ +function buildTrustPolicy(issuer: string, audience: string, subject: string, roleArn: string) { + const issuerHostPath = issuer.replace(/^https:\/\//, '') + const match = ACCOUNT_ID_FROM_ROLE_ARN.exec(roleArn.trim()) + const accountId = match?.[1] ?? '' + const partition = roleArn.trim().startsWith('arn:aws-') ? roleArn.trim().split(':')[1] : 'aws' + return JSON.stringify( + { + Version: '2012-10-17', + Statement: [ + { + Effect: 'Allow', + Principal: { + Federated: `arn:${partition}:iam::${accountId}:oidc-provider/${issuerHostPath}`, + }, + Action: 'sts:AssumeRoleWithWebIdentity', + Condition: { + StringEquals: { + [`${issuerHostPath}:aud`]: audience, + [`${issuerHostPath}:sub`]: subject, + }, + }, + }, + ], + }, + null, + 2 + ) +} + +/** Saved AWS identities share the standard credential create/reconnect lifecycle. */ +export function AwsAccountModal(props: AwsAccountModalProps) { + if (!props.open) return null + return ( + + ) +} + +function AwsAccountForm({ + open, + onOpenChange, + workspaceId, + organizationId, + serviceIcon: ServiceIcon, + credentialId, + initialDisplayName, + initialDescription, + onCreated, +}: AwsAccountModalProps) { + // Keyless roles bind their subject to a workspace; organization credentials use keys. + const supportsOidc = Boolean(workspaceId) && !organizationId + const [authType, setAuthType] = useState(supportsOidc ? 'oidc_role' : 'access_keys') + const [roleArn, setRoleArn] = useState('') + const [accessKeyId, setAccessKeyId] = useState('') + const [secretAccessKey, setSecretAccessKey] = useState('') + const [externalId, setExternalId] = useState('') + const [displayName, setDisplayName] = useState(initialDisplayName ?? '') + const [description, setDescription] = useState(initialDescription ?? '') + const [error, setError] = useState(null) + const [sessionKey] = useState(() => generateShortId()) + + const setup = useWorkloadIdentitySetup({ + workspaceId, + provider: 'aws', + sessionKey, + enabled: authType === 'oidc_role', + }) + const trust = setup.data + const createCredential = useCreateScopedCredential() + const updateCredential = useUpdateScopedCredential() + const isPending = createCredential.isPending || updateCredential.isPending + const action = credentialId ? 'Reconnect' : 'Add' + + const needsKeys = authType === 'access_keys' || authType === 'assume_role' + const needsRole = authType === 'oidc_role' || authType === 'assume_role' + const disabled = + isPending || + (needsKeys && (!accessKeyId.trim() || !secretAccessKey)) || + (needsRole && !roleArn.trim()) || + (authType === 'oidc_role' && !trust) + + const clearError = () => setError(null) + + const buildConfig = () => { + if (authType === 'oidc_role' && trust) { + return { + authType, + roleArn: roleArn.trim(), + subject: trust.subject, + subjectProof: trust.subjectProof, + } + } + const keys = { accessKeyId: accessKeyId.trim(), secretAccessKey } + if (authType === 'assume_role') { + return { + authType, + ...keys, + roleArn: roleArn.trim(), + ...(externalId.trim() ? { externalId: externalId.trim() } : {}), + } + } + return { authType: 'access_keys' as const, ...keys } + } + + const submit = async () => { + if (disabled) return + setError(null) + const input = { + ...resourceScopeFields(resourceScopeFromOwner({ workspaceId, organizationId })), + serviceAccountJson: JSON.stringify(buildConfig()), + displayName: displayName.trim() || undefined, + description: description.trim() || undefined, + } + try { + let connectedId = credentialId + if (credentialId) + await updateCredential.mutateAsync({ + ...input, + credentialId, + description: description.trim() || null, + }) + else { + const created = await createCredential.mutateAsync({ + ...input, + type: 'service_account', + providerId: AWS_SERVICE_ACCOUNT_PROVIDER_ID, + }) + connectedId = created.credential.id + } + if (connectedId) onCreated?.(connectedId) + onOpenChange(false) + } catch (error) { + if (isApiClientError(error) && error.code === 'duplicate_display_name') { + setError('A credential with that name already exists. Choose a different display name.') + return + } + setError( + isApiClientError(error) && error.message + ? error.message + : 'Could not verify the AWS credential. Check the details and try again.' + ) + } + } + + const authOptions = [ + ...(supportsOidc ? [{ value: 'oidc_role', label: 'IAM role (keyless, via Sim OIDC)' }] : []), + { value: 'access_keys', label: 'Access keys' }, + { value: 'assume_role', label: 'Access keys that assume an IAM role' }, + ] + + return ( + + onOpenChange(false)}> + {action} AWS credential + + + { + setAuthType(value as AwsAuthType) + clearError() + }} + options={authOptions} + placeholder='Choose how Sim signs in to AWS' + required + hint={ + authType === 'oidc_role' + ? 'No keys are stored. Sim signs a short-lived token that your role trusts.' + : authType === 'assume_role' + ? 'Sim uses the keys only to assume the role, then works with temporary credentials.' + : 'Sim signs requests with these long-lived keys.' + } + /> + + {authType === 'oidc_role' && ( + <> + {setup.isError && ( + + {isApiClientError(setup.error) && setup.error.message + ? setup.error.message + : 'Could not start a keyless role connection. Use access keys instead.'} + + )} + {trust && ( + <> + + {(aria) => } + + + {(aria) => ( + + )} + + + {(aria) => ( + + )} + + + )} + + )} + + {needsKeys && ( + <> + { + setAccessKeyId(value) + clearError() + }} + placeholder='AKIA...' + required + autoComplete='off' + /> + + {(aria) => ( + { + setSecretAccessKey(value) + clearError() + }} + placeholder='Enter the secret access key' + autoComplete='new-password' + data-lpignore='true' + /> + )} + + + )} + + {needsRole && ( + { + setRoleArn(value) + clearError() + }} + placeholder={ROLE_ARN_PLACEHOLDER} + required + autoComplete='off' + /> + )} + + {authType === 'assume_role' && ( + { + setExternalId(value) + clearError() + }} + placeholder='Optional, if the role requires one' + autoComplete='off' + /> + )} + + {authType === 'oidc_role' && trust && ( + + {(aria) => ( + + )} + + )} + + + + {error} + + onOpenChange(false)} + secondaryActions={[ + { + label: 'Setup guide', + onClick: () => + window.open( + 'https://docs.sim.ai/integrations/aws-credentials', + '_blank', + 'noopener,noreferrer' + ), + }, + ]} + primaryAction={{ + label: isPending ? 'Verifying...' : `${action} credential`, + onClick: submit, + disabled, + }} + /> + + ) +} diff --git a/apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/connect-service-account-modal.tsx b/apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/connect-service-account-modal.tsx index b9d825364c3..d4c8f6af607 100644 --- a/apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/connect-service-account-modal.tsx +++ b/apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/connect-service-account-modal.tsx @@ -33,12 +33,16 @@ import { import { getServiceAccountCoverageSentence } from '@/lib/integrations/credential-display' import { ATLASSIAN_SERVICE_ACCOUNT_PROVIDER_ID, + AWS_SERVICE_ACCOUNT_PROVIDER_ID, + DATABRICKS_SERVICE_ACCOUNT_PROVIDER_ID, GOOGLE_SERVICE_ACCOUNT_PROVIDER_ID, OCI_API_KEY_SERVICE_ACCOUNT_PROVIDER_ID, ORACLE_DATABASE_SERVICE_ACCOUNT_PROVIDER_ID, SLACK_CUSTOM_BOT_PROVIDER_ID, } from '@/lib/oauth/types' +import { AwsAccountModal } from '@/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/aws-account-modal' import { ClientCredentialAccountModal } from '@/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/client-credential-account-modal' +import { DatabricksAccountModal } from '@/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/databricks-account-modal' import { OracleDatabaseAccountModal } from '@/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/oracle-database-account-modal' import { TokenServiceAccountModal } from '@/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/token-service-account-modal' import { ConnectSlackBotModal } from '@/app/workspace/[workspaceId]/integrations/components/connect-slack-bot-modal/connect-slack-bot-modal' @@ -56,6 +60,8 @@ export type ServiceAccountProviderId = | typeof SLACK_CUSTOM_BOT_PROVIDER_ID | typeof OCI_API_KEY_SERVICE_ACCOUNT_PROVIDER_ID | typeof ORACLE_DATABASE_SERVICE_ACCOUNT_PROVIDER_ID + | typeof AWS_SERVICE_ACCOUNT_PROVIDER_ID + | typeof DATABRICKS_SERVICE_ACCOUNT_PROVIDER_ID | TokenServiceAccountProviderId | ClientCredentialAccountProviderId @@ -177,6 +183,36 @@ export function ConnectServiceAccountModal({ onSubmitCredentials, submitPending, }: ConnectServiceAccountModalProps) { + if (serviceAccountProviderId === DATABRICKS_SERVICE_ACCOUNT_PROVIDER_ID) { + return ( + + ) + } + if (serviceAccountProviderId === AWS_SERVICE_ACCOUNT_PROVIDER_ID) { + return ( + + ) + } if (serviceAccountProviderId === ORACLE_DATABASE_SERVICE_ACCOUNT_PROVIDER_ID) { return ( void + workspaceId?: string + organizationId?: string + serviceIcon: ComponentType<{ className?: string }> + credentialId?: string + initialDisplayName?: string + initialDescription?: string + onCreated?: (credentialId: string) => void +} + +type DatabricksAuthType = 'oidc_federation' | 'service_principal' | 'personal_access_token' + +/** The account-level CLI command that makes the service principal trust this credential. */ +function buildFederationPolicyCommand(issuer: string, audience: string, subject: string) { + const policy = JSON.stringify({ oidc_policy: { issuer, audiences: [audience], subject } }) + return `databricks account service-principal-federation-policy create --json '${policy}'` +} + +/** Saved Databricks connections share the standard credential create/reconnect lifecycle. */ +export function DatabricksAccountModal(props: DatabricksAccountModalProps) { + if (!props.open) return null + return ( + + ) +} + +function DatabricksAccountForm({ + open, + onOpenChange, + workspaceId, + organizationId, + serviceIcon: ServiceIcon, + credentialId, + initialDisplayName, + initialDescription, + onCreated, +}: DatabricksAccountModalProps) { + // Keyless principals bind their subject to a workspace; organization connections use secrets. + const supportsOidc = Boolean(workspaceId) && !organizationId + const [authType, setAuthType] = useState( + supportsOidc ? 'oidc_federation' : 'service_principal' + ) + const [host, setHost] = useState('') + const [token, setToken] = useState('') + const [clientId, setClientId] = useState('') + const [clientSecret, setClientSecret] = useState('') + const [displayName, setDisplayName] = useState(initialDisplayName ?? '') + const [description, setDescription] = useState(initialDescription ?? '') + const [error, setError] = useState(null) + const [sessionKey] = useState(() => generateShortId()) + + const setup = useWorkloadIdentitySetup({ + workspaceId, + provider: 'databricks', + sessionKey, + enabled: authType === 'oidc_federation', + }) + const trust = setup.data + const createCredential = useCreateScopedCredential() + const updateCredential = useUpdateScopedCredential() + const isPending = createCredential.isPending || updateCredential.isPending + const action = credentialId ? 'Reconnect' : 'Add' + + const disabled = + isPending || + !host.trim() || + (authType === 'personal_access_token' && !token.trim()) || + (authType === 'service_principal' && (!clientId.trim() || !clientSecret)) || + (authType === 'oidc_federation' && (!clientId.trim() || !trust)) + + const clearError = () => setError(null) + + const buildConfig = () => { + const base = { host: host.trim() } + if (authType === 'oidc_federation' && trust) { + return { + authType, + ...base, + clientId: clientId.trim(), + subject: trust.subject, + subjectProof: trust.subjectProof, + } + } + if (authType === 'service_principal') { + return { authType, ...base, clientId: clientId.trim(), clientSecret } + } + return { authType: 'personal_access_token' as const, ...base, token: token.trim() } + } + + const submit = async () => { + if (disabled) return + setError(null) + const input = { + ...resourceScopeFields(resourceScopeFromOwner({ workspaceId, organizationId })), + serviceAccountJson: JSON.stringify(buildConfig()), + displayName: displayName.trim() || undefined, + description: description.trim() || undefined, + } + try { + let connectedId = credentialId + if (credentialId) + await updateCredential.mutateAsync({ + ...input, + credentialId, + description: description.trim() || null, + }) + else { + const created = await createCredential.mutateAsync({ + ...input, + type: 'service_account', + providerId: DATABRICKS_SERVICE_ACCOUNT_PROVIDER_ID, + }) + connectedId = created.credential.id + } + if (connectedId) onCreated?.(connectedId) + onOpenChange(false) + } catch (error) { + if (isApiClientError(error) && error.code === 'duplicate_display_name') { + setError('A credential with that name already exists. Choose a different display name.') + return + } + setError( + isApiClientError(error) && error.message + ? error.message + : 'Could not verify the Databricks connection. Check the details and try again.' + ) + } + } + + const authOptions = [ + ...(supportsOidc + ? [{ value: 'oidc_federation', label: 'Service principal (keyless, via Sim OIDC)' }] + : []), + { value: 'service_principal', label: 'Service principal OAuth secret' }, + { value: 'personal_access_token', label: 'Personal access token' }, + ] + + return ( + + onOpenChange(false)}> + {action} Databricks connection + + + { + setAuthType(value as DatabricksAuthType) + clearError() + }} + options={authOptions} + placeholder='Choose how Sim signs in to Databricks' + required + hint={ + authType === 'oidc_federation' + ? 'No secret is stored. Sim signs a short-lived token your service principal trusts.' + : authType === 'service_principal' + ? 'Sim exchanges the OAuth secret for a short-lived workspace token on each run.' + : 'Sim sends this token on every request.' + } + /> + { + setHost(value) + clearError() + }} + placeholder='dbc-abc123.cloud.databricks.com' + required + autoComplete='off' + /> + + {authType === 'personal_access_token' && ( + + {(aria) => ( + { + setToken(value) + clearError() + }} + placeholder='dapi...' + autoComplete='new-password' + data-lpignore='true' + /> + )} + + )} + + {(authType === 'service_principal' || authType === 'oidc_federation') && ( + { + setClientId(value) + clearError() + }} + placeholder='7cb2f8a4-49a7-4147-83db-35cb69e5cede' + required + autoComplete='off' + /> + )} + + {authType === 'service_principal' && ( + + {(aria) => ( + { + setClientSecret(value) + clearError() + }} + placeholder='Enter the service principal OAuth secret' + autoComplete='new-password' + data-lpignore='true' + /> + )} + + )} + + {authType === 'oidc_federation' && ( + <> + {setup.isError && ( + + {isApiClientError(setup.error) && setup.error.message + ? setup.error.message + : 'Could not start a keyless connection. Use a service principal secret instead.'} + + )} + {trust && ( + <> + + {(aria) => ( + + )} + + + {(aria) => ( + + )} + + + {(aria) => ( + + )} + + + {(aria) => ( + + )} + + + )} + + )} + + + + {error} + + onOpenChange(false)} + secondaryActions={[ + { + label: 'Setup guide', + onClick: () => + window.open( + 'https://docs.sim.ai/integrations/databricks-credentials', + '_blank', + 'noopener,noreferrer' + ), + }, + ]} + primaryAction={{ + label: isPending ? 'Verifying...' : `${action} connection`, + onClick: submit, + disabled, + }} + /> + + ) +} diff --git a/apps/sim/blocks/blocks/appconfig.ts b/apps/sim/blocks/blocks/appconfig.ts index 4627d32bafc..47ed9f81707 100644 --- a/apps/sim/blocks/blocks/appconfig.ts +++ b/apps/sim/blocks/blocks/appconfig.ts @@ -1,6 +1,7 @@ import { AppConfigIcon } from '@/components/icons' import type { BlockConfig, BlockMeta } from '@/blocks/types' import { AuthMode, IntegrationType } from '@/blocks/types' +import { AWS_CREDENTIAL_SUBBLOCKS, withoutSavedCredential } from '@/blocks/utils' export const AppConfigBlock: BlockConfig = { type: 'appconfig', @@ -182,12 +183,14 @@ export const AppConfigBlock: BlockConfig = { placeholder: 'us-east-1', required: true, }, + ...AWS_CREDENTIAL_SUBBLOCKS, { id: 'accessKeyId', title: 'AWS Access Key ID', type: 'short-input', placeholder: 'AKIA...', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -196,6 +199,7 @@ export const AppConfigBlock: BlockConfig = { type: 'short-input', placeholder: 'Your secret access key', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -640,6 +644,10 @@ export const AppConfigBlock: BlockConfig = { inputs: { operation: { type: 'string', description: 'AppConfig operation to perform' }, region: { type: 'string', description: 'AWS region' }, + oauthCredential: { + type: 'string', + description: 'Saved AWS credential (optional; replaces the access keys)', + }, accessKeyId: { type: 'string', description: 'AWS access key ID' }, secretAccessKey: { type: 'string', description: 'AWS secret access key' }, applicationId: { type: 'string', description: 'Application ID or name' }, diff --git a/apps/sim/blocks/blocks/athena.ts b/apps/sim/blocks/blocks/athena.ts index 27f7eaac49d..6c0c98d4829 100644 --- a/apps/sim/blocks/blocks/athena.ts +++ b/apps/sim/blocks/blocks/athena.ts @@ -1,6 +1,7 @@ import { AthenaIcon } from '@/components/icons' import type { BlockConfig, BlockMeta } from '@/blocks/types' -import { IntegrationType } from '@/blocks/types' +import { AuthMode, IntegrationType } from '@/blocks/types' +import { AWS_CREDENTIAL_SUBBLOCKS, withoutSavedCredential } from '@/blocks/utils' /** * Normalizes a switch value that may arrive as a boolean or as the strings 'true' / 'false'. @@ -15,6 +16,7 @@ function parseBoolean(value: unknown): boolean | undefined { export const AthenaBlock: BlockConfig = { type: 'athena', name: 'Athena', + authMode: AuthMode.ApiKey, description: 'Run SQL queries on data in Amazon S3 using AWS Athena', longDescription: 'Execute SQL queries against data in S3, check query status and runtime statistics, retrieve results, manage named queries and prepared statements, and inspect data catalogs, databases, tables, and workgroups. Requires AWS access key and secret access key.', @@ -170,12 +172,14 @@ export const AthenaBlock: BlockConfig = { placeholder: 'us-east-1', required: true, }, + ...AWS_CREDENTIAL_SUBBLOCKS, { id: 'awsAccessKeyId', title: 'AWS Access Key ID', type: 'short-input', placeholder: 'AKIA...', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -184,6 +188,7 @@ export const AthenaBlock: BlockConfig = { type: 'short-input', placeholder: 'Your secret access key', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -971,6 +976,10 @@ Return ONLY a JSON array of strings — no explanations, no markdown code blocks inputs: { operation: { type: 'string', description: 'Athena operation to perform' }, awsRegion: { type: 'string', description: 'AWS region' }, + oauthCredential: { + type: 'string', + description: 'Saved AWS credential (optional; replaces the access keys)', + }, awsAccessKeyId: { type: 'string', description: 'AWS access key ID' }, awsSecretAccessKey: { type: 'string', description: 'AWS secret access key' }, queryString: { type: 'string', description: 'SQL query string' }, diff --git a/apps/sim/blocks/blocks/cloudformation.ts b/apps/sim/blocks/blocks/cloudformation.ts index ecfc6f9b0a2..646e9317331 100644 --- a/apps/sim/blocks/blocks/cloudformation.ts +++ b/apps/sim/blocks/blocks/cloudformation.ts @@ -1,11 +1,13 @@ import { getErrorMessage } from '@sim/utils/errors' import { CloudFormationIcon } from '@/components/icons' import type { BlockConfig, BlockMeta } from '@/blocks/types' -import { IntegrationType } from '@/blocks/types' +import { AuthMode, IntegrationType } from '@/blocks/types' +import { AWS_CREDENTIAL_SUBBLOCKS, withoutSavedCredential } from '@/blocks/utils' export const CloudFormationBlock: BlockConfig = { type: 'cloudformation', name: 'CloudFormation', + authMode: AuthMode.ApiKey, description: 'Manage and inspect AWS CloudFormation stacks, resources, and drift', longDescription: 'Create, update, and delete stacks, preview changes with change sets, describe stacks, list resources, detect drift, view stack events, and retrieve or validate templates. Requires AWS access key and secret access key.', @@ -102,12 +104,14 @@ export const CloudFormationBlock: BlockConfig = { placeholder: 'us-east-1', required: true, }, + ...AWS_CREDENTIAL_SUBBLOCKS, { id: 'awsAccessKeyId', title: 'AWS Access Key ID', type: 'short-input', placeholder: 'AKIA...', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -116,6 +120,7 @@ export const CloudFormationBlock: BlockConfig = { type: 'short-input', placeholder: 'Your secret access key', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -619,6 +624,10 @@ Return ONLY valid JSON - no explanations, no markdown code blocks.`, inputs: { operation: { type: 'string', description: 'CloudFormation operation to perform' }, awsRegion: { type: 'string', description: 'AWS region' }, + oauthCredential: { + type: 'string', + description: 'Saved AWS credential (optional; replaces the access keys)', + }, awsAccessKeyId: { type: 'string', description: 'AWS access key ID' }, awsSecretAccessKey: { type: 'string', description: 'AWS secret access key' }, stackName: { type: 'string', description: 'Stack name or ID' }, diff --git a/apps/sim/blocks/blocks/cloudtrail.ts b/apps/sim/blocks/blocks/cloudtrail.ts index 0d4d7c7d878..07f8246c7b3 100644 --- a/apps/sim/blocks/blocks/cloudtrail.ts +++ b/apps/sim/blocks/blocks/cloudtrail.ts @@ -1,6 +1,7 @@ import { CloudTrailIcon } from '@/components/icons' import type { BlockConfig, BlockMeta } from '@/blocks/types' import { AuthMode, IntegrationType } from '@/blocks/types' +import { AWS_CREDENTIAL_SUBBLOCKS, withoutSavedCredential } from '@/blocks/utils' /** Operations that accept an opaque AWS pagination token. */ const PAGINATED_OPERATIONS = [ @@ -120,12 +121,14 @@ export const CloudTrailBlock: BlockConfig = { placeholder: 'us-east-1', required: true, }, + ...AWS_CREDENTIAL_SUBBLOCKS, { id: 'awsAccessKeyId', title: 'AWS Access Key ID', type: 'short-input', placeholder: 'AKIA...', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -134,6 +137,7 @@ export const CloudTrailBlock: BlockConfig = { type: 'short-input', placeholder: 'Your secret access key', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -584,6 +588,10 @@ Return ONLY the SQL query — no explanations, no markdown code blocks.`, inputs: { operation: { type: 'string', description: 'CloudTrail operation to perform' }, awsRegion: { type: 'string', description: 'AWS region' }, + oauthCredential: { + type: 'string', + description: 'Saved AWS credential (optional; replaces the access keys)', + }, awsAccessKeyId: { type: 'string', description: 'AWS access key ID' }, awsSecretAccessKey: { type: 'string', description: 'AWS secret access key' }, attributeKey: { type: 'string', description: 'Lookup attribute to filter events on' }, diff --git a/apps/sim/blocks/blocks/cloudwatch.ts b/apps/sim/blocks/blocks/cloudwatch.ts index b5fadd2818e..8a6a6e99a50 100644 --- a/apps/sim/blocks/blocks/cloudwatch.ts +++ b/apps/sim/blocks/blocks/cloudwatch.ts @@ -1,6 +1,7 @@ import { CloudWatchIcon } from '@/components/icons' import type { BlockConfig, BlockMeta } from '@/blocks/types' -import { IntegrationType } from '@/blocks/types' +import { AuthMode, IntegrationType } from '@/blocks/types' +import { AWS_CREDENTIAL_SUBBLOCKS, withoutSavedCredential } from '@/blocks/utils' /* * Canonical basic/advanced pairs, shared by the card sentences below. Listing @@ -15,6 +16,7 @@ const LOG_STREAM_FIELD = ['logStreamNameSelector', 'logStreamNameInput'] as cons export const CloudWatchBlock: BlockConfig = { type: 'cloudwatch', name: 'CloudWatch', + authMode: AuthMode.ApiKey, description: 'Query and monitor AWS CloudWatch logs, metrics, and alarms', longDescription: 'Run Log Insights queries, list log groups, retrieve log events, list and get metrics, and monitor alarms. Requires AWS access key and secret access key.', @@ -117,12 +119,14 @@ export const CloudWatchBlock: BlockConfig = { placeholder: 'us-east-1', required: true, }, + ...AWS_CREDENTIAL_SUBBLOCKS, { id: 'awsAccessKeyId', title: 'AWS Access Key ID', type: 'short-input', placeholder: 'AKIA...', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -131,6 +135,7 @@ export const CloudWatchBlock: BlockConfig = { type: 'short-input', placeholder: 'Your secret access key', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -1045,6 +1050,10 @@ Return ONLY the numeric timestamp - no explanations, no quotes, no extra text.`, inputs: { operation: { type: 'string', description: 'CloudWatch operation to perform' }, awsRegion: { type: 'string', description: 'AWS region' }, + oauthCredential: { + type: 'string', + description: 'Saved AWS credential (optional; replaces the access keys)', + }, awsAccessKeyId: { type: 'string', description: 'AWS access key ID' }, awsSecretAccessKey: { type: 'string', description: 'AWS secret access key' }, logGroupNames: { type: 'string', description: 'Log group name(s) for query' }, diff --git a/apps/sim/blocks/blocks/codepipeline.ts b/apps/sim/blocks/blocks/codepipeline.ts index fea6c081723..0aafb3d61af 100644 --- a/apps/sim/blocks/blocks/codepipeline.ts +++ b/apps/sim/blocks/blocks/codepipeline.ts @@ -2,9 +2,11 @@ import { CodePipelineIcon } from '@/components/icons' import type { BlockConfig, BlockMeta } from '@/blocks/types' import { AuthMode, IntegrationType } from '@/blocks/types' import { + AWS_CREDENTIAL_SUBBLOCKS, parseOptionalBooleanInput, parseOptionalJsonInput, parseOptionalNumberInput, + withoutSavedCredential, } from '@/blocks/utils' export const CodePipelineBlock: BlockConfig = { @@ -107,12 +109,14 @@ export const CodePipelineBlock: BlockConfig = { placeholder: 'us-east-1', required: true, }, + ...AWS_CREDENTIAL_SUBBLOCKS, { id: 'awsAccessKeyId', title: 'AWS Access Key ID', type: 'short-input', placeholder: 'AKIA...', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -121,6 +125,7 @@ export const CodePipelineBlock: BlockConfig = { type: 'short-input', placeholder: 'Your secret access key', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -562,6 +567,10 @@ export const CodePipelineBlock: BlockConfig = { inputs: { operation: { type: 'string', description: 'CodePipeline operation to perform' }, awsRegion: { type: 'string', description: 'AWS region' }, + oauthCredential: { + type: 'string', + description: 'Saved AWS credential (optional; replaces the access keys)', + }, awsAccessKeyId: { type: 'string', description: 'AWS access key ID' }, awsSecretAccessKey: { type: 'string', description: 'AWS secret access key' }, pipelineName: { type: 'string', description: 'Pipeline name' }, diff --git a/apps/sim/blocks/blocks/databricks.ts b/apps/sim/blocks/blocks/databricks.ts index 14b55c115b0..4dcb3a9475e 100644 --- a/apps/sim/blocks/blocks/databricks.ts +++ b/apps/sim/blocks/blocks/databricks.ts @@ -1,6 +1,7 @@ import { DatabricksIcon } from '@/components/icons' import type { BlockConfig, BlockMeta } from '@/blocks/types' import { AuthMode, IntegrationType } from '@/blocks/types' +import { DATABRICKS_CREDENTIAL_SUBBLOCKS, withoutSavedCredential } from '@/blocks/utils' /** A run is parameterized either at the job level or per notebook, never both. */ const DATABRICKS_RUN_PARAMS_FIELD = ['jobParameters', 'notebookParams'] as const @@ -1978,11 +1979,13 @@ Return ONLY the numeric timestamp in milliseconds - no explanations, no extra te }, }, + ...DATABRICKS_CREDENTIAL_SUBBLOCKS, { id: 'host', title: 'Workspace Host', type: 'short-input', placeholder: 'dbc-abc123.cloud.databricks.com', + condition: withoutSavedCredential(), required: true, }, { @@ -1991,6 +1994,7 @@ Return ONLY the numeric timestamp in milliseconds - no explanations, no extra te type: 'short-input', placeholder: 'Enter your Databricks Personal Access Token', password: true, + condition: withoutSavedCredential(), required: true, }, ], @@ -2394,6 +2398,10 @@ Return ONLY the numeric timestamp in milliseconds - no explanations, no extra te only: { type: 'json', description: 'Task keys to run; omit to run every task' }, operation: { type: 'string', description: 'Operation to perform' }, + oauthCredential: { + type: 'string', + description: 'Saved Databricks connection (optional; replaces the host and token)', + }, host: { type: 'string', description: 'Databricks workspace host URL' }, apiKey: { type: 'string', description: 'Databricks Personal Access Token' }, warehouseId: { type: 'string', description: 'SQL warehouse ID' }, diff --git a/apps/sim/blocks/blocks/dynamodb.ts b/apps/sim/blocks/blocks/dynamodb.ts index c445293cff4..b53196e1c48 100644 --- a/apps/sim/blocks/blocks/dynamodb.ts +++ b/apps/sim/blocks/blocks/dynamodb.ts @@ -2,6 +2,7 @@ import { toError } from '@sim/utils/errors' import { DynamoDBIcon } from '@/components/icons' import type { BlockConfig, BlockMeta } from '@/blocks/types' import { AuthMode, IntegrationType } from '@/blocks/types' +import { AWS_CREDENTIAL_SUBBLOCKS, withoutSavedCredential } from '@/blocks/utils' export const DynamoDBBlock: BlockConfig = { type: 'dynamodb', @@ -82,12 +83,14 @@ export const DynamoDBBlock: BlockConfig = { placeholder: 'us-east-1', required: true, }, + ...AWS_CREDENTIAL_SUBBLOCKS, { id: 'accessKeyId', title: 'AWS Access Key ID', type: 'short-input', placeholder: 'AKIA...', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -96,6 +99,7 @@ export const DynamoDBBlock: BlockConfig = { type: 'short-input', placeholder: 'Your secret access key', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -774,6 +778,10 @@ Return ONLY the expression - no explanations.`, inputs: { operation: { type: 'string', description: 'DynamoDB operation to perform' }, region: { type: 'string', description: 'AWS region' }, + oauthCredential: { + type: 'string', + description: 'Saved AWS credential (optional; replaces the access keys)', + }, accessKeyId: { type: 'string', description: 'AWS access key ID' }, secretAccessKey: { type: 'string', description: 'AWS secret access key' }, tableName: { type: 'string', description: 'DynamoDB table name' }, diff --git a/apps/sim/blocks/blocks/ec2.ts b/apps/sim/blocks/blocks/ec2.ts index ddc5bc05d4d..16066409ac8 100644 --- a/apps/sim/blocks/blocks/ec2.ts +++ b/apps/sim/blocks/blocks/ec2.ts @@ -1,6 +1,7 @@ import { EC2Icon } from '@/components/icons' import type { BlockConfig, BlockMeta } from '@/blocks/types' import { AuthMode, IntegrationType } from '@/blocks/types' +import { AWS_CREDENTIAL_SUBBLOCKS, withoutSavedCredential } from '@/blocks/utils' const INSTANCE_ACTIONS = [ 'start_instances', @@ -205,12 +206,14 @@ export const EC2Block: BlockConfig = { placeholder: 'us-east-1', required: true, }, + ...AWS_CREDENTIAL_SUBBLOCKS, { id: 'awsAccessKeyId', title: 'AWS Access Key ID', type: 'short-input', placeholder: 'Enter your AWS access key ID', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -219,6 +222,7 @@ export const EC2Block: BlockConfig = { type: 'short-input', placeholder: 'Enter your AWS secret access key', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -686,6 +690,10 @@ Return ONLY the JSON array, no explanation.`, inputs: { operation: { type: 'string', description: 'EC2 operation to perform' }, awsRegion: { type: 'string', description: 'AWS region' }, + oauthCredential: { + type: 'string', + description: 'Saved AWS credential (optional; replaces the access keys)', + }, awsAccessKeyId: { type: 'string', description: 'AWS access key ID' }, awsSecretAccessKey: { type: 'string', description: 'AWS secret access key' }, instanceIds: { type: 'string', description: 'Comma-separated instance IDs' }, diff --git a/apps/sim/blocks/blocks/iam.ts b/apps/sim/blocks/blocks/iam.ts index cd99bcabd96..e8a71876d0c 100644 --- a/apps/sim/blocks/blocks/iam.ts +++ b/apps/sim/blocks/blocks/iam.ts @@ -1,6 +1,7 @@ import { IAMIcon } from '@/components/icons' import type { BlockConfig, BlockMeta } from '@/blocks/types' import { AuthMode, IntegrationType } from '@/blocks/types' +import { AWS_CREDENTIAL_SUBBLOCKS, withoutSavedCredential } from '@/blocks/utils' /** * Raised when `contextEntries` is not a JSON array of context entries. @@ -153,12 +154,14 @@ export const IAMBlock: BlockConfig = { placeholder: 'us-east-1', required: true, }, + ...AWS_CREDENTIAL_SUBBLOCKS, { id: 'accessKeyId', title: 'AWS Access Key ID', type: 'short-input', placeholder: 'AKIA...', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -167,6 +170,7 @@ export const IAMBlock: BlockConfig = { type: 'short-input', placeholder: 'Your secret access key', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -716,6 +720,10 @@ export const IAMBlock: BlockConfig = { inputs: { operation: { type: 'string', description: 'IAM operation to perform' }, region: { type: 'string', description: 'AWS region' }, + oauthCredential: { + type: 'string', + description: 'Saved AWS credential (optional; replaces the access keys)', + }, accessKeyId: { type: 'string', description: 'AWS access key ID' }, secretAccessKey: { type: 'string', description: 'AWS secret access key' }, userName: { type: 'string', description: 'IAM user name' }, diff --git a/apps/sim/blocks/blocks/identity_center.ts b/apps/sim/blocks/blocks/identity_center.ts index 7d58ebfd26c..926deffe06b 100644 --- a/apps/sim/blocks/blocks/identity_center.ts +++ b/apps/sim/blocks/blocks/identity_center.ts @@ -1,6 +1,7 @@ import { IdentityCenterIcon } from '@/components/icons' import type { BlockConfig, BlockMeta } from '@/blocks/types' import { AuthMode, IntegrationType } from '@/blocks/types' +import { AWS_CREDENTIAL_SUBBLOCKS, withoutSavedCredential } from '@/blocks/utils' export const IdentityCenterBlock: BlockConfig = { type: 'identity_center', @@ -87,12 +88,14 @@ export const IdentityCenterBlock: BlockConfig = { placeholder: 'us-east-1', required: true, }, + ...AWS_CREDENTIAL_SUBBLOCKS, { id: 'accessKeyId', title: 'AWS Access Key ID', type: 'short-input', placeholder: 'AKIA...', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -101,6 +104,7 @@ export const IdentityCenterBlock: BlockConfig = { type: 'short-input', placeholder: 'Your secret access key', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -518,6 +522,10 @@ export const IdentityCenterBlock: BlockConfig = { inputs: { operation: { type: 'string', description: 'Identity Center operation to perform' }, region: { type: 'string', description: 'AWS region' }, + oauthCredential: { + type: 'string', + description: 'Saved AWS credential (optional; replaces the access keys)', + }, accessKeyId: { type: 'string', description: 'AWS access key ID' }, secretAccessKey: { type: 'string', description: 'AWS secret access key' }, instanceArn: { type: 'string', description: 'Identity Center instance ARN' }, diff --git a/apps/sim/blocks/blocks/lambda.ts b/apps/sim/blocks/blocks/lambda.ts index ecd5502ca12..f58dafd3ddf 100644 --- a/apps/sim/blocks/blocks/lambda.ts +++ b/apps/sim/blocks/blocks/lambda.ts @@ -2,6 +2,7 @@ import { getErrorMessage } from '@sim/utils/errors' import { LambdaIcon } from '@/components/icons' import type { BlockConfig, BlockMeta } from '@/blocks/types' import { AuthMode, IntegrationType } from '@/blocks/types' +import { AWS_CREDENTIAL_SUBBLOCKS, withoutSavedCredential } from '@/blocks/utils' type ParamKind = 'string' | 'number' | 'boolean' | 'json' | 'array' | 'jsonArray' @@ -629,12 +630,14 @@ export const LambdaBlock: BlockConfig = { placeholder: 'us-east-1', required: true, }, + ...AWS_CREDENTIAL_SUBBLOCKS, { id: 'awsAccessKeyId', title: 'AWS Access Key ID', type: 'short-input', placeholder: 'AKIA...', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -643,6 +646,7 @@ export const LambdaBlock: BlockConfig = { type: 'short-input', placeholder: 'Your secret access key', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -1912,6 +1916,10 @@ export const LambdaBlock: BlockConfig = { inputs: { operation: { type: 'string', description: 'Lambda operation to perform' }, awsRegion: { type: 'string', description: 'AWS region' }, + oauthCredential: { + type: 'string', + description: 'Saved AWS credential (optional; replaces the access keys)', + }, awsAccessKeyId: { type: 'string', description: 'AWS access key ID' }, awsSecretAccessKey: { type: 'string', description: 'AWS secret access key' }, functionName: { type: 'string', description: 'Function Name' }, diff --git a/apps/sim/blocks/blocks/rds.ts b/apps/sim/blocks/blocks/rds.ts index 6a66795bae8..a68d7448ab0 100644 --- a/apps/sim/blocks/blocks/rds.ts +++ b/apps/sim/blocks/blocks/rds.ts @@ -1,11 +1,13 @@ import { getErrorMessage } from '@sim/utils/errors' import { RDSIcon } from '@/components/icons' import type { BlockConfig, BlockMeta } from '@/blocks/types' -import { IntegrationType } from '@/blocks/types' +import { AuthMode, IntegrationType } from '@/blocks/types' +import { AWS_CREDENTIAL_SUBBLOCKS, withoutSavedCredential } from '@/blocks/utils' export const RDSBlock: BlockConfig = { type: 'rds', name: 'Amazon RDS', + authMode: AuthMode.ApiKey, description: 'Connect to Amazon RDS via Data API', longDescription: 'Integrate Amazon RDS Aurora Serverless into the workflow using the Data API. Can query, insert, update, delete, and execute raw SQL without managing database connections.', @@ -69,12 +71,14 @@ export const RDSBlock: BlockConfig = { placeholder: 'us-east-1', required: true, }, + ...AWS_CREDENTIAL_SUBBLOCKS, { id: 'accessKeyId', title: 'AWS Access Key ID', type: 'short-input', placeholder: 'AKIA...', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -83,6 +87,7 @@ export const RDSBlock: BlockConfig = { type: 'short-input', placeholder: 'Your secret access key', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -474,6 +479,10 @@ Return ONLY the JSON object.`, inputs: { operation: { type: 'string', description: 'Database operation to perform' }, region: { type: 'string', description: 'AWS region' }, + oauthCredential: { + type: 'string', + description: 'Saved AWS credential (optional; replaces the access keys)', + }, accessKeyId: { type: 'string', description: 'AWS access key ID' }, secretAccessKey: { type: 'string', description: 'AWS secret access key' }, resourceArn: { type: 'string', description: 'Aurora DB cluster ARN' }, diff --git a/apps/sim/blocks/blocks/s3.ts b/apps/sim/blocks/blocks/s3.ts index 407886d0ef5..4d9752195d3 100644 --- a/apps/sim/blocks/blocks/s3.ts +++ b/apps/sim/blocks/blocks/s3.ts @@ -1,7 +1,12 @@ import { S3Icon } from '@/components/icons' import type { BlockConfig, BlockMeta } from '@/blocks/types' import { AuthMode, IntegrationType } from '@/blocks/types' -import { normalizeFileInput } from '@/blocks/utils' +import { + AWS_CREDENTIAL_SUBBLOCKS, + hasSavedCredential, + normalizeFileInput, + withoutSavedCredential, +} from '@/blocks/utils' /** * Normalize the batch-delete keys input into a string array. Accepts an array, @@ -116,12 +121,14 @@ export const S3Block: BlockConfig = { value: () => 'get_object', }, // AWS Credentials + ...AWS_CREDENTIAL_SUBBLOCKS, { id: 'accessKeyId', title: 'Access Key ID', type: 'short-input', placeholder: 'Enter your AWS Access Key ID', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -130,6 +137,7 @@ export const S3Block: BlockConfig = { type: 'short-input', placeholder: 'Enter your AWS Secret Access Key', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -474,12 +482,14 @@ export const S3Block: BlockConfig = { } }, params: (params) => { - // Validate required fields (common to all operations) - if (!params.accessKeyId) { - throw new Error('Access Key ID is required') - } - if (!params.secretAccessKey) { - throw new Error('Secret Access Key is required') + // Inline keys are required unless a saved AWS credential supplies them. + if (!hasSavedCredential(params)) { + if (!params.accessKeyId) { + throw new Error('Access Key ID is required') + } + if (!params.secretAccessKey) { + throw new Error('Secret Access Key is required') + } } // Default to get_object for backward compatibility with existing workflows @@ -704,6 +714,10 @@ export const S3Block: BlockConfig = { }, inputs: { operation: { type: 'string', description: 'Operation to perform' }, + oauthCredential: { + type: 'string', + description: 'Saved AWS credential (optional; replaces the access keys)', + }, accessKeyId: { type: 'string', description: 'AWS access key ID' }, secretAccessKey: { type: 'string', description: 'AWS secret access key' }, region: { type: 'string', description: 'AWS region' }, diff --git a/apps/sim/blocks/blocks/secrets_manager.ts b/apps/sim/blocks/blocks/secrets_manager.ts index 32d6a714525..a2dffabe6c4 100644 --- a/apps/sim/blocks/blocks/secrets_manager.ts +++ b/apps/sim/blocks/blocks/secrets_manager.ts @@ -1,10 +1,12 @@ import { SecretsManagerIcon } from '@/components/icons' import type { BlockConfig, BlockMeta } from '@/blocks/types' -import { IntegrationType } from '@/blocks/types' +import { AuthMode, IntegrationType } from '@/blocks/types' +import { AWS_CREDENTIAL_SUBBLOCKS, withoutSavedCredential } from '@/blocks/utils' export const SecretsManagerBlock: BlockConfig = { type: 'secrets_manager', name: 'AWS Secrets Manager', + authMode: AuthMode.ApiKey, description: 'Connect to AWS Secrets Manager', longDescription: 'Retrieve, create, update, list, delete, describe, tag, untag, restore, and rotate secrets.', @@ -77,12 +79,14 @@ export const SecretsManagerBlock: BlockConfig = { placeholder: 'us-east-1', required: true, }, + ...AWS_CREDENTIAL_SUBBLOCKS, { id: 'accessKeyId', title: 'AWS Access Key ID', type: 'short-input', placeholder: 'AKIA...', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -91,6 +95,7 @@ export const SecretsManagerBlock: BlockConfig = { type: 'short-input', placeholder: 'Your secret access key', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -415,6 +420,10 @@ export const SecretsManagerBlock: BlockConfig = { inputs: { operation: { type: 'string', description: 'Secrets Manager operation to perform' }, region: { type: 'string', description: 'AWS region' }, + oauthCredential: { + type: 'string', + description: 'Saved AWS credential (optional; replaces the access keys)', + }, accessKeyId: { type: 'string', description: 'AWS access key ID' }, secretAccessKey: { type: 'string', description: 'AWS secret access key' }, secretId: { type: 'string', description: 'Secret name or ARN' }, diff --git a/apps/sim/blocks/blocks/ses.ts b/apps/sim/blocks/blocks/ses.ts index 7b2ee9ad857..595016ced6e 100644 --- a/apps/sim/blocks/blocks/ses.ts +++ b/apps/sim/blocks/blocks/ses.ts @@ -1,6 +1,7 @@ import { SESIcon } from '@/components/icons' import type { BlockConfig, BlockMeta } from '@/blocks/types' import { AuthMode, IntegrationType } from '@/blocks/types' +import { AWS_CREDENTIAL_SUBBLOCKS, withoutSavedCredential } from '@/blocks/utils' export const SESBlock: BlockConfig = { type: 'ses', @@ -139,12 +140,14 @@ export const SESBlock: BlockConfig = { placeholder: 'us-east-1', required: true, }, + ...AWS_CREDENTIAL_SUBBLOCKS, { id: 'accessKeyId', title: 'AWS Access Key ID', type: 'short-input', placeholder: 'AKIA...', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -153,6 +156,7 @@ export const SESBlock: BlockConfig = { type: 'short-input', placeholder: 'Your secret access key', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -758,6 +762,10 @@ export const SESBlock: BlockConfig = { inputs: { operation: { type: 'string', description: 'SES operation to perform' }, region: { type: 'string', description: 'AWS region' }, + oauthCredential: { + type: 'string', + description: 'Saved AWS credential (optional; replaces the access keys)', + }, accessKeyId: { type: 'string', description: 'AWS access key ID' }, secretAccessKey: { type: 'string', description: 'AWS secret access key' }, fromAddress: { type: 'string', description: 'Verified sender email address' }, diff --git a/apps/sim/blocks/blocks/sqs.ts b/apps/sim/blocks/blocks/sqs.ts index 0d27671203f..88430547453 100644 --- a/apps/sim/blocks/blocks/sqs.ts +++ b/apps/sim/blocks/blocks/sqs.ts @@ -2,6 +2,7 @@ import { getErrorMessage } from '@sim/utils/errors' import { SQSIcon } from '@/components/icons' import type { BlockConfig, BlockMeta } from '@/blocks/types' import { AuthMode, IntegrationType } from '@/blocks/types' +import { AWS_CREDENTIAL_SUBBLOCKS, withoutSavedCredential } from '@/blocks/utils' export const SQSBlock: BlockConfig = { type: 'sqs', @@ -132,12 +133,14 @@ export const SQSBlock: BlockConfig = { placeholder: 'us-east-1', required: true, }, + ...AWS_CREDENTIAL_SUBBLOCKS, { id: 'accessKeyId', title: 'AWS Access Key ID', type: 'short-input', placeholder: 'AKIA...', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -146,6 +149,7 @@ export const SQSBlock: BlockConfig = { type: 'short-input', placeholder: 'Your secret access key', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -805,6 +809,10 @@ export const SQSBlock: BlockConfig = { inputs: { operation: { type: 'string', description: 'SQS operation to perform' }, region: { type: 'string', description: 'AWS region' }, + oauthCredential: { + type: 'string', + description: 'Saved AWS credential (optional; replaces the access keys)', + }, accessKeyId: { type: 'string', description: 'AWS access key ID' }, secretAccessKey: { type: 'string', description: 'AWS secret access key' }, queueUrl: { type: 'string', description: 'SQS queue URL' }, diff --git a/apps/sim/blocks/blocks/ssm.ts b/apps/sim/blocks/blocks/ssm.ts index b7c80223269..0216e76e98d 100644 --- a/apps/sim/blocks/blocks/ssm.ts +++ b/apps/sim/blocks/blocks/ssm.ts @@ -1,6 +1,7 @@ import { SSMIcon } from '@/components/icons' import type { BlockConfig, BlockMeta } from '@/blocks/types' import { AuthMode, IntegrationType } from '@/blocks/types' +import { AWS_CREDENTIAL_SUBBLOCKS, withoutSavedCredential } from '@/blocks/utils' /** Operations whose SSM API caps `MaxResults` at 50. */ const STANDARD_PAGE_OPERATIONS = [ @@ -164,12 +165,14 @@ export const SSMBlock: BlockConfig = { placeholder: 'us-east-1', required: true, }, + ...AWS_CREDENTIAL_SUBBLOCKS, { id: 'accessKeyId', title: 'AWS Access Key ID', type: 'short-input', placeholder: 'AKIA...', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -178,6 +181,7 @@ export const SSMBlock: BlockConfig = { type: 'short-input', placeholder: 'Your secret access key', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -966,6 +970,10 @@ export const SSMBlock: BlockConfig = { inputs: { operation: { type: 'string', description: 'Systems Manager operation to perform' }, region: { type: 'string', description: 'AWS region' }, + oauthCredential: { + type: 'string', + description: 'Saved AWS credential (optional; replaces the access keys)', + }, accessKeyId: { type: 'string', description: 'AWS access key ID' }, secretAccessKey: { type: 'string', description: 'AWS secret access key' }, documentName: { type: 'string', description: 'SSM document or runbook name' }, diff --git a/apps/sim/blocks/blocks/sts.ts b/apps/sim/blocks/blocks/sts.ts index bdb9b93d8a3..1f8bf30fa2b 100644 --- a/apps/sim/blocks/blocks/sts.ts +++ b/apps/sim/blocks/blocks/sts.ts @@ -1,6 +1,7 @@ import { STSIcon } from '@/components/icons' import type { BlockConfig, BlockMeta } from '@/blocks/types' import { AuthMode, IntegrationType } from '@/blocks/types' +import { AWS_CREDENTIAL_SUBBLOCKS, withoutSavedCredential } from '@/blocks/utils' export const STSBlock: BlockConfig = { type: 'sts', @@ -63,17 +64,18 @@ export const STSBlock: BlockConfig = { placeholder: 'us-east-1', required: true, }, + ...AWS_CREDENTIAL_SUBBLOCKS, { id: 'accessKeyId', title: 'AWS Access Key ID', type: 'short-input', placeholder: 'AKIA...', password: true, - condition: { + condition: withoutSavedCredential({ field: 'operation', value: ['assume_role_with_web_identity', 'assume_role_with_saml'], not: true, - }, + }), required: { field: 'operation', value: ['assume_role_with_web_identity', 'assume_role_with_saml'], @@ -86,11 +88,11 @@ export const STSBlock: BlockConfig = { type: 'short-input', placeholder: 'Your secret access key', password: true, - condition: { + condition: withoutSavedCredential({ field: 'operation', value: ['assume_role_with_web_identity', 'assume_role_with_saml'], not: true, - }, + }), required: { field: 'operation', value: ['assume_role_with_web_identity', 'assume_role_with_saml'], @@ -371,6 +373,10 @@ export const STSBlock: BlockConfig = { inputs: { operation: { type: 'string', description: 'STS operation to perform' }, region: { type: 'string', description: 'AWS region' }, + oauthCredential: { + type: 'string', + description: 'Saved AWS credential (optional; replaces the access keys)', + }, accessKeyId: { type: 'string', description: 'AWS access key ID' }, secretAccessKey: { type: 'string', description: 'AWS secret access key' }, roleArn: { type: 'string', description: 'ARN of the role to assume' }, diff --git a/apps/sim/blocks/blocks/textract.ts b/apps/sim/blocks/blocks/textract.ts index 1ab086cbe35..d137b56d34d 100644 --- a/apps/sim/blocks/blocks/textract.ts +++ b/apps/sim/blocks/blocks/textract.ts @@ -6,7 +6,12 @@ import { IntegrationType, type SubBlockType, } from '@/blocks/types' -import { normalizeFileInput } from '@/blocks/utils' +import { + AWS_CREDENTIAL_SUBBLOCKS, + hasSavedCredential, + normalizeFileInput, + withoutSavedCredential, +} from '@/blocks/utils' const LEGACY_DOCUMENT_FIELD = ['fileUpload', 'filePath', 's3Uri'] as const const DOCUMENT_FIELD = ['fileUpload', 'fileReference', 's3Uri'] as const @@ -95,12 +100,14 @@ export const TextractBlock: BlockConfig = { placeholder: 'e.g., us-east-1', required: true, }, + ...AWS_CREDENTIAL_SUBBLOCKS, { id: 'accessKeyId', title: 'AWS Access Key ID', type: 'short-input' as SubBlockType, placeholder: 'Enter your AWS Access Key ID', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -109,6 +116,7 @@ export const TextractBlock: BlockConfig = { type: 'short-input' as SubBlockType, placeholder: 'Enter your AWS Secret Access Key', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -137,11 +145,13 @@ export const TextractBlock: BlockConfig = { config: { tool: () => 'textract_parser', params: (params) => { - if (!params.accessKeyId || params.accessKeyId.trim() === '') { - throw new Error('AWS Access Key ID is required') - } - if (!params.secretAccessKey || params.secretAccessKey.trim() === '') { - throw new Error('AWS Secret Access Key is required') + if (!hasSavedCredential(params)) { + if (!params.accessKeyId || params.accessKeyId.trim() === '') { + throw new Error('AWS Access Key ID is required') + } + if (!params.secretAccessKey || params.secretAccessKey.trim() === '') { + throw new Error('AWS Secret Access Key is required') + } } if (!params.region || params.region.trim() === '') { throw new Error('AWS Region is required') @@ -196,6 +206,10 @@ export const TextractBlock: BlockConfig = { detectSignatures: { type: 'boolean', description: 'Detect signatures' }, analyzeLayout: { type: 'boolean', description: 'Analyze document layout' }, region: { type: 'string', description: 'AWS region' }, + oauthCredential: { + type: 'string', + description: 'Saved AWS credential (optional; replaces the access keys)', + }, accessKeyId: { type: 'string', description: 'AWS Access Key ID' }, secretAccessKey: { type: 'string', description: 'AWS Secret Access Key' }, }, @@ -245,8 +259,11 @@ function requireAwsCredentials(params: Record) { typeof params.secretAccessKey === 'string' ? params.secretAccessKey.trim() : '' const region = typeof params.region === 'string' ? params.region.trim() : '' - if (!accessKeyId) throw new Error('AWS Access Key ID is required') - if (!secretAccessKey) throw new Error('AWS Secret Access Key is required') + // A saved AWS credential supplies the keys server-side instead. + if (!hasSavedCredential(params)) { + if (!accessKeyId) throw new Error('AWS Access Key ID is required') + if (!secretAccessKey) throw new Error('AWS Secret Access Key is required') + } if (!region) throw new Error('AWS Region is required') return { accessKeyId, secretAccessKey, region } @@ -368,12 +385,14 @@ export const TextractV2Block: BlockConfig = { placeholder: 'e.g., us-east-1', required: true, }, + ...AWS_CREDENTIAL_SUBBLOCKS, { id: 'accessKeyId', title: 'AWS Access Key ID', type: 'short-input' as SubBlockType, placeholder: 'Enter your AWS Access Key ID', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -382,6 +401,7 @@ export const TextractV2Block: BlockConfig = { type: 'short-input' as SubBlockType, placeholder: 'Enter your AWS Secret Access Key', password: true, + condition: withoutSavedCredential(), required: true, }, { @@ -491,6 +511,10 @@ export const TextractV2Block: BlockConfig = { detectSignatures: { type: 'boolean', description: 'Detect signatures' }, analyzeLayout: { type: 'boolean', description: 'Analyze document layout' }, region: { type: 'string', description: 'AWS region' }, + oauthCredential: { + type: 'string', + description: 'Saved AWS credential (optional; replaces the access keys)', + }, accessKeyId: { type: 'string', description: 'AWS Access Key ID' }, secretAccessKey: { type: 'string', description: 'AWS Secret Access Key' }, }, diff --git a/apps/sim/blocks/utils.ts b/apps/sim/blocks/utils.ts index 37110375bab..53bb261d85d 100644 --- a/apps/sim/blocks/utils.ts +++ b/apps/sim/blocks/utils.ts @@ -49,6 +49,84 @@ export const SERVICE_ACCOUNT_SUBBLOCKS: SubBlockConfig[] = [ }, ] +/** + * Value keys a saved credential can sit under: the picker by subblock id + * (editor, raw values) and its canonical param (serializer and agent + * tool-input, after canonicalization). The picker is deliberately the group's + * only member — an advanced ID input would make "is a credential selected" + * depend on the canonical mode, which these conditions cannot see, so a stale + * value in the inactive member could hide the inline fields while the run used + * neither. + */ +const SAVED_CREDENTIAL_VALUE_KEYS = ['credential', 'oauthCredential'] as const + +/** Whether a block's values select a saved credential. */ +export function hasSavedCredential(values?: Record): boolean { + return SAVED_CREDENTIAL_VALUE_KEYS.some((key) => { + const value = values?.[key] + return typeof value === 'string' && value.trim().length > 0 + }) +} + +type SubBlockConditionShape = Extract, { field: string }> + +/** + * Condition for an inline secret field on a block that also accepts a saved + * credential: shown, and so validated, only while no saved credential is + * selected. A block that has never had a credential — every block saved before + * the credential option existed — always shows its inline fields exactly as + * before. `base` keeps a field's existing gate. + */ +export function withoutSavedCredential(base?: SubBlockConditionShape) { + return (values?: Record): SubBlockConditionShape => { + if (hasSavedCredential(values)) { + return { field: 'credential', value: '__saved_credential_selected__' } + } + if (base) return base + // The catalog evaluates this with no values; publish "required while no credential is selected". + if (!values) return { field: 'credential', value: '' } + // Matches itself whatever the empty value is (absent, null, or blank). + return { field: 'credential', value: values.credential as string } + } +} + +/** + * The optional saved-credential picker for a block whose inline secret fields + * stay available. Leaving it empty keeps the inline fields, so existing blocks + * run unchanged. + */ +function savedCredentialSubBlocks(input: { + serviceId: string + title: string + inlineFallback: string +}): SubBlockConfig[] { + return [ + { + id: 'credential', + title: input.title, + type: 'oauth-input', + serviceId: input.serviceId, + credentialKind: 'service-account', + canonicalParamId: 'oauthCredential', + placeholder: `Select a saved ${input.title.toLowerCase()}, or ${input.inlineFallback}`, + }, + ] +} + +/** Optional saved AWS credential for every AWS block. */ +export const AWS_CREDENTIAL_SUBBLOCKS = savedCredentialSubBlocks({ + serviceId: 'aws', + title: 'AWS Credential', + inlineFallback: 'enter access keys below', +}) + +/** Optional saved Databricks connection for the Databricks block. */ +export const DATABRICKS_CREDENTIAL_SUBBLOCKS = savedCredentialSubBlocks({ + serviceId: 'databricks', + title: 'Databricks Connection', + inlineFallback: 'enter a host and token below', +}) + /** * Returns model options for combobox subblocks, combining all provider sources. */ diff --git a/apps/sim/hooks/queries/scoped-credentials.ts b/apps/sim/hooks/queries/scoped-credentials.ts index fc37fdd3794..594678af21a 100644 --- a/apps/sim/hooks/queries/scoped-credentials.ts +++ b/apps/sim/hooks/queries/scoped-credentials.ts @@ -5,6 +5,7 @@ import { requestJson } from '@/lib/api/client/request' import type { ContractBodyInput } from '@/lib/api/contracts' import { createWorkspaceCredentialContract, + prepareWorkloadIdentityContract, updateWorkspaceCredentialContract, type WorkspaceCredential, type WorkspaceCredentialType, @@ -18,6 +19,7 @@ import { updateOrganizationCredentialContract, } from '@/lib/api/contracts/organization-credentials' import { type ResourceOwner, resourceScopeFromOwner } from '@/lib/core/resource-scope' +import type { WorkloadIdentityProvider } from '@/lib/credentials/workload-identity/audiences' import { oauthCredentialKeys } from '@/hooks/queries/oauth/credentials' import { organizationCredentialKeys, @@ -114,3 +116,34 @@ export function useUpdateScopedCredential() { onSuccess: reconcile, }) } + +/** + * The trust setup for a new keyless AWS role or Databricks service principal: + * the issuer to register and the signed subject it must trust. Each fetch + * mints a new subject, so the key carries the modal session and the result + * never goes stale or refetches while the person is copying it. + */ +export function useWorkloadIdentitySetup(input: { + workspaceId?: string + provider: WorkloadIdentityProvider + sessionKey: string + enabled: boolean +}) { + return useQuery({ + queryKey: workspaceCredentialKeys.workloadIdentity( + input.workspaceId, + input.provider, + input.sessionKey + ), + queryFn: async ({ signal }) => + requestJson(prepareWorkloadIdentityContract, { + body: { workspaceId: input.workspaceId ?? '', provider: input.provider }, + signal, + }), + enabled: input.enabled && Boolean(input.workspaceId), + staleTime: Number.POSITIVE_INFINITY, + gcTime: 0, + retry: false, + refetchOnWindowFocus: false, + }) +} diff --git a/apps/sim/hooks/queries/utils/credential-keys.ts b/apps/sim/hooks/queries/utils/credential-keys.ts index 1be218be3a7..a4bec7bd17a 100644 --- a/apps/sim/hooks/queries/utils/credential-keys.ts +++ b/apps/sim/hooks/queries/utils/credential-keys.ts @@ -23,6 +23,15 @@ export const workspaceCredentialKeys = { workspaceId ? ([...workspaceCredentialKeys.detail(credentialId), 'workspace', workspaceId] as const) : workspaceCredentialKeys.detail(credentialId), + /** One keyless cloud setup per connect-modal session (each fetch mints a new subject). */ + workloadIdentity: (workspaceId: string | undefined, provider: string, sessionKey: string) => + [ + ...workspaceCredentialKeys.all, + 'workloadIdentity', + workspaceId ?? 'none', + provider, + sessionKey, + ] as const, members: (credentialId?: string) => [...workspaceCredentialKeys.detail(credentialId), 'members'] as const, /** diff --git a/apps/sim/lib/api/contracts/credentials.ts b/apps/sim/lib/api/contracts/credentials.ts index 611008a5d41..7dd2e0eaa26 100644 --- a/apps/sim/lib/api/contracts/credentials.ts +++ b/apps/sim/lib/api/contracts/credentials.ts @@ -5,6 +5,7 @@ import { ATLASSIAN_PRODUCTS, getServiceAccountRequiredFields, } from '@/lib/credentials/service-account-fields' +import { WORKLOAD_IDENTITY_PROVIDERS } from '@/lib/credentials/workload-identity/audiences' import type { OAuthProvider } from '@/lib/oauth/types' export const atlassianProductSchema = z.enum(ATLASSIAN_PRODUCTS) @@ -556,6 +557,29 @@ export const createWorkspaceCredentialContract = defineRouteContract({ }, }) +export const prepareWorkloadIdentityContract = defineRouteContract({ + method: 'POST', + path: '/api/credentials/workload-identity', + body: z.object({ + workspaceId: workspaceIdSchema, + provider: z.enum(WORKLOAD_IDENTITY_PROVIDERS), + }), + response: { + mode: 'json', + schema: z.object({ + /** Register this URL as the OpenID Connect issuer the cloud trusts. */ + issuer: z.string(), + /** The `aud` the cloud must accept (AWS client ID, Databricks policy audience). */ + audience: z.string(), + /** The exact `sub` the role's trust policy must allow. */ + subject: z.string(), + /** Opaque proof submitted with the credential; binds the subject to its creator. */ + subjectProof: z.string(), + expiresAt: z.string(), + }), + }, +}) + export const updateWorkspaceCredentialContract = defineRouteContract({ method: 'PUT', path: '/api/credentials/[id]', diff --git a/apps/sim/lib/core/config/env.ts b/apps/sim/lib/core/config/env.ts index da8c2d61915..01b51480d1a 100644 --- a/apps/sim/lib/core/config/env.ts +++ b/apps/sim/lib/core/config/env.ts @@ -148,6 +148,9 @@ export const env = createEnv({ ENCRYPT_ACCOUNT_TOKENS: z.boolean().optional(), // Opt-out: OAuth access/refresh tokens are sealed on write (read by @sim/db) and backfilled by migrate whenever ENCRYPTION_KEY is 64 hex characters; false or 0 writes plaintext. Sealed tokens need v0.9.33+ on every process that reads them INTERNAL_API_SECRET: z.string().min(32), // Secret for internal API authentication INTERNAL_JWT_SECRET: z.string().min(32).optional(), // Dedicated signing key for internal JWTs (falls back to INTERNAL_API_SECRET); separating limits blast radius if one leaks + WORKLOAD_IDENTITY_SIGNING_KEY: z.string().min(1).optional(), // PKCS#8 PEM RSA private key that signs Sim workload-identity (OIDC) tokens for keyless AWS/cloud credentials; unset disables the OIDC credential mode + WORKLOAD_IDENTITY_PREVIOUS_KEY: z.string().min(1).optional(), // Retiring workload-identity key (private or public PEM), still published in the JWKS during rotation so tokens it signed keep verifying + WORKLOAD_IDENTITY_ISSUER: z.string().url().optional(), // Workload-identity issuer URL (default /oidc/workload). Customer trust policies pin it, so it must never change once in use // Copilot COPILOT_API_KEY: z.string().min(1).optional(), // Secret for internal sim agent API authentication diff --git a/apps/sim/lib/credentials/application/crud.test.ts b/apps/sim/lib/credentials/application/crud.test.ts index 87c15d24087..94a40382a8a 100644 --- a/apps/sim/lib/credentials/application/crud.test.ts +++ b/apps/sim/lib/credentials/application/crud.test.ts @@ -1,3 +1,4 @@ +import { requirePrincipalSubjectUserId } from '@sim/auth/principal' import { createPersonalApiKeyPrincipal, createSessionPrincipal, @@ -154,6 +155,7 @@ describe('updateWorkspaceCredentialUseCase', () => { credentialId: credential.id, displayName: 'Zoom prod', credential, + actorUserId: requirePrincipalSubjectUserId(apiKeyPrincipal), }) expect(mocks.updateRecord.mock.calls[0][0]).not.toHaveProperty('assertedWorkspaceId') }) diff --git a/apps/sim/lib/credentials/application/crud.ts b/apps/sim/lib/credentials/application/crud.ts index 949aa81b2a5..c171fd39910 100644 --- a/apps/sim/lib/credentials/application/crud.ts +++ b/apps/sim/lib/credentials/application/crud.ts @@ -343,7 +343,11 @@ export const updateWorkspaceCredentialUseCase = defineAuthorizedCredentialUseCas const result = context.credential.type === 'personal_token' ? await updatePersonalTokenCredential({ ...fields, credential: context.credential }) - : await updateCredentialRecord({ ...fields, credential: context.credential }) + : await updateCredentialRecord({ + ...fields, + credential: context.credential, + actorUserId: requirePrincipalSubjectUserId(principal), + }) if (!result.success) throwCredentialMutationFailure(result) const access = await getCredentialActorContext( context.credential.id, diff --git a/apps/sim/lib/credentials/application/operations.ts b/apps/sim/lib/credentials/application/operations.ts index b1bb906658b..f04697cb65b 100644 --- a/apps/sim/lib/credentials/application/operations.ts +++ b/apps/sim/lib/credentials/application/operations.ts @@ -143,6 +143,14 @@ export const credentialOperations = { principalKinds: ['delegated'], delegatedServices: ['copilot'], }), + /** Issues a signed OIDC subject for a new keyless AWS or Databricks credential (connect modal only). */ + prepareWorkloadIdentity: defineWorkspaceOperation({ + id: 'credentials.workload_identity.prepare', + minimumRole: 'write', + workspaceApiKey: 'deny', + capability: 'integrations.manage', + principalKinds: ['session'], + }), createServiceAccount: defineWorkspaceOperation({ id: 'credentials.service_accounts.create', oauthScope: 'api:write', diff --git a/apps/sim/lib/credentials/application/organization-credentials.ts b/apps/sim/lib/credentials/application/organization-credentials.ts index b6e32aa51e8..5fe2bb1282a 100644 --- a/apps/sim/lib/credentials/application/organization-credentials.ts +++ b/apps/sim/lib/credentials/application/organization-credentials.ts @@ -441,7 +441,7 @@ export const updateOrganizationCredential: OperationUseCase< ) } const result = await withResourceOutboundScope(row, () => - updateCredentialRecord({ ...input, credential: row }) + updateCredentialRecord({ ...input, credential: row, actorUserId: context.userId }) ) if (!result.success) throwCredentialMutationFailure(result) const updated = await getOrganizationCredential(input.organizationId, input.credentialId) diff --git a/apps/sim/lib/credentials/application/prepare-workload-identity.ts b/apps/sim/lib/credentials/application/prepare-workload-identity.ts new file mode 100644 index 00000000000..73fcd04d58b --- /dev/null +++ b/apps/sim/lib/credentials/application/prepare-workload-identity.ts @@ -0,0 +1,62 @@ +import { requirePrincipalSubjectUserId } from '@sim/auth/principal' +import { defineAuthorizedWorkspaceUseCase } from '@/lib/core/application' +import { OrchestrationError } from '@/lib/core/orchestration/types' +import { credentialDelegationPolicy } from '@/lib/credentials/application/authorization' +import { credentialOperations } from '@/lib/credentials/application/operations' +import { + WORKLOAD_IDENTITY_AUDIENCES, + type WorkloadIdentityProvider, +} from '@/lib/credentials/workload-identity/audiences' +import { + getWorkloadIdentityIssuer, + isWorkloadIdentityConfigured, +} from '@/lib/credentials/workload-identity/issuer' +import { issueWorkloadIdentitySubject } from '@/lib/credentials/workload-identity/subject' +import { loadActiveWorkspaceApplicationContext } from '@/lib/workspaces/application/context' + +export interface PrepareWorkloadIdentityInput { + workspaceId: string + provider: WorkloadIdentityProvider +} + +export interface PrepareWorkloadIdentityResult { + issuer: string + audience: string + subject: string + subjectProof: string + expiresAt: string +} + +/** + * Starts a keyless cloud connection (an AWS role or a Databricks service + * principal): the subject the customer's trust configuration will pin, signed + * for this person and workspace so only they can attach it to the credential + * they are about to create. + */ +export const prepareWorkloadIdentity = defineAuthorizedWorkspaceUseCase({ + operation: credentialOperations.prepareWorkloadIdentity, + resolveContext: async ({ input }: { input: PrepareWorkloadIdentityInput }) => { + const context = await loadActiveWorkspaceApplicationContext(input.workspaceId) + if (!context) throw new OrchestrationError('not_found', 'Workspace not found') + return context + }, + authorizationOptions: { delegation: credentialDelegationPolicy }, + execute: async ({ principal, input }): Promise => { + if (!isWorkloadIdentityConfigured()) { + throw new OrchestrationError( + 'conflict', + 'Keyless connections are not available on this deployment. Use a key or secret instead.' + ) + } + const grant = issueWorkloadIdentitySubject( + input.provider, + { workspaceId: input.workspaceId }, + requirePrincipalSubjectUserId(principal) + ) + return { + issuer: getWorkloadIdentityIssuer(), + audience: WORKLOAD_IDENTITY_AUDIENCES[input.provider], + ...grant, + } + }, +}) diff --git a/apps/sim/lib/credentials/application/provider-catalog.ts b/apps/sim/lib/credentials/application/provider-catalog.ts index 9fdb84ab4d9..5ae98321d89 100644 --- a/apps/sim/lib/credentials/application/provider-catalog.ts +++ b/apps/sim/lib/credentials/application/provider-catalog.ts @@ -18,6 +18,8 @@ import { import { GITHUB_INSTALLATION_PROVIDER_ID } from '@/lib/oauth/github-installation-types' import { ATLASSIAN_SERVICE_ACCOUNT_PROVIDER_ID, + AWS_SERVICE_ACCOUNT_PROVIDER_ID, + DATABRICKS_SERVICE_ACCOUNT_PROVIDER_ID, GOOGLE_SERVICE_ACCOUNT_PROVIDER_ID, type OAuthServiceMetadata, OCI_API_KEY_SERVICE_ACCOUNT_PROVIDER_ID, @@ -128,6 +130,45 @@ function getServiceAccountDescriptor(providerId: string): ServiceAccountDescript fields: [], } } + if (providerId === DATABRICKS_SERVICE_ACCOUNT_PROVIDER_ID) { + return { + name: 'Databricks connection', + description: + 'Use the Databricks block with a personal access token, a service principal OAuth secret, or a keyless service principal that trusts Sim through OpenID Connect.', + docsUrl: 'https://docs.sim.ai/integrations/databricks-credentials', + fields: [ + { + id: 'serviceAccountJson', + label: 'Connection configuration', + placeholder: + '{"authType":"personal_access_token","host":"dbc-abc123.cloud.databricks.com","token":"dapi..."}', + required: true, + secret: true, + multiline: true, + hint: 'JSON object with host and authType: "personal_access_token" (token) or "service_principal" (clientId, clientSecret). Keyless "oidc_federation" connections are created from the Databricks connect dialog, which issues the trusted subject.', + }, + ], + } + } + if (providerId === AWS_SERVICE_ACCOUNT_PROVIDER_ID) { + return { + name: 'AWS credential', + description: + 'Use AWS blocks with saved access keys, access keys that assume an IAM role, or a keyless IAM role that trusts Sim through OpenID Connect.', + docsUrl: 'https://docs.sim.ai/integrations/aws-credentials', + fields: [ + { + id: 'serviceAccountJson', + label: 'Credential configuration', + placeholder: '{"authType":"access_keys","accessKeyId":"AKIA...","secretAccessKey":"..."}', + required: true, + secret: true, + multiline: true, + hint: 'JSON object with authType: "access_keys" (accessKeyId, secretAccessKey) or "assume_role" (accessKeyId, secretAccessKey, roleArn, optional externalId). Keyless "oidc_role" credentials are created from the AWS connect dialog, which issues the trusted subject.', + }, + ], + } + } if (providerId === ORACLE_DATABASE_SERVICE_ACCOUNT_PROVIDER_ID) { return { name: 'Oracle Database connection', diff --git a/apps/sim/lib/credentials/aws-service-account.server.ts b/apps/sim/lib/credentials/aws-service-account.server.ts new file mode 100644 index 00000000000..d3b4b017c71 --- /dev/null +++ b/apps/sim/lib/credentials/aws-service-account.server.ts @@ -0,0 +1,370 @@ +import { + AssumeRoleCommand, + AssumeRoleWithWebIdentityCommand, + type Credentials, + GetCallerIdentityCommand, + STSClient, +} from '@aws-sdk/client-sts' +import { db } from '@sim/db' +import { credential } from '@sim/db/schema' +import { getErrorMessage } from '@sim/utils/errors' +import { and, eq, isNull, or } from 'drizzle-orm' +import { z } from 'zod' +import { decryptSecret, encryptSecret } from '@/lib/core/security/encryption' +import { WORKLOAD_IDENTITY_AUDIENCES } from '@/lib/credentials/workload-identity/audiences' +import { + mintWorkloadIdentityToken, + type WorkloadIdentityOwner, +} from '@/lib/credentials/workload-identity/issuer' +import { + verifyWorkloadIdentitySubject, + type WorkloadIdentityCredentialOwner, + WorkloadIdentitySubjectError, +} from '@/lib/credentials/workload-identity/subject' +import { AWS_SERVICE_ACCOUNT_PROVIDER_ID } from '@/lib/oauth/types' + +/** + * Saved AWS identities for every AWS block. + * + * Three modes, all resolved server-side at execution. Keys and session tokens + * stay out of block outputs, logs, and model input — except where AWS itself + * requires them in a value the block returns: an S3 presigned download URL made + * with temporary credentials carries the temporary access key ID and its + * session token (never the secret), and expires with the session. + * - `access_keys`: a long-lived IAM user key pair, used as-is (today's inline behavior). + * - `assume_role`: a key pair that assumes a role, optionally with an external ID. + * - `oidc_role`: no stored key at all — Sim signs a short-lived OIDC token for + * this credential's subject and exchanges it with STS for the customer's role. + */ + +const AWS_WORKLOAD_IDENTITY_AUDIENCE = WORKLOAD_IDENTITY_AUDIENCES.aws +const AWS_CREDENTIAL_SECRET_TYPE = 'aws_credential_v1' as const + +const ROLE_ARN_PATTERN = + /^arn:aws(?:-cn|-us-gov|-iso[a-z-]*)?:iam::\d{12}:role\/[\w+=,.@/-]{1,512}$/ +const REGION_PATTERN = /^[a-z]{2}(?:-[a-z]+)+-\d{1,2}$/ +const ACCESS_KEY_ID_PATTERN = /^[A-Z0-9]{16,128}$/ +const EXTERNAL_ID_PATTERN = /^[\w+=,.@:/-]{2,1224}$/ +const VERIFY_TIMEOUT_MS = 20_000 + +const keyPairShape = { + accessKeyId: z.string().trim().regex(ACCESS_KEY_ID_PATTERN, 'Invalid AWS access key ID'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required').max(256), +} + +const commonShape = { + stsRegion: z.string().trim().regex(REGION_PATTERN, 'Invalid AWS region').optional(), + sessionDurationSeconds: z.number().int().min(900).max(43_200).optional(), +} + +const roleArnSchema = z.string().trim().regex(ROLE_ARN_PATTERN, 'Invalid IAM role ARN') + +const accessKeysSchema = z + .object({ authType: z.literal('access_keys'), ...keyPairShape, ...commonShape }) + .strict() + +const assumeRoleSchema = z + .object({ + authType: z.literal('assume_role'), + ...keyPairShape, + roleArn: roleArnSchema, + externalId: z.string().regex(EXTERNAL_ID_PATTERN, 'Invalid external ID').optional(), + ...commonShape, + }) + .strict() + +const oidcRoleShape = { + authType: z.literal('oidc_role'), + roleArn: roleArnSchema, + subject: z.string().min(1).max(512), + ...commonShape, +} + +const storedConfigSchema = z.discriminatedUnion('authType', [ + accessKeysSchema, + assumeRoleSchema, + z.object(oidcRoleShape).strict(), +]) + +export type AwsCredentialConfig = z.infer + +/** What the connect modal submits: the stored shape plus a one-time subject proof for OIDC roles. */ +const submittedConfigSchema = z.discriminatedUnion('authType', [ + accessKeysSchema, + assumeRoleSchema, + z.object({ ...oidcRoleShape, subjectProof: z.string().min(1).max(512).optional() }).strict(), +]) + +const storedSecretSchema = z + .object({ type: z.literal(AWS_CREDENTIAL_SECRET_TYPE), config: storedConfigSchema }) + .strict() + +export class AwsCredentialError extends Error { + constructor(message: string) { + super(message) + this.name = 'AwsCredentialError' + } +} + +export interface AwsSessionCredentials { + accessKeyId: string + secretAccessKey: string + sessionToken?: string +} + +/** STS lives in every partition; a role's partition decides the default endpoint. */ +function defaultStsRegion(roleArn?: string): string { + if (roleArn?.startsWith('arn:aws-cn:')) return 'cn-north-1' + if (roleArn?.startsWith('arn:aws-us-gov:')) return 'us-gov-west-1' + return 'us-east-1' +} + +function stsRegionFor(config: AwsCredentialConfig): string { + return config.stsRegion ?? defaultStsRegion('roleArn' in config ? config.roleArn : undefined) +} + +/** RoleSessionName allows `[\w+=,.@-]{2,64}` and shows up in the customer's CloudTrail. */ +export function buildAwsRoleSessionName(label: string | undefined): string { + const cleaned = (label ?? '').replace(/[^\w+=,.@-]/g, '-').slice(0, 56) + return `sim-${cleaned || 'credential'}` +} + +function toSessionCredentials(credentials: Credentials | undefined): AwsSessionCredentials { + if (!credentials?.AccessKeyId || !credentials.SecretAccessKey || !credentials.SessionToken) { + throw new AwsCredentialError('AWS STS returned no credentials') + } + return { + accessKeyId: credentials.AccessKeyId, + secretAccessKey: credentials.SecretAccessKey, + sessionToken: credentials.SessionToken, + } +} + +/** + * Exchanges a saved AWS identity for credentials an SDK client can sign with. + * `access_keys` return the stored pair unchanged (no session token), so a + * credential behaves exactly like the inline keys it replaces. + */ +export async function resolveAwsSessionCredentials( + config: AwsCredentialConfig, + owner: WorkloadIdentityOwner, + options: { roleSessionName: string; signal?: AbortSignal } +): Promise { + if (config.authType === 'access_keys') { + return { accessKeyId: config.accessKeyId, secretAccessKey: config.secretAccessKey } + } + const region = stsRegionFor(config) + const durationSeconds = config.sessionDurationSeconds ?? 3600 + if (config.authType === 'assume_role') { + const client = new STSClient({ + region, + credentials: { accessKeyId: config.accessKeyId, secretAccessKey: config.secretAccessKey }, + }) + const response = await client.send( + new AssumeRoleCommand({ + RoleArn: config.roleArn, + RoleSessionName: options.roleSessionName, + DurationSeconds: durationSeconds, + ...(config.externalId ? { ExternalId: config.externalId } : {}), + }), + { abortSignal: options.signal } + ) + return toSessionCredentials(response.Credentials) + } + const webIdentityToken = await mintWorkloadIdentityToken({ + subject: config.subject, + audience: AWS_WORKLOAD_IDENTITY_AUDIENCE, + owner, + }) + /** + * AWS does not check the request signature for AssumeRoleWithWebIdentity; + * placeholder credentials keep the SDK off the ambient provider chain so the + * request never signs with Sim's own task role. + */ + const client = new STSClient({ + region, + credentials: { accessKeyId: 'anonymous', secretAccessKey: 'anonymous' }, + }) + const response = await client.send( + new AssumeRoleWithWebIdentityCommand({ + RoleArn: config.roleArn, + RoleSessionName: options.roleSessionName, + WebIdentityToken: webIdentityToken, + DurationSeconds: durationSeconds, + }), + { abortSignal: options.signal } + ) + return toSessionCredentials(response.Credentials) +} + +function parseSubmittedConfig(serialized: string) { + if (Buffer.byteLength(serialized, 'utf8') > 64 * 1024) { + throw new AwsCredentialError('AWS credential configuration is too large') + } + let raw: unknown + try { + raw = JSON.parse(serialized) + } catch { + throw new AwsCredentialError('Invalid AWS credential configuration') + } + const parsed = submittedConfigSchema.safeParse(raw) + if (!parsed.success) { + throw new AwsCredentialError(parsed.error.issues[0]?.message ?? 'Invalid AWS credential') + } + return parsed.data +} + +function readStoredSubject(storedSecret: Record | null | undefined) { + const parsed = storedSecretSchema.safeParse(storedSecret) + return parsed.success && parsed.data.config.authType === 'oidc_role' + ? parsed.data.config.subject + : undefined +} + +/** + * Binds an OIDC subject to the credential. A reconnect may keep the subject it + * already has; any other subject needs a fresh, unexpired proof Sim issued to + * this person for this owner. + */ +function bindOidcSubject( + subject: string, + subjectProof: string | undefined, + owner: WorkloadIdentityCredentialOwner +): string { + if (subject === readStoredSubject(owner.storedSecret)) return subject + if (!subjectProof) { + throw new AwsCredentialError('Start a new AWS role connection to get a trust setup') + } + try { + verifyWorkloadIdentitySubject('aws', owner, owner.actorUserId, subject, subjectProof) + } catch (error) { + if (error instanceof WorkloadIdentitySubjectError) throw new AwsCredentialError(error.message) + throw error + } + return subject +} + +function verificationFailure(config: AwsCredentialConfig, error: unknown): AwsCredentialError { + const detail = getErrorMessage(error, 'Unknown error') + if (config.authType === 'oidc_role') { + return new AwsCredentialError( + `Sim could not assume this role: ${detail}. Check that the role trusts the Sim OIDC provider with this exact subject and audience ${AWS_WORKLOAD_IDENTITY_AUDIENCE}.` + ) + } + if (config.authType === 'assume_role') { + return new AwsCredentialError( + `Sim could not assume this role with the access keys: ${detail}. Check the role ARN, its trust policy, and the external ID.` + ) + } + return new AwsCredentialError(`AWS rejected these access keys: ${detail}`) +} + +/** + * Validates the submitted configuration, proves it works by resolving it and + * calling `sts:GetCallerIdentity`, and returns the encrypted blob plus the + * caller ARN AWS reports. + */ +export async function verifyAndEncryptAwsCredential( + serialized: string, + owner: WorkloadIdentityCredentialOwner +): Promise<{ encryptedServiceAccountKey: string; callerArn: string }> { + const submitted = parseSubmittedConfig(serialized) + let config: AwsCredentialConfig + if (submitted.authType === 'oidc_role') { + const { subjectProof, ...rest } = submitted + config = { ...rest, subject: bindOidcSubject(rest.subject, subjectProof, owner) } + } else { + config = submitted + } + + let callerArn: string + try { + const signal = AbortSignal.timeout(VERIFY_TIMEOUT_MS) + const session = await resolveAwsSessionCredentials(config, owner, { + roleSessionName: buildAwsRoleSessionName('verify'), + signal, + }) + const identity = await new STSClient({ + region: stsRegionFor(config), + credentials: session, + }).send(new GetCallerIdentityCommand({}), { abortSignal: signal }) + if (!identity.Arn) throw new Error('AWS returned no caller identity') + callerArn = identity.Arn + } catch (error) { + throw verificationFailure(config, error) + } + + const { encrypted } = await encryptSecret( + JSON.stringify({ type: AWS_CREDENTIAL_SECRET_TYPE, config }) + ) + return { encryptedServiceAccountKey: encrypted, callerArn } +} + +/** + * Loads an executor-authorized AWS credential bound to its trusted owner + * scope. The executor has already authorized the acting user's use of the + * credential; this re-checks that the row belongs to the run's own workspace + * or organization and is a live AWS credential before decrypting it. + */ +export async function getAwsCredentialConfig( + credentialId: string, + scope: WorkloadIdentityOwner +): Promise<{ config: AwsCredentialConfig; owner: WorkloadIdentityOwner }> { + const unavailable = () => new AwsCredentialError('AWS credential is unavailable') + if (!credentialId || (!scope.workspaceId && !scope.organizationId)) throw unavailable() + const [row] = await db + .select({ + workspaceId: credential.workspaceId, + organizationId: credential.organizationId, + type: credential.type, + providerId: credential.providerId, + revokedAt: credential.revokedAt, + encryptedServiceAccountKey: credential.encryptedServiceAccountKey, + }) + .from(credential) + .where( + and( + eq(credential.id, credentialId), + or( + scope.workspaceId + ? and(eq(credential.workspaceId, scope.workspaceId), isNull(credential.organizationId)) + : undefined, + scope.organizationId + ? and( + eq(credential.organizationId, scope.organizationId), + isNull(credential.workspaceId) + ) + : undefined + ) + ) + ) + .limit(1) + const ownerMatches = + row && + ((row.workspaceId === scope.workspaceId && + !!scope.workspaceId && + row.organizationId === null) || + (row.organizationId === scope.organizationId && + !!scope.organizationId && + row.workspaceId === null)) + if ( + !ownerMatches || + row.type !== 'service_account' || + row.providerId !== AWS_SERVICE_ACCOUNT_PROVIDER_ID || + row.revokedAt !== null || + !row.encryptedServiceAccountKey + ) + throw unavailable() + try { + const { decrypted } = await decryptSecret(row.encryptedServiceAccountKey) + const { config } = storedSecretSchema.parse(JSON.parse(decrypted)) + return { + config, + owner: row.workspaceId + ? { workspaceId: row.workspaceId } + : { organizationId: row.organizationId ?? undefined }, + } + } catch { + throw unavailable() + } +} diff --git a/apps/sim/lib/credentials/databricks-service-account.server.ts b/apps/sim/lib/credentials/databricks-service-account.server.ts new file mode 100644 index 00000000000..262f9422cc6 --- /dev/null +++ b/apps/sim/lib/credentials/databricks-service-account.server.ts @@ -0,0 +1,296 @@ +import { db } from '@sim/db' +import { credential } from '@sim/db/schema' +import { getErrorMessage } from '@sim/utils/errors' +import { eq } from 'drizzle-orm' +import { z } from 'zod' +import { decryptSecret, encryptSecret } from '@/lib/core/security/encryption' +import { validateDatabricksWorkspaceHost } from '@/lib/core/security/input-validation' +import { WORKLOAD_IDENTITY_AUDIENCES } from '@/lib/credentials/workload-identity/audiences' +import { + mintWorkloadIdentityToken, + type WorkloadIdentityOwner, +} from '@/lib/credentials/workload-identity/issuer' +import { + verifyWorkloadIdentitySubject, + type WorkloadIdentityCredentialOwner, + WorkloadIdentitySubjectError, +} from '@/lib/credentials/workload-identity/subject' +import { DATABRICKS_SERVICE_ACCOUNT_PROVIDER_ID } from '@/lib/oauth/types' + +/** + * Saved Databricks connections for the Databricks block. + * + * - `personal_access_token`: a PAT used as-is (today's inline behavior). + * - `service_principal`: OAuth machine-to-machine — the service principal's + * client ID and secret mint a workspace token per run. + * - `oidc_federation`: no stored secret — Sim signs a short-lived OIDC token + * for this credential's subject and exchanges it (RFC 8693) for a token of + * the service principal whose federation policy trusts it. + * + * Every mode resolves server-side to a bearer token plus the workspace host, + * which reach the tools as `accessToken` and `domain`. + */ + +const DATABRICKS_CREDENTIAL_SECRET_TYPE = 'databricks_credential_v1' as const +const DATABRICKS_WORKLOAD_IDENTITY_AUDIENCE = WORKLOAD_IDENTITY_AUDIENCES.databricks + +const REQUEST_TIMEOUT_MS = 15_000 +const CLIENT_ID_PATTERN = /^[A-Za-z0-9-]{8,128}$/ + +/** Workspace origin with Databricks' own host allowlist as the SSRF guard. */ +function workspaceOrigin(host: string): string { + const result = validateDatabricksWorkspaceHost(host.trim().replace(/^http:\/\//i, ''), 'host') + if (!result.isValid || !result.sanitized) { + throw new DatabricksCredentialError(result.error || 'Invalid Databricks workspace host') + } + return result.sanitized +} + +const hostSchema = z + .string() + .trim() + .min(1, 'Databricks workspace host is required') + .max(255) + .transform((value, context) => { + try { + return new URL(workspaceOrigin(value)).host + } catch (error) { + context.addIssue({ code: 'custom', message: getErrorMessage(error, 'Invalid host') }) + return z.NEVER + } + }) + +const clientIdSchema = z.string().trim().regex(CLIENT_ID_PATTERN, 'Invalid client ID') + +const oidcShape = { + authType: z.literal('oidc_federation'), + host: hostSchema, + clientId: clientIdSchema, + subject: z.string().min(1).max(512), +} + +const patSchema = z + .object({ + authType: z.literal('personal_access_token'), + host: hostSchema, + token: z.string().trim().min(1, 'Personal access token is required').max(4096), + }) + .strict() + +const servicePrincipalSchema = z + .object({ + authType: z.literal('service_principal'), + host: hostSchema, + clientId: clientIdSchema, + clientSecret: z.string().min(1, 'OAuth secret is required').max(4096), + }) + .strict() + +const storedConfigSchema = z.discriminatedUnion('authType', [ + patSchema, + servicePrincipalSchema, + z.object(oidcShape).strict(), +]) + +type DatabricksCredentialConfig = z.infer + +const submittedConfigSchema = z.discriminatedUnion('authType', [ + patSchema, + servicePrincipalSchema, + z.object({ ...oidcShape, subjectProof: z.string().min(1).max(512).optional() }).strict(), +]) + +const storedSecretSchema = z + .object({ type: z.literal(DATABRICKS_CREDENTIAL_SECRET_TYPE), config: storedConfigSchema }) + .strict() + +export class DatabricksCredentialError extends Error { + constructor(message: string) { + super(message) + this.name = 'DatabricksCredentialError' + } +} + +async function requestWorkspaceToken( + host: string, + body: URLSearchParams, + headers: Record = {} +): Promise { + const response = await fetch(`${workspaceOrigin(host)}/oidc/v1/token`, { + method: 'POST', + headers: { 'Content-Type': 'application/x-www-form-urlencoded', ...headers }, + body, + // A secret or subject token must never follow a redirect off the workspace host. + redirect: 'error', + signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS), + }) + const payload = (await response.json().catch(() => ({}))) as { + access_token?: unknown + error_description?: unknown + error?: unknown + } + if (!response.ok || typeof payload.access_token !== 'string' || !payload.access_token) { + const reason = + typeof payload.error_description === 'string' + ? payload.error_description + : typeof payload.error === 'string' + ? payload.error + : `HTTP ${response.status}` + throw new DatabricksCredentialError(`Databricks rejected the token request: ${reason}`) + } + return payload.access_token +} + +/** A bearer token for the configured workspace. */ +async function resolveDatabricksAccessToken( + config: DatabricksCredentialConfig, + owner: WorkloadIdentityOwner +): Promise { + if (config.authType === 'personal_access_token') return config.token + if (config.authType === 'service_principal') { + const basic = Buffer.from(`${config.clientId}:${config.clientSecret}`).toString('base64') + return requestWorkspaceToken( + config.host, + new URLSearchParams({ grant_type: 'client_credentials', scope: 'all-apis' }), + { Authorization: `Basic ${basic}` } + ) + } + const subjectToken = await mintWorkloadIdentityToken({ + subject: config.subject, + audience: DATABRICKS_WORKLOAD_IDENTITY_AUDIENCE, + owner, + }) + return requestWorkspaceToken( + config.host, + new URLSearchParams({ + client_id: config.clientId, + subject_token: subjectToken, + subject_token_type: 'urn:ietf:params:oauth:token-type:jwt', + grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange', + scope: 'all-apis', + }) + ) +} + +function readStoredSubject(storedSecret: Record | null | undefined) { + const parsed = storedSecretSchema.safeParse(storedSecret) + return parsed.success && parsed.data.config.authType === 'oidc_federation' + ? parsed.data.config.subject + : undefined +} + +function bindSubject( + subject: string, + subjectProof: string | undefined, + owner: WorkloadIdentityCredentialOwner +): string { + if (subject === readStoredSubject(owner.storedSecret)) return subject + if (!subjectProof) { + throw new DatabricksCredentialError('Start a new keyless Databricks connection') + } + try { + verifyWorkloadIdentitySubject('databricks', owner, owner.actorUserId, subject, subjectProof) + } catch (error) { + if (error instanceof WorkloadIdentitySubjectError) { + throw new DatabricksCredentialError(error.message) + } + throw error + } + return subject +} + +/** + * Validates the submitted configuration, proves it by calling the workspace's + * SCIM `Me` endpoint with the resolved token, and returns the encrypted blob + * plus the identity Databricks reports. + */ +export async function verifyAndEncryptDatabricksCredential( + serialized: string, + owner: WorkloadIdentityCredentialOwner +): Promise<{ encryptedServiceAccountKey: string; identity: string }> { + if (Buffer.byteLength(serialized, 'utf8') > 64 * 1024) { + throw new DatabricksCredentialError('Databricks credential configuration is too large') + } + let raw: unknown + try { + raw = JSON.parse(serialized) + } catch { + throw new DatabricksCredentialError('Invalid Databricks credential configuration') + } + const parsed = submittedConfigSchema.safeParse(raw) + if (!parsed.success) { + throw new DatabricksCredentialError( + parsed.error.issues[0]?.message ?? 'Invalid Databricks credential' + ) + } + const submitted = parsed.data + let config: DatabricksCredentialConfig + if (submitted.authType === 'oidc_federation') { + const { subjectProof, ...rest } = submitted + config = { ...rest, subject: bindSubject(rest.subject, subjectProof, owner) } + } else { + config = submitted + } + + let identity: string + try { + const token = await resolveDatabricksAccessToken(config, owner) + const response = await fetch(`${workspaceOrigin(config.host)}/api/2.0/preview/scim/v2/Me`, { + headers: { Authorization: `Bearer ${token}`, Accept: 'application/json' }, + redirect: 'error', + signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS), + }) + if (!response.ok) throw new Error(`workspace returned HTTP ${response.status}`) + const me = (await response.json().catch(() => ({}))) as { + userName?: unknown + displayName?: unknown + } + identity = + (typeof me.userName === 'string' && me.userName) || + (typeof me.displayName === 'string' && me.displayName) || + config.host + } catch (error) { + throw new DatabricksCredentialError( + `Could not verify the Databricks credential: ${getErrorMessage(error, 'Unknown error')}` + ) + } + + const { encrypted } = await encryptSecret( + JSON.stringify({ type: DATABRICKS_CREDENTIAL_SECRET_TYPE, config }) + ) + return { encryptedServiceAccountKey: encrypted, identity } +} + +/** + * Resolves an executor-authorized Databricks credential (the executor already + * checked the caller may use it) to a token and its workspace host. + */ +export async function resolveDatabricksCredentialToken( + credentialId: string +): Promise<{ accessToken: string; domain: string }> { + const [row] = await db + .select({ + workspaceId: credential.workspaceId, + organizationId: credential.organizationId, + providerId: credential.providerId, + revokedAt: credential.revokedAt, + encryptedServiceAccountKey: credential.encryptedServiceAccountKey, + }) + .from(credential) + .where(eq(credential.id, credentialId)) + .limit(1) + if ( + !row || + row.providerId !== DATABRICKS_SERVICE_ACCOUNT_PROVIDER_ID || + row.revokedAt !== null || + !row.encryptedServiceAccountKey + ) { + throw new DatabricksCredentialError('Databricks credential is unavailable') + } + const { decrypted } = await decryptSecret(row.encryptedServiceAccountKey) + const { config } = storedSecretSchema.parse(JSON.parse(decrypted)) + const owner: WorkloadIdentityOwner = row.workspaceId + ? { workspaceId: row.workspaceId } + : { organizationId: row.organizationId ?? undefined } + return { accessToken: await resolveDatabricksAccessToken(config, owner), domain: config.host } +} diff --git a/apps/sim/lib/credentials/orchestration/credential-create.ts b/apps/sim/lib/credentials/orchestration/credential-create.ts index 41a1af00008..01d864a489b 100644 --- a/apps/sim/lib/credentials/orchestration/credential-create.ts +++ b/apps/sim/lib/credentials/orchestration/credential-create.ts @@ -323,6 +323,12 @@ export async function createCredentialRecord( fingerprint: params.fingerprint, privateKeyPassphrase: params.privateKeyPassphrase, region: params.region, + owner: { + ...(scope.kind === 'workspace' + ? { workspaceId: scope.workspaceId } + : { organizationId: scope.organizationId }), + actorUserId: userId, + }, }) resolvedProviderId = secret.providerId resolvedAccountId = null diff --git a/apps/sim/lib/credentials/orchestration/index.ts b/apps/sim/lib/credentials/orchestration/index.ts index 73aab4fab51..1a94fec2d62 100644 --- a/apps/sim/lib/credentials/orchestration/index.ts +++ b/apps/sim/lib/credentials/orchestration/index.ts @@ -51,6 +51,8 @@ import { invalidateEffectiveDecryptedEnvCache } from '@/lib/environment/utils' import { findSlackSearchInstallation } from '@/lib/knowledge/application/slack-search/repository' import { ATLASSIAN_SERVICE_ACCOUNT_PROVIDER_ID, + AWS_SERVICE_ACCOUNT_PROVIDER_ID, + DATABRICKS_SERVICE_ACCOUNT_PROVIDER_ID, GOOGLE_SERVICE_ACCOUNT_PROVIDER_ID, SLACK_CUSTOM_BOT_PROVIDER_ID, SLACK_CUSTOM_BOT_SECRET_TYPE, @@ -235,7 +237,11 @@ export interface PerformCredentialResult { export type UpdateCredentialRecordParams = Omit< PerformUpdateCredentialParams, 'userId' | 'actorName' | 'actorEmail' | 'allowedTypes' | 'reason' | 'request' -> & { credential: CredentialRow } +> & { + credential: CredentialRow + /** The person saving the change; binds owner-scoped secrets such as an AWS OIDC subject. */ + actorUserId?: string +} /** Updates one already-authorized credential without surface authorization or audit. */ export async function updateCredentialRecord( @@ -334,6 +340,10 @@ export async function updateCredentialRecord( providerId === ATLASSIAN_SERVICE_ACCOUNT_PROVIDER_ID && params.atlassianProduct === undefined const needsStoredUsername = params.username === undefined && isMultiGrantProvider + // A keyless AWS role or Databricks principal keeps its trusted subject across reconnects. + const needsStoredBoundSubject = + providerId === AWS_SERVICE_ACCOUNT_PROVIDER_ID || + providerId === DATABRICKS_SERVICE_ACCOUNT_PROVIDER_ID // Rotating to a key that belongs to a different principal makes an // identity-derived label (a Google `client_email`, a Slack team name) @@ -351,7 +361,8 @@ export async function updateCredentialRecord( needsStoredAuthMethod || needsStoredUsername || needsStoredIdentity || - needsStoredAtlassianProduct + needsStoredAtlassianProduct || + needsStoredBoundSubject ? await readStoredSecretBlob(params.credential.id) : null @@ -431,6 +442,13 @@ export async function updateCredentialRecord( fingerprint: params.fingerprint, privateKeyPassphrase: params.privateKeyPassphrase, region: params.region, + owner: { + ...(params.credential.organizationId + ? { organizationId: params.credential.organizationId } + : { workspaceId: params.credential.workspaceId ?? undefined }), + actorUserId: params.actorUserId ?? '', + storedSecret: storedBlob, + }, }) updates.encryptedServiceAccountKey = secret.encryptedServiceAccountKey rotatedSlackBotUserId = secret.botUserId @@ -571,7 +589,11 @@ export async function performUpdateCredential( } } - const result = await updateCredentialRecord({ ...params, credential: access.credential }) + const result = await updateCredentialRecord({ + ...params, + credential: access.credential, + actorUserId: params.userId, + }) if (!result.success) return result recordAudit({ diff --git a/apps/sim/lib/credentials/service-account-fields.ts b/apps/sim/lib/credentials/service-account-fields.ts index 853679387a3..62678c4b20a 100644 --- a/apps/sim/lib/credentials/service-account-fields.ts +++ b/apps/sim/lib/credentials/service-account-fields.ts @@ -2,6 +2,8 @@ import { CLIENT_CREDENTIAL_ACCOUNT_REQUIRED_FIELDS } from '@/lib/credentials/cli import { TOKEN_SERVICE_ACCOUNT_REQUIRED_FIELDS } from '@/lib/credentials/token-service-accounts/descriptors' import { ATLASSIAN_SERVICE_ACCOUNT_PROVIDER_ID, + AWS_SERVICE_ACCOUNT_PROVIDER_ID, + DATABRICKS_SERVICE_ACCOUNT_PROVIDER_ID, GOOGLE_SERVICE_ACCOUNT_PROVIDER_ID, OCI_API_KEY_SERVICE_ACCOUNT_PROVIDER_ID, ORACLE_DATABASE_SERVICE_ACCOUNT_PROVIDER_ID, @@ -47,6 +49,8 @@ export type ServiceAccountFieldId = */ export const SERVICE_ACCOUNT_REQUIRED_FIELDS: Record = { [ORACLE_DATABASE_SERVICE_ACCOUNT_PROVIDER_ID]: ['serviceAccountJson'], + [AWS_SERVICE_ACCOUNT_PROVIDER_ID]: ['serviceAccountJson'], + [DATABRICKS_SERVICE_ACCOUNT_PROVIDER_ID]: ['serviceAccountJson'], [GOOGLE_SERVICE_ACCOUNT_PROVIDER_ID]: ['serviceAccountJson'], [ATLASSIAN_SERVICE_ACCOUNT_PROVIDER_ID]: ['apiToken', 'domain'], [SLACK_CUSTOM_BOT_PROVIDER_ID]: ['signingSecret', 'botToken'], diff --git a/apps/sim/lib/credentials/service-account-provider-ids.ts b/apps/sim/lib/credentials/service-account-provider-ids.ts index a060015a393..dde9710d8b7 100644 --- a/apps/sim/lib/credentials/service-account-provider-ids.ts +++ b/apps/sim/lib/credentials/service-account-provider-ids.ts @@ -8,6 +8,8 @@ import { } from '@/lib/credentials/token-service-accounts/descriptors' import { ATLASSIAN_SERVICE_ACCOUNT_PROVIDER_ID, + AWS_SERVICE_ACCOUNT_PROVIDER_ID, + DATABRICKS_SERVICE_ACCOUNT_PROVIDER_ID, GOOGLE_SERVICE_ACCOUNT_PROVIDER_ID, OCI_API_KEY_SERVICE_ACCOUNT_PROVIDER_ID, ORACLE_DATABASE_SERVICE_ACCOUNT_PROVIDER_ID, @@ -33,6 +35,8 @@ export function asServiceAccountProviderId( value === SLACK_CUSTOM_BOT_PROVIDER_ID || value === OCI_API_KEY_SERVICE_ACCOUNT_PROVIDER_ID || value === ORACLE_DATABASE_SERVICE_ACCOUNT_PROVIDER_ID || + value === AWS_SERVICE_ACCOUNT_PROVIDER_ID || + value === DATABRICKS_SERVICE_ACCOUNT_PROVIDER_ID || isTokenServiceAccountProviderId(value) || isClientCredentialAccountProviderId(value) ) { @@ -76,6 +80,8 @@ export function getServiceAccountConnectNoun(providerId: string): string { if (providerId === SLACK_CUSTOM_BOT_PROVIDER_ID) return 'custom bot' if (providerId === OCI_API_KEY_SERVICE_ACCOUNT_PROVIDER_ID) return 'API key' if (providerId === ORACLE_DATABASE_SERVICE_ACCOUNT_PROVIDER_ID) return 'database connection' + if (providerId === AWS_SERVICE_ACCOUNT_PROVIDER_ID) return 'AWS credential' + if (providerId === DATABRICKS_SERVICE_ACCOUNT_PROVIDER_ID) return 'Databricks connection' const descriptor = getTokenServiceAccountDescriptor(providerId) ?? getClientCredentialAccountDescriptor(providerId) return descriptor?.connectNoun ?? 'service account' diff --git a/apps/sim/lib/credentials/service-account-secret.ts b/apps/sim/lib/credentials/service-account-secret.ts index 4bf9d0b8768..4b5509ea62b 100644 --- a/apps/sim/lib/credentials/service-account-secret.ts +++ b/apps/sim/lib/credentials/service-account-secret.ts @@ -6,6 +6,10 @@ import { normalizeAtlassianDomain, validateAtlassianServiceAccount, } from '@/lib/credentials/atlassian-service-account' +import { + AwsCredentialError, + verifyAndEncryptAwsCredential, +} from '@/lib/credentials/aws-service-account.server' import { CLIENT_CREDENTIAL_ACCOUNT_SECRET_TYPE, type ClientCredentialAccountFieldId, @@ -19,6 +23,10 @@ import { type ClientCredentialAccountSecretBlob, getClientCredentialAccountMinter, } from '@/lib/credentials/client-credential-accounts/server' +import { + DatabricksCredentialError, + verifyAndEncryptDatabricksCredential, +} from '@/lib/credentials/databricks-service-account.server' import { slackCustomBotDisplayName } from '@/lib/credentials/display-name' import { verifyAndEncryptOciApiKeyCredential } from '@/lib/credentials/oci-api-key-service-account.server' import { verifyAndEncryptOracleDatabaseCredential } from '@/lib/credentials/oracledb-service-account.server' @@ -36,10 +44,13 @@ import { getTokenServiceAccountValidator, type TokenServiceAccountSecretBlob, } from '@/lib/credentials/token-service-accounts/server' +import type { WorkloadIdentityCredentialOwner } from '@/lib/credentials/workload-identity/subject' import { GITHUB_INSTALLATION_PROVIDER_ID } from '@/lib/oauth/github-installation-types' import { ATLASSIAN_SERVICE_ACCOUNT_PROVIDER_ID, ATLASSIAN_SERVICE_ACCOUNT_SECRET_TYPE, + AWS_SERVICE_ACCOUNT_PROVIDER_ID, + DATABRICKS_SERVICE_ACCOUNT_PROVIDER_ID, GOOGLE_SERVICE_ACCOUNT_PROVIDER_ID, OCI_API_KEY_SERVICE_ACCOUNT_PROVIDER_ID, ORACLE_DATABASE_SERVICE_ACCOUNT_PROVIDER_ID, @@ -71,6 +82,12 @@ export interface ServiceAccountSecretFields { fingerprint?: string privateKeyPassphrase?: string region?: string + /** + * Who owns the credential and who is saving it. Only providers whose secret + * is bound to its owner read it (an AWS OIDC role subject is bound to the + * workspace and the person who prepared it); every other builder ignores it. + */ + owner?: WorkloadIdentityCredentialOwner } export interface ServiceAccountSecretResult { @@ -233,6 +250,58 @@ async function buildGoogleServiceAccountSecret( } } +async function buildAwsServiceAccountSecret( + fields: ServiceAccountSecretFields +): Promise { + if (!fields.serviceAccountJson) + throw new ServiceAccountSecretError('AWS credential configuration is required') + if (!fields.owner) throw new ServiceAccountSecretError('AWS credential owner is required') + let result + try { + result = await verifyAndEncryptAwsCredential(fields.serviceAccountJson, fields.owner) + } catch (error) { + if (error instanceof AwsCredentialError) throw new ServiceAccountSecretError(error.message) + throw new ServiceAccountSecretError( + `Could not verify the AWS credential: ${getErrorMessage(error, 'Unknown error')}` + ) + } + const principal: ServiceAccountPrincipal = { kind: 'user', id: result.callerArn } + return { + providerId: AWS_SERVICE_ACCOUNT_PROVIDER_ID, + encryptedServiceAccountKey: result.encryptedServiceAccountKey, + displayName: result.callerArn, + auditMetadata: serviceAccountPrincipalMetadata(principal), + principal, + } +} + +async function buildDatabricksServiceAccountSecret( + fields: ServiceAccountSecretFields +): Promise { + if (!fields.serviceAccountJson) + throw new ServiceAccountSecretError('Databricks credential configuration is required') + if (!fields.owner) throw new ServiceAccountSecretError('Databricks credential owner is required') + let result + try { + result = await verifyAndEncryptDatabricksCredential(fields.serviceAccountJson, fields.owner) + } catch (error) { + if (error instanceof DatabricksCredentialError) { + throw new ServiceAccountSecretError(error.message) + } + throw new ServiceAccountSecretError( + `Could not verify the Databricks credential: ${getErrorMessage(error, 'Unknown error')}` + ) + } + const principal: ServiceAccountPrincipal = { kind: 'user', id: result.identity } + return { + providerId: DATABRICKS_SERVICE_ACCOUNT_PROVIDER_ID, + encryptedServiceAccountKey: result.encryptedServiceAccountKey, + displayName: result.identity, + auditMetadata: serviceAccountPrincipalMetadata(principal), + principal, + } +} + async function buildOracleDatabaseServiceAccountSecret( fields: ServiceAccountSecretFields ): Promise { @@ -427,6 +496,8 @@ const SERVICE_ACCOUNT_SECRET_BUILDERS: Record = { + aws: 'sts.amazonaws.com', + databricks: 'sim-databricks', +} diff --git a/apps/sim/lib/credentials/workload-identity/issuer.test.ts b/apps/sim/lib/credentials/workload-identity/issuer.test.ts new file mode 100644 index 00000000000..06b0ce9d2d9 --- /dev/null +++ b/apps/sim/lib/credentials/workload-identity/issuer.test.ts @@ -0,0 +1,117 @@ +/** + * @vitest-environment node + */ +import { generateKeyPairSync } from 'node:crypto' +import { createLocalJWKSet, decodeProtectedHeader, jwtVerify } from 'jose' +import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' +import { env } from '@/lib/core/config/env' + +/** The shared env mock is mutable at runtime; its declared type is the real readonly env. */ +function setEnv(key: string, value: string | undefined) { + Reflect.set(env, key, value) +} + +function rsaPem() { + return generateKeyPairSync('rsa', { modulusLength: 2048 }).privateKey.export({ + type: 'pkcs8', + format: 'pem', + }) as string +} + +async function loadIssuer() { + vi.resetModules() + return import('@/lib/credentials/workload-identity/issuer') +} + +describe('workload identity issuer', () => { + beforeEach(() => { + setEnv('WORKLOAD_IDENTITY_SIGNING_KEY', rsaPem()) + }) + + afterEach(() => { + setEnv('WORKLOAD_IDENTITY_SIGNING_KEY', undefined) + setEnv('WORKLOAD_IDENTITY_PREVIOUS_KEY', undefined) + setEnv('WORKLOAD_IDENTITY_ISSUER', undefined) + }) + + it('mints a token a relying party verifies with the published JWKS and discovery document', async () => { + const issuer = await loadIssuer() + const token = await issuer.mintWorkloadIdentityToken({ + subject: 'sim:workspace:ws-1:credential:abc123def456', + audience: 'sts.amazonaws.com', + owner: { workspaceId: 'ws-1' }, + }) + const discovery = issuer.getWorkloadIdentityDiscoveryDocument() + const jwks = createLocalJWKSet(await issuer.getWorkloadIdentityJwks()) + + const { payload } = await jwtVerify(token, jwks, { + issuer: discovery.issuer, + audience: 'sts.amazonaws.com', + algorithms: discovery.id_token_signing_alg_values_supported, + }) + + expect(discovery.jwks_uri).toBe(`${discovery.issuer}/jwks`) + expect(payload.sub).toBe('sim:workspace:ws-1:credential:abc123def456') + expect(payload.sim_workspace_id).toBe('ws-1') + expect((payload.exp ?? 0) - (payload.iat ?? 0)).toBe(issuer.WORKLOAD_IDENTITY_TOKEN_TTL_SECONDS) + }) + + it('rejects a token presented to a different audience', async () => { + const issuer = await loadIssuer() + const token = await issuer.mintWorkloadIdentityToken({ + subject: 'sim:workspace:ws-1:credential:abc123def456', + audience: 'sts.amazonaws.com', + owner: { workspaceId: 'ws-1' }, + }) + const jwks = createLocalJWKSet(await issuer.getWorkloadIdentityJwks()) + + await expect(jwtVerify(token, jwks, { audience: 'sim-databricks' })).rejects.toThrow() + }) + + it('keeps verifying tokens signed by the previous key during rotation', async () => { + const previousKey = rsaPem() + setEnv('WORKLOAD_IDENTITY_SIGNING_KEY', previousKey) + const before = await loadIssuer() + const oldToken = await before.mintWorkloadIdentityToken({ + subject: 'sim:workspace:ws-1:credential:abc123def456', + audience: 'sts.amazonaws.com', + owner: { workspaceId: 'ws-1' }, + }) + + setEnv('WORKLOAD_IDENTITY_SIGNING_KEY', rsaPem()) + setEnv('WORKLOAD_IDENTITY_PREVIOUS_KEY', previousKey) + const after = await loadIssuer() + const jwks = await after.getWorkloadIdentityJwks() + + expect(jwks.keys).toHaveLength(2) + await expect(jwtVerify(oldToken, createLocalJWKSet(jwks))).resolves.toBeTruthy() + expect(jwks.keys.map((key) => key.kid)).toContain(decodeProtectedHeader(oldToken).kid) + expect(jwks.keys.every((key) => key.d === undefined)).toBe(true) + }) + + it('publishes nothing and refuses to sign when no signing key is configured', async () => { + setEnv('WORKLOAD_IDENTITY_SIGNING_KEY', undefined) + const issuer = await loadIssuer() + const { workloadIdentityDiscoveryResponse, workloadIdentityJwksResponse } = await import( + '@/lib/credentials/workload-identity/responses' + ) + + expect(issuer.isWorkloadIdentityConfigured()).toBe(false) + expect(workloadIdentityDiscoveryResponse().status).toBe(404) + expect((await workloadIdentityJwksResponse()).status).toBe(404) + await expect( + issuer.mintWorkloadIdentityToken({ + subject: 'sim:workspace:ws-1:credential:abc123def456', + audience: 'sts.amazonaws.com', + owner: { workspaceId: 'ws-1' }, + }) + ).rejects.toBeInstanceOf(issuer.WorkloadIdentityNotConfiguredError) + }) + + it('uses the pinned issuer URL when one is configured', async () => { + setEnv('WORKLOAD_IDENTITY_ISSUER', 'https://oidc.example.com/workload/') + const issuer = await loadIssuer() + + expect(issuer.getWorkloadIdentityIssuer()).toBe('https://oidc.example.com/workload') + }) +}) diff --git a/apps/sim/lib/credentials/workload-identity/issuer.ts b/apps/sim/lib/credentials/workload-identity/issuer.ts new file mode 100644 index 00000000000..fbeb15bab5f --- /dev/null +++ b/apps/sim/lib/credentials/workload-identity/issuer.ts @@ -0,0 +1,156 @@ +import { createPrivateKey, createPublicKey, type KeyObject } from 'node:crypto' +import { generateId } from '@sim/utils/id' +import { calculateJwkThumbprint, type JWK, SignJWT } from 'jose' +import { env } from '@/lib/core/config/env' +import { getBaseUrl } from '@/lib/core/utils/urls' + +/** + * Sim's workload-identity issuer: a minimal OpenID Connect token issuer that + * lets a customer's cloud trust Sim directly, so a credential can assume an + * AWS role (or federate into another cloud) without any long-lived key stored + * in Sim. + * + * It is deliberately separate from the Better Auth OAuth server, which is an + * opaque-token API-authorization surface with JWT/JWKS disabled. This issuer + * only signs short-lived tokens for Sim's own server-side use while a saved + * credential resolves; tokens never reach a block output, the model, or a + * browser. + */ + +export const WORKLOAD_IDENTITY_PATH = '/oidc/workload' +export const WORKLOAD_IDENTITY_ALGORITHM = 'RS256' +export const WORKLOAD_IDENTITY_TOKEN_TTL_SECONDS = 300 + +const PRIVATE_JWK_FIELDS = ['d', 'p', 'q', 'dp', 'dq', 'qi'] as const + +export class WorkloadIdentityNotConfiguredError extends Error { + constructor() { + super('Workload identity is not configured on this deployment') + this.name = 'WorkloadIdentityNotConfiguredError' + } +} + +interface SigningMaterial { + privateKey: KeyObject + kid: string + jwks: { keys: JWK[] } +} + +/** Env values often arrive with escaped newlines; PEM parsing needs real ones. */ +function normalizePem(value: string): string { + return value.includes('\\n') ? value.replace(/\\n/g, '\n') : value +} + +async function toPublicJwk(key: KeyObject): Promise { + const publicKey = key.type === 'public' ? key : createPublicKey(key) + const exported = publicKey.export({ format: 'jwk' }) as JWK + for (const field of PRIVATE_JWK_FIELDS) delete exported[field] + if (exported.kty !== 'RSA') { + throw new Error('Workload identity keys must be RSA keys') + } + const kid = await calculateJwkThumbprint(exported, 'sha256') + return { ...exported, kid, alg: WORKLOAD_IDENTITY_ALGORITHM, use: 'sig' } +} + +let signingMaterial: Promise | undefined + +/** + * Loads the signing key once per process. The key is immutable config, not a + * remote read, so this is a memoized derivation rather than a cache; a failed + * load is not memoized so a fixed deployment recovers without a restart. + */ +function loadSigningMaterial(): Promise { + const signingKey = env.WORKLOAD_IDENTITY_SIGNING_KEY + if (!signingKey) return Promise.reject(new WorkloadIdentityNotConfiguredError()) + if (!signingMaterial) { + signingMaterial = (async () => { + const privateKey = createPrivateKey(normalizePem(signingKey)) + const current = await toPublicJwk(privateKey) + const keys = [current] + const previousKey = env.WORKLOAD_IDENTITY_PREVIOUS_KEY + if (previousKey) { + const previous = await toPublicJwk(createPublicKey(normalizePem(previousKey))) + if (previous.kid !== current.kid) keys.push(previous) + } + return { privateKey, kid: current.kid as string, jwks: { keys } } + })() + signingMaterial.catch(() => { + signingMaterial = undefined + }) + } + return signingMaterial +} + +/** Whether this deployment can mint workload-identity tokens. */ +export function isWorkloadIdentityConfigured(): boolean { + return Boolean(env.WORKLOAD_IDENTITY_SIGNING_KEY) +} + +/** The issuer URL customers register as an OIDC identity provider. Stable for the deployment's life. */ +export function getWorkloadIdentityIssuer(): string { + const configured = env.WORKLOAD_IDENTITY_ISSUER?.trim() + return (configured || `${getBaseUrl()}${WORKLOAD_IDENTITY_PATH}`).replace(/\/+$/, '') +} + +/** OpenID Connect discovery document for the issuer. */ +export function getWorkloadIdentityDiscoveryDocument() { + const issuer = getWorkloadIdentityIssuer() + return { + issuer, + jwks_uri: `${issuer}/jwks`, + response_types_supported: ['id_token'], + subject_types_supported: ['public'], + id_token_signing_alg_values_supported: [WORKLOAD_IDENTITY_ALGORITHM], + scopes_supported: ['openid'], + claims_supported: [ + 'iss', + 'sub', + 'aud', + 'exp', + 'iat', + 'nbf', + 'jti', + 'sim_workspace_id', + 'sim_organization_id', + ], + } +} + +/** Public signing keys, including a retiring key during rotation. */ +export async function getWorkloadIdentityJwks(): Promise<{ keys: JWK[] }> { + return (await loadSigningMaterial()).jwks +} + +export interface WorkloadIdentityOwner { + workspaceId?: string + organizationId?: string +} + +export interface MintWorkloadIdentityTokenInput { + /** Fully-qualified subject; see `buildWorkloadIdentitySubject`. */ + subject: string + /** Relying party, e.g. `sts.amazonaws.com`. */ + audience: string + owner: WorkloadIdentityOwner +} + +/** Signs one short-lived token for a single credential resolution. */ +export async function mintWorkloadIdentityToken( + input: MintWorkloadIdentityTokenInput +): Promise { + const { privateKey, kid } = await loadSigningMaterial() + const claims: Record = {} + if (input.owner.workspaceId) claims.sim_workspace_id = input.owner.workspaceId + if (input.owner.organizationId) claims.sim_organization_id = input.owner.organizationId + const now = Math.floor(Date.now() / 1000) + return new SignJWT(claims) + .setProtectedHeader({ alg: WORKLOAD_IDENTITY_ALGORITHM, kid, typ: 'JWT' }) + .setIssuer(getWorkloadIdentityIssuer()) + .setSubject(input.subject) + .setAudience(input.audience) + .setIssuedAt(now) + .setNotBefore(now - 30) + .setExpirationTime(now + WORKLOAD_IDENTITY_TOKEN_TTL_SECONDS) + .setJti(generateId()) + .sign(privateKey) +} diff --git a/apps/sim/lib/credentials/workload-identity/responses.ts b/apps/sim/lib/credentials/workload-identity/responses.ts new file mode 100644 index 00000000000..08fd9a457d1 --- /dev/null +++ b/apps/sim/lib/credentials/workload-identity/responses.ts @@ -0,0 +1,31 @@ +import { NextResponse } from 'next/server' +import { + getWorkloadIdentityDiscoveryDocument, + getWorkloadIdentityJwks, + isWorkloadIdentityConfigured, +} from '@/lib/credentials/workload-identity/issuer' + +/** + * Cloud providers fetch these anonymously (AWS STS, Azure AD, Databricks) and + * cache them; five minutes keeps a key rotation visible quickly. "No issuer + * here" is a 404 rather than an empty document, so a self-hosted deployment + * without a signing key never advertises one. + */ +const DISCOVERY_HEADERS = { + 'Cache-Control': 'public, max-age=300', + 'Access-Control-Allow-Origin': '*', +} as const + +function notConfigured() { + return new NextResponse(null, { status: 404 }) +} + +export function workloadIdentityDiscoveryResponse() { + if (!isWorkloadIdentityConfigured()) return notConfigured() + return NextResponse.json(getWorkloadIdentityDiscoveryDocument(), { headers: DISCOVERY_HEADERS }) +} + +export async function workloadIdentityJwksResponse() { + if (!isWorkloadIdentityConfigured()) return notConfigured() + return NextResponse.json(await getWorkloadIdentityJwks(), { headers: DISCOVERY_HEADERS }) +} diff --git a/apps/sim/lib/credentials/workload-identity/subject.test.ts b/apps/sim/lib/credentials/workload-identity/subject.test.ts new file mode 100644 index 00000000000..de37a6ba6ba --- /dev/null +++ b/apps/sim/lib/credentials/workload-identity/subject.test.ts @@ -0,0 +1,111 @@ +/** + * @vitest-environment node + */ +import { describe, expect, it } from 'vitest' +import { + issueWorkloadIdentitySubject, + verifyWorkloadIdentitySubject, + WorkloadIdentitySubjectError, +} from '@/lib/credentials/workload-identity/subject' + +const owner = { workspaceId: 'ws-1' } +const now = Date.UTC(2026, 10, 6) + +describe('workload identity subjects', () => { + it('accepts the subject and proof Sim issued to this person for this workspace', () => { + const grant = issueWorkloadIdentitySubject('aws', owner, 'user-1', now) + + expect(grant.subject).toMatch(/^sim:workspace:ws-1:credential:[A-Za-z0-9_-]+$/) + expect(() => + verifyWorkloadIdentitySubject('aws', owner, 'user-1', grant.subject, grant.subjectProof, now) + ).not.toThrow() + }) + + it('refuses another member reusing a subject they learned from a trust policy', () => { + const victim = issueWorkloadIdentitySubject('aws', owner, 'user-1', now) + const attacker = issueWorkloadIdentitySubject('aws', owner, 'user-2', now) + + expect(() => + verifyWorkloadIdentitySubject( + 'aws', + owner, + 'user-2', + victim.subject, + attacker.subjectProof, + now + ) + ).toThrow(WorkloadIdentitySubjectError) + expect(() => + verifyWorkloadIdentitySubject( + 'aws', + owner, + 'user-2', + victim.subject, + victim.subjectProof, + now + ) + ).toThrow(WorkloadIdentitySubjectError) + }) + + it('refuses a proof presented in another workspace', () => { + const grant = issueWorkloadIdentitySubject('aws', owner, 'user-1', now) + + expect(() => + verifyWorkloadIdentitySubject( + 'aws', + { workspaceId: 'ws-2' }, + 'user-1', + grant.subject, + grant.subjectProof, + now + ) + ).toThrow(WorkloadIdentitySubjectError) + }) + + it('refuses a proof issued for another provider', () => { + const grant = issueWorkloadIdentitySubject('aws', owner, 'user-1', now) + + expect(() => + verifyWorkloadIdentitySubject( + 'databricks', + owner, + 'user-1', + grant.subject, + grant.subjectProof, + now + ) + ).toThrow(WorkloadIdentitySubjectError) + }) + + it('refuses an expired proof', () => { + const grant = issueWorkloadIdentitySubject('aws', owner, 'user-1', now) + const later = now + 24 * 60 * 60 * 1000 + 1 + + expect(() => + verifyWorkloadIdentitySubject( + 'aws', + owner, + 'user-1', + grant.subject, + grant.subjectProof, + later + ) + ).toThrow(WorkloadIdentitySubjectError) + }) + + it('refuses a tampered or malformed proof', () => { + const grant = issueWorkloadIdentitySubject('aws', owner, 'user-1', now) + const [expiresAt] = grant.subjectProof.split('.') + + for (const proof of [ + `${Number(expiresAt) + 1000}.${grant.subjectProof.split('.')[1]}`, + `${expiresAt}.forged`, + 'no-separator', + '', + ]) { + expect(() => + verifyWorkloadIdentitySubject('aws', owner, 'user-1', grant.subject, proof, now) + ).toThrow(WorkloadIdentitySubjectError) + } + }) +}) diff --git a/apps/sim/lib/credentials/workload-identity/subject.ts b/apps/sim/lib/credentials/workload-identity/subject.ts new file mode 100644 index 00000000000..6b68d8b2169 --- /dev/null +++ b/apps/sim/lib/credentials/workload-identity/subject.ts @@ -0,0 +1,114 @@ +import { createHmac } from 'node:crypto' +import { safeCompare } from '@sim/security/compare' +import { generateId } from '@sim/utils/id' +import { env } from '@/lib/core/config/env' +import type { WorkloadIdentityProvider } from '@/lib/credentials/workload-identity/audiences' +import type { WorkloadIdentityOwner } from '@/lib/credentials/workload-identity/issuer' + +/** + * Credential-scoped workload-identity subjects. + * + * A customer's trust policy pins one subject, so the subject — not the + * workspace — is what a cloud role trusts. Sim generates the random part and + * signs it for the preparing user and owner: a member who learns another + * credential's subject (it is visible in that customer's trust policy) cannot + * attach it to a credential of their own, because only Sim can produce a proof + * for it, and only for the person it was issued to. + */ + +const SUBJECT_PROOF_TTL_MS = 24 * 60 * 60 * 1000 +const SUBJECT_ID_PATTERN = /^[A-Za-z0-9_-]{8,64}$/ + +/** Who owns a credential with a bound subject, and who is saving it. */ +export interface WorkloadIdentityCredentialOwner extends WorkloadIdentityOwner { + /** The person creating or reconnecting the credential. */ + actorUserId: string + /** Decrypted secret of the credential being reconnected, if any. */ + storedSecret?: Record | null +} + +export class WorkloadIdentitySubjectError extends Error { + constructor(message: string) { + super(message) + this.name = 'WorkloadIdentitySubjectError' + } +} + +function ownerSegment(owner: WorkloadIdentityOwner): string { + if (owner.workspaceId && !owner.organizationId) return `workspace:${owner.workspaceId}` + if (owner.organizationId && !owner.workspaceId) return `organization:${owner.organizationId}` + throw new WorkloadIdentitySubjectError('A workload identity subject needs exactly one owner') +} + +/** `sim:workspace::credential:` (or `sim:organization:…`). */ +function buildWorkloadIdentitySubject(owner: WorkloadIdentityOwner, subjectId: string): string { + if (!SUBJECT_ID_PATTERN.test(subjectId)) { + throw new WorkloadIdentitySubjectError('Invalid workload identity subject') + } + return `sim:${ownerSegment(owner)}:credential:${subjectId}` +} + +function proofKey(): Buffer { + return createHmac('sha256', env.BETTER_AUTH_SECRET) + .update('sim/workload-identity-subject/v1') + .digest() +} + +function sign( + provider: WorkloadIdentityProvider, + owner: WorkloadIdentityOwner, + userId: string, + subject: string, + expiresAt: number +) { + return createHmac('sha256', proofKey()) + .update(`${provider}|${ownerSegment(owner)}|${userId}|${subject}|${expiresAt}`, 'utf8') + .digest('base64url') +} + +export interface WorkloadIdentitySubjectGrant { + subject: string + subjectProof: string + expiresAt: string +} + +/** Issues a fresh subject the given user can attach to a new credential of one provider. */ +export function issueWorkloadIdentitySubject( + provider: WorkloadIdentityProvider, + owner: WorkloadIdentityOwner, + userId: string, + now: number = Date.now() +): WorkloadIdentitySubjectGrant { + const subject = buildWorkloadIdentitySubject(owner, generateId().replace(/-/g, '')) + const expiresAt = now + SUBJECT_PROOF_TTL_MS + return { + subject, + subjectProof: `${expiresAt}.${sign(provider, owner, userId, subject, expiresAt)}`, + expiresAt: new Date(expiresAt).toISOString(), + } +} + +/** + * Throws unless the proof was issued by Sim for this provider, owner, user, and + * subject and has not expired. + */ +export function verifyWorkloadIdentitySubject( + provider: WorkloadIdentityProvider, + owner: WorkloadIdentityOwner, + userId: string, + subject: string, + subjectProof: string, + now: number = Date.now() +): void { + const invalid = () => + new WorkloadIdentitySubjectError( + 'This trust setup has expired or belongs to someone else. Start a new AWS role connection.' + ) + const separator = subjectProof.indexOf('.') + if (separator <= 0) throw invalid() + const expiresAt = Number(subjectProof.slice(0, separator)) + const signature = subjectProof.slice(separator + 1) + if (!Number.isSafeInteger(expiresAt) || expiresAt <= now) throw invalid() + if (!subject.startsWith(`sim:${ownerSegment(owner)}:credential:`)) throw invalid() + if (!safeCompare(signature, sign(provider, owner, userId, subject, expiresAt))) throw invalid() +} diff --git a/apps/sim/lib/internal/appconfig/client.ts b/apps/sim/lib/internal/appconfig/client.ts index 38a5e285031..d2beb6d0fd6 100644 --- a/apps/sim/lib/internal/appconfig/client.ts +++ b/apps/sim/lib/internal/appconfig/client.ts @@ -30,25 +30,20 @@ import { GetLatestConfigurationCommand, StartConfigurationSessionCommand, } from '@aws-sdk/client-appconfigdata' +import { awsClientCredentials } from '@/lib/internal/aws/credentials' import type { AppConfigConnectionConfig } from '@/tools/appconfig/types' export function createAppConfigClient(config: AppConfigConnectionConfig): AppConfigClient { return new AppConfigClient({ region: config.region, - credentials: { - accessKeyId: config.accessKeyId, - secretAccessKey: config.secretAccessKey, - }, + credentials: awsClientCredentials(config.accessKeyId, config.secretAccessKey), }) } export function createAppConfigDataClient(config: AppConfigConnectionConfig): AppConfigDataClient { return new AppConfigDataClient({ region: config.region, - credentials: { - accessKeyId: config.accessKeyId, - secretAccessKey: config.secretAccessKey, - }, + credentials: awsClientCredentials(config.accessKeyId, config.secretAccessKey), }) } diff --git a/apps/sim/lib/internal/athena/client.ts b/apps/sim/lib/internal/athena/client.ts index c584509c627..a62c800800a 100644 --- a/apps/sim/lib/internal/athena/client.ts +++ b/apps/sim/lib/internal/athena/client.ts @@ -1,4 +1,5 @@ import { AthenaClient } from '@aws-sdk/client-athena' +import { awsClientCredentials } from '@/lib/internal/aws/credentials' export interface AthenaConnectionConfig { region: string @@ -9,9 +10,6 @@ export interface AthenaConnectionConfig { export function createAthenaClient(config: AthenaConnectionConfig): AthenaClient { return new AthenaClient({ region: config.region, - credentials: { - accessKeyId: config.accessKeyId, - secretAccessKey: config.secretAccessKey, - }, + credentials: awsClientCredentials(config.accessKeyId, config.secretAccessKey), }) } diff --git a/apps/sim/lib/internal/aws/credentials.test.ts b/apps/sim/lib/internal/aws/credentials.test.ts new file mode 100644 index 00000000000..9aab02a1432 --- /dev/null +++ b/apps/sim/lib/internal/aws/credentials.test.ts @@ -0,0 +1,136 @@ +/** + * @vitest-environment node + */ +import { describe, expect, it, vi } from 'vitest' +import type { InternalToolOperationCall } from '@/lib/internal/tool-operations/types' + +const { mockGetAwsCredentialConfig, mockResolveAwsSessionCredentials } = vi.hoisted(() => ({ + mockGetAwsCredentialConfig: vi.fn(), + mockResolveAwsSessionCredentials: vi.fn(), +})) + +vi.mock('@/lib/credentials/aws-service-account.server', () => ({ + buildAwsRoleSessionName: (label?: string) => `sim-${label ?? 'credential'}`, + getAwsCredentialConfig: mockGetAwsCredentialConfig, + resolveAwsSessionCredentials: mockResolveAwsSessionCredentials, +})) + +import { awsClientCredentials, withAwsCredential } from '@/lib/internal/aws/credentials' + +function call(overrides: Partial = {}): InternalToolOperationCall { + return { + toolId: 'dynamodb_get', + input: { region: 'us-east-1', accessKeyId: 'AKIAINLINE', secretAccessKey: 'inline-secret' }, + headers: new Headers(), + context: { workflowId: 'wf-1', workspaceId: 'ws-1', executionId: 'exec-1' }, + requestId: 'req-1', + ...overrides, + } +} + +describe('withAwsCredential', () => { + it('hands an inline-key call to the family handler untouched', async () => { + const request = call() + const handler = vi.fn(async (received: InternalToolOperationCall) => { + const input = received.input as { accessKeyId: string; secretAccessKey: string } + return Response.json(awsClientCredentials(input.accessKeyId, input.secretAccessKey)) + }) + + const response = await withAwsCredential(handler)(request) + + expect(handler.mock.calls[0][0]).toBe(request) + expect(await (response as Response).json()).toStrictEqual({ + accessKeyId: 'AKIAINLINE', + secretAccessKey: 'inline-secret', + }) + expect(mockGetAwsCredentialConfig).not.toHaveBeenCalled() + }) + + it('substitutes the resolved session keys and signs with their session token', async () => { + mockGetAwsCredentialConfig.mockResolvedValue({ + config: { authType: 'oidc_role' }, + owner: { workspaceId: 'ws-1' }, + }) + mockResolveAwsSessionCredentials.mockResolvedValue({ + accessKeyId: 'ASIASESSION', + secretAccessKey: 'session-secret', + sessionToken: 'session-token', + }) + const handler = vi.fn(async (received: InternalToolOperationCall) => { + const input = received.input as { accessKeyId: string; secretAccessKey: string } + return Response.json(awsClientCredentials(input.accessKeyId, input.secretAccessKey)) + }) + + const response = await withAwsCredential(handler)( + call({ + input: { region: 'us-east-1', tableName: 'Users' }, + context: { + workflowId: 'wf-1', + workspaceId: 'ws-1', + executionId: 'exec-1', + authorizedAwsCredentialId: 'cred-1', + }, + }) + ) + + expect(mockGetAwsCredentialConfig).toHaveBeenCalledWith('cred-1', { + workspaceId: 'ws-1', + organizationId: undefined, + }) + expect(handler.mock.calls[0][0].input).toMatchObject({ + region: 'us-east-1', + tableName: 'Users', + accessKeyId: 'ASIASESSION', + secretAccessKey: 'session-secret', + }) + expect(await (response as Response).json()).toStrictEqual({ + accessKeyId: 'ASIASESSION', + secretAccessKey: 'session-secret', + sessionToken: 'session-token', + }) + }) + + it('never attaches a session token to keys other than the resolved pair', async () => { + mockGetAwsCredentialConfig.mockResolvedValue({ config: {}, owner: { workspaceId: 'ws-1' } }) + mockResolveAwsSessionCredentials.mockResolvedValue({ + accessKeyId: 'ASIASESSION', + secretAccessKey: 'session-secret', + sessionToken: 'session-token', + }) + const handler = vi.fn(async () => + Response.json(awsClientCredentials('AKIAOTHER', 'other-secret')) + ) + + const response = await withAwsCredential(handler)( + call({ context: { workflowId: 'wf-1', workspaceId: 'ws-1', authorizedAwsCredentialId: 'c' } }) + ) + + expect(await (response as Response).json()).toStrictEqual({ + accessKeyId: 'AKIAOTHER', + secretAccessKey: 'other-secret', + }) + }) + + it('refuses the call when the credential cannot be resolved, without running the handler', async () => { + mockGetAwsCredentialConfig.mockRejectedValue(new Error('AWS credential is unavailable')) + const handler = vi.fn() + + const response = (await withAwsCredential(handler)( + call({ + context: { workflowId: 'wf-1', workspaceId: 'ws-2', authorizedAwsCredentialId: 'cred-1' }, + }) + )) as Response + + expect(response.status).toBe(403) + expect(handler).not.toHaveBeenCalled() + }) +}) + +describe('awsClientCredentials', () => { + it('returns exactly the inline pair outside a saved-credential call', () => { + expect(awsClientCredentials('AKIAINLINE', 'inline-secret')).toStrictEqual({ + accessKeyId: 'AKIAINLINE', + secretAccessKey: 'inline-secret', + }) + }) +}) diff --git a/apps/sim/lib/internal/aws/credentials.ts b/apps/sim/lib/internal/aws/credentials.ts new file mode 100644 index 00000000000..1ca1bc44fda --- /dev/null +++ b/apps/sim/lib/internal/aws/credentials.ts @@ -0,0 +1,99 @@ +import { AsyncLocalStorage } from 'node:async_hooks' +import { getErrorMessage } from '@sim/utils/errors' +import { isRecordLike } from '@sim/utils/object' +import { + type AwsSessionCredentials, + buildAwsRoleSessionName, + getAwsCredentialConfig, + resolveAwsSessionCredentials, +} from '@/lib/credentials/aws-service-account.server' +import type { + InternalToolOperationCall, + InternalToolOperationHandler, +} from '@/lib/internal/tool-operations/types' + +/** + * Saved-credential support for every AWS tool family. + * + * An AWS operation was written for inline keys: its contract requires an + * access key pair and its client signs with exactly that pair. A saved + * credential plugs in underneath without touching either: + * + * 1. The executor authorizes the credential and sets + * `context.authorizedAwsCredentialId` (trusted context, never tool input). + * 2. {@link withAwsCredential} resolves it to session credentials and + * substitutes them for `accessKeyId`/`secretAccessKey` before the contract parses. + * 3. The family's client asks {@link awsClientCredentials} for its SDK + * credentials, which adds the session token for that resolved key pair. + * + * With no saved credential, step 2 calls the handler with the original request + * object and step 3 returns the same `{ accessKeyId, secretAccessKey }` the + * client always built, so inline-key behavior is unchanged. + */ + +const sessionStorage = new AsyncLocalStorage() + +/** SDK credentials for a client built from an operation's key fields. */ +export function awsClientCredentials( + accessKeyId: string, + secretAccessKey: string +): { accessKeyId: string; secretAccessKey: string; sessionToken?: string } { + const session = sessionStorage.getStore() + if (session?.sessionToken && session.accessKeyId === accessKeyId) { + return { accessKeyId, secretAccessKey, sessionToken: session.sessionToken } + } + return { accessKeyId, secretAccessKey } +} + +/** + * Resolves an executor-authorized AWS credential for the run's owner scope. + * Also used directly by AWS tools that sign their own HTTP requests. + */ +export async function resolveAuthorizedAwsCredential( + credentialId: string, + context: { workspaceId?: string; organizationId?: string; executionId?: string }, + signal?: AbortSignal +): Promise { + const { config, owner } = await getAwsCredentialConfig(credentialId, { + workspaceId: context.workspaceId, + organizationId: context.organizationId, + }) + signal?.throwIfAborted() + return resolveAwsSessionCredentials(config, owner, { + roleSessionName: buildAwsRoleSessionName(context.executionId), + signal, + }) +} + +/** Wraps a family's operation handler so it also accepts a saved AWS credential. */ +export function withAwsCredential( + handler: InternalToolOperationHandler +): InternalToolOperationHandler { + return async (request: InternalToolOperationCall) => { + const credentialId = request.context.authorizedAwsCredentialId + if (!credentialId) return handler(request) + + if (!isRecordLike(request.input)) { + return Response.json({ error: 'Invalid request data' }, { status: 400 }) + } + + let session: AwsSessionCredentials + try { + session = await resolveAuthorizedAwsCredential(credentialId, request.context, request.signal) + } catch (error) { + request.signal?.throwIfAborted() + return Response.json( + { error: `Could not use the AWS credential: ${getErrorMessage(error, 'Unknown error')}` }, + { status: 403 } + ) + } + request.signal?.throwIfAborted() + + const input = { + ...request.input, + accessKeyId: session.accessKeyId, + secretAccessKey: session.secretAccessKey, + } + return sessionStorage.run(session, () => handler({ ...request, input })) + } +} diff --git a/apps/sim/lib/internal/cloudformation/client.ts b/apps/sim/lib/internal/cloudformation/client.ts index fb2eb8bca66..06dac7e41e2 100644 --- a/apps/sim/lib/internal/cloudformation/client.ts +++ b/apps/sim/lib/internal/cloudformation/client.ts @@ -4,6 +4,7 @@ import { type Parameter, type Tag, } from '@aws-sdk/client-cloudformation' +import { awsClientCredentials } from '@/lib/internal/aws/credentials' export interface CloudFormationConnectionConfig { region: string @@ -16,10 +17,7 @@ export function createCloudFormationClient( ): CloudFormationClient { return new CloudFormationClient({ region: config.region, - credentials: { - accessKeyId: config.accessKeyId, - secretAccessKey: config.secretAccessKey, - }, + credentials: awsClientCredentials(config.accessKeyId, config.secretAccessKey), }) } diff --git a/apps/sim/lib/internal/cloudtrail/client.ts b/apps/sim/lib/internal/cloudtrail/client.ts index 3d5b13d7bd9..66e7bc549b9 100644 --- a/apps/sim/lib/internal/cloudtrail/client.ts +++ b/apps/sim/lib/internal/cloudtrail/client.ts @@ -1,4 +1,5 @@ import { CloudTrailClient } from '@aws-sdk/client-cloudtrail' +import { awsClientCredentials } from '@/lib/internal/aws/credentials' export interface CloudTrailConnectionConfig { region: string @@ -25,10 +26,7 @@ export function createCloudTrailClient( ): CloudTrailClient { return new CloudTrailClient({ region: config.region, - credentials: { - accessKeyId: config.accessKeyId, - secretAccessKey: config.secretAccessKey, - }, + credentials: awsClientCredentials(config.accessKeyId, config.secretAccessKey), ...(options.throttleSensitive ? { retryMode: 'adaptive', maxAttempts: THROTTLE_SENSITIVE_MAX_ATTEMPTS } : {}), diff --git a/apps/sim/lib/internal/cloudwatch/client.ts b/apps/sim/lib/internal/cloudwatch/client.ts index f198a8a25c2..01e5963acec 100644 --- a/apps/sim/lib/internal/cloudwatch/client.ts +++ b/apps/sim/lib/internal/cloudwatch/client.ts @@ -10,6 +10,7 @@ import { import { createLogger } from '@sim/logger' import { sleep } from '@sim/utils/helpers' import { DEFAULT_EXECUTION_TIMEOUT_MS } from '@/lib/core/execution-limits' +import { awsClientCredentials } from '@/lib/internal/aws/credentials' interface AwsCredentials { region: string @@ -24,20 +25,14 @@ export function createCloudWatchClient( return new CloudWatchClient({ region: config.region, ...(options?.maxAttempts !== undefined && { maxAttempts: options.maxAttempts }), - credentials: { - accessKeyId: config.accessKeyId, - secretAccessKey: config.secretAccessKey, - }, + credentials: awsClientCredentials(config.accessKeyId, config.secretAccessKey), }) } export function createCloudWatchLogsClient(config: AwsCredentials): CloudWatchLogsClient { return new CloudWatchLogsClient({ region: config.region, - credentials: { - accessKeyId: config.accessKeyId, - secretAccessKey: config.secretAccessKey, - }, + credentials: awsClientCredentials(config.accessKeyId, config.secretAccessKey), }) } diff --git a/apps/sim/lib/internal/codepipeline/client.ts b/apps/sim/lib/internal/codepipeline/client.ts index 0061c45688d..0acd3e71883 100644 --- a/apps/sim/lib/internal/codepipeline/client.ts +++ b/apps/sim/lib/internal/codepipeline/client.ts @@ -1,4 +1,5 @@ import { CodePipelineClient } from '@aws-sdk/client-codepipeline' +import { awsClientCredentials } from '@/lib/internal/aws/credentials' export interface CodePipelineConnectionConfig { region: string @@ -9,9 +10,6 @@ export interface CodePipelineConnectionConfig { export function createCodePipelineClient(config: CodePipelineConnectionConfig): CodePipelineClient { return new CodePipelineClient({ region: config.region, - credentials: { - accessKeyId: config.accessKeyId, - secretAccessKey: config.secretAccessKey, - }, + credentials: awsClientCredentials(config.accessKeyId, config.secretAccessKey), }) } diff --git a/apps/sim/lib/internal/dynamodb/client.ts b/apps/sim/lib/internal/dynamodb/client.ts index 76ee3ceef9c..34b5f544bef 100644 --- a/apps/sim/lib/internal/dynamodb/client.ts +++ b/apps/sim/lib/internal/dynamodb/client.ts @@ -8,15 +8,13 @@ import { ScanCommand, UpdateCommand, } from '@aws-sdk/lib-dynamodb' +import { awsClientCredentials } from '@/lib/internal/aws/credentials' import type { DynamoDBConnectionConfig, DynamoDBTableSchema } from '@/tools/dynamodb/types' export function createDynamoDBClient(config: DynamoDBConnectionConfig): DynamoDBDocumentClient { const client = new DynamoDBClient({ region: config.region, - credentials: { - accessKeyId: config.accessKeyId, - secretAccessKey: config.secretAccessKey, - }, + credentials: awsClientCredentials(config.accessKeyId, config.secretAccessKey), }) return DynamoDBDocumentClient.from(client, { @@ -223,10 +221,7 @@ export async function deleteItem( export function createRawDynamoDBClient(config: DynamoDBConnectionConfig): DynamoDBClient { return new DynamoDBClient({ region: config.region, - credentials: { - accessKeyId: config.accessKeyId, - secretAccessKey: config.secretAccessKey, - }, + credentials: awsClientCredentials(config.accessKeyId, config.secretAccessKey), }) } diff --git a/apps/sim/lib/internal/ec2/client.ts b/apps/sim/lib/internal/ec2/client.ts index 300bed5922f..2c70f65a8c6 100644 --- a/apps/sim/lib/internal/ec2/client.ts +++ b/apps/sim/lib/internal/ec2/client.ts @@ -1,4 +1,5 @@ import { EC2Client, type Tag } from '@aws-sdk/client-ec2' +import { awsClientCredentials } from '@/lib/internal/aws/credentials' interface Ec2ConnectionConfig { region: string @@ -13,10 +14,7 @@ export function createEc2Client( return new EC2Client({ region: config.region, ...(options?.maxAttempts !== undefined && { maxAttempts: options.maxAttempts }), - credentials: { - accessKeyId: config.accessKeyId, - secretAccessKey: config.secretAccessKey, - }, + credentials: awsClientCredentials(config.accessKeyId, config.secretAccessKey), }) } diff --git a/apps/sim/lib/internal/iam/client.ts b/apps/sim/lib/internal/iam/client.ts index 76a2a610692..8a4429653b4 100644 --- a/apps/sim/lib/internal/iam/client.ts +++ b/apps/sim/lib/internal/iam/client.ts @@ -38,15 +38,13 @@ import { SimulatePrincipalPolicyCommand, UpdateAccessKeyCommand, } from '@aws-sdk/client-iam' +import { awsClientCredentials } from '@/lib/internal/aws/credentials' import type { IAMConnectionConfig, IAMSimulateContextEntry } from '@/tools/iam/types' export function createIAMClient(config: IAMConnectionConfig): IAMClient { return new IAMClient({ region: config.region, - credentials: { - accessKeyId: config.accessKeyId, - secretAccessKey: config.secretAccessKey, - }, + credentials: awsClientCredentials(config.accessKeyId, config.secretAccessKey), }) } diff --git a/apps/sim/lib/internal/identity-center/client.ts b/apps/sim/lib/internal/identity-center/client.ts index 02c5cbeef68..e7d3b29e3ad 100644 --- a/apps/sim/lib/internal/identity-center/client.ts +++ b/apps/sim/lib/internal/identity-center/client.ts @@ -27,6 +27,7 @@ import { SSOAdminClient, type TargetType, } from '@aws-sdk/client-sso-admin' +import { awsClientCredentials } from '@/lib/internal/aws/credentials' import { AWS_FANOUT_CONCURRENCY, mapWithConcurrency, @@ -43,10 +44,7 @@ interface IdentityCenterConnectionConfig { export function createSSOAdminClient(config: IdentityCenterConnectionConfig): SSOAdminClient { return new SSOAdminClient({ region: config.region, - credentials: { - accessKeyId: config.accessKeyId, - secretAccessKey: config.secretAccessKey, - }, + credentials: awsClientCredentials(config.accessKeyId, config.secretAccessKey), }) } @@ -55,10 +53,7 @@ export function createIdentityStoreClient( ): IdentitystoreClient { return new IdentitystoreClient({ region: config.region, - credentials: { - accessKeyId: config.accessKeyId, - secretAccessKey: config.secretAccessKey, - }, + credentials: awsClientCredentials(config.accessKeyId, config.secretAccessKey), }) } @@ -69,10 +64,7 @@ export function createIdentityStoreClient( export function createOrganizationsClient(config: IdentityCenterConnectionConfig) { return new OrganizationsClient({ region: resolveOrganizationsRegion(config.region), - credentials: { - accessKeyId: config.accessKeyId, - secretAccessKey: config.secretAccessKey, - }, + credentials: awsClientCredentials(config.accessKeyId, config.secretAccessKey), }) } diff --git a/apps/sim/lib/internal/lambda/client.ts b/apps/sim/lib/internal/lambda/client.ts index 9c689061687..27d216d904c 100644 --- a/apps/sim/lib/internal/lambda/client.ts +++ b/apps/sim/lib/internal/lambda/client.ts @@ -8,6 +8,7 @@ import { type LayersListItem, type LayerVersionsListItem, } from '@aws-sdk/client-lambda' +import { awsClientCredentials } from '@/lib/internal/aws/credentials' export interface LambdaConnectionConfig { region: string @@ -18,10 +19,7 @@ export interface LambdaConnectionConfig { export function createLambdaClient(config: LambdaConnectionConfig): LambdaClient { return new LambdaClient({ region: config.region, - credentials: { - accessKeyId: config.accessKeyId, - secretAccessKey: config.secretAccessKey, - }, + credentials: awsClientCredentials(config.accessKeyId, config.secretAccessKey), }) } diff --git a/apps/sim/lib/internal/rds/client.ts b/apps/sim/lib/internal/rds/client.ts index 683e9a1aee4..bdefbbefe29 100644 --- a/apps/sim/lib/internal/rds/client.ts +++ b/apps/sim/lib/internal/rds/client.ts @@ -5,15 +5,13 @@ import { RDSDataClient, type SqlParameter, } from '@aws-sdk/client-rds-data' +import { awsClientCredentials } from '@/lib/internal/aws/credentials' import type { RdsConnectionConfig } from '@/tools/rds/types' export function createRdsClient(config: RdsConnectionConfig): RDSDataClient { return new RDSDataClient({ region: config.region, - credentials: { - accessKeyId: config.accessKeyId, - secretAccessKey: config.secretAccessKey, - }, + credentials: awsClientCredentials(config.accessKeyId, config.secretAccessKey), }) } diff --git a/apps/sim/lib/internal/s3/client.ts b/apps/sim/lib/internal/s3/client.ts index 95d336d332a..2dfc9f0d156 100644 --- a/apps/sim/lib/internal/s3/client.ts +++ b/apps/sim/lib/internal/s3/client.ts @@ -1,4 +1,5 @@ import { S3Client } from '@aws-sdk/client-s3' +import { awsClientCredentials } from '@/lib/internal/aws/credentials' export interface S3ConnectionConfig { region: string @@ -9,9 +10,6 @@ export interface S3ConnectionConfig { export function createS3Client(config: S3ConnectionConfig): S3Client { return new S3Client({ region: config.region, - credentials: { - accessKeyId: config.accessKeyId, - secretAccessKey: config.secretAccessKey, - }, + credentials: awsClientCredentials(config.accessKeyId, config.secretAccessKey), }) } diff --git a/apps/sim/lib/internal/secrets-manager/client.ts b/apps/sim/lib/internal/secrets-manager/client.ts index 7e3808dc776..6a7dd894497 100644 --- a/apps/sim/lib/internal/secrets-manager/client.ts +++ b/apps/sim/lib/internal/secrets-manager/client.ts @@ -12,6 +12,7 @@ import { UntagResourceCommand, UpdateSecretCommand, } from '@aws-sdk/client-secrets-manager' +import { awsClientCredentials } from '@/lib/internal/aws/credentials' interface SecretsManagerConnectionConfig { region: string @@ -33,10 +34,7 @@ export function createSecretsManagerClient( ): SecretsManagerClient { return new SecretsManagerClient({ region: config.region, - credentials: { - accessKeyId: config.accessKeyId, - secretAccessKey: config.secretAccessKey, - }, + credentials: awsClientCredentials(config.accessKeyId, config.secretAccessKey), }) } diff --git a/apps/sim/lib/internal/ses/client.ts b/apps/sim/lib/internal/ses/client.ts index 8ab4c75bdfa..2fe659913ea 100644 --- a/apps/sim/lib/internal/ses/client.ts +++ b/apps/sim/lib/internal/ses/client.ts @@ -22,6 +22,7 @@ import { UpdateEmailTemplateCommand, } from '@aws-sdk/client-sesv2' import { z } from 'zod' +import { awsClientCredentials } from '@/lib/internal/aws/credentials' import type { SESConnectionConfig } from '@/tools/ses/types' const SesBulkEmailDestinationSchema = z.object({ @@ -34,10 +35,7 @@ type SesBulkEmailDestination = z.infer export function createSESClient(config: SESConnectionConfig): SESv2Client { return new SESv2Client({ region: config.region, - credentials: { - accessKeyId: config.accessKeyId, - secretAccessKey: config.secretAccessKey, - }, + credentials: awsClientCredentials(config.accessKeyId, config.secretAccessKey), }) } diff --git a/apps/sim/lib/internal/sqs/client.ts b/apps/sim/lib/internal/sqs/client.ts index 9c762c0439d..0b549cbaec4 100644 --- a/apps/sim/lib/internal/sqs/client.ts +++ b/apps/sim/lib/internal/sqs/client.ts @@ -1,12 +1,10 @@ import { SQSClient } from '@aws-sdk/client-sqs' +import { awsClientCredentials } from '@/lib/internal/aws/credentials' import type { SqsConnectionConfig } from '@/tools/sqs/types' export function createSqsClient(config: SqsConnectionConfig): SQSClient { return new SQSClient({ region: config.region, - credentials: { - accessKeyId: config.accessKeyId, - secretAccessKey: config.secretAccessKey, - }, + credentials: awsClientCredentials(config.accessKeyId, config.secretAccessKey), }) } diff --git a/apps/sim/lib/internal/ssm/client.ts b/apps/sim/lib/internal/ssm/client.ts index 584708bad35..5f5655559f9 100644 --- a/apps/sim/lib/internal/ssm/client.ts +++ b/apps/sim/lib/internal/ssm/client.ts @@ -63,6 +63,7 @@ import type { AwsSsmPutParameterBody } from '@/lib/api/contracts/tools/aws/ssm-p import type { AwsSsmSendCommandBody } from '@/lib/api/contracts/tools/aws/ssm-send-command' import type { AwsSsmStartAutomationExecutionBody } from '@/lib/api/contracts/tools/aws/ssm-start-automation-execution' import type { AwsSsmStopAutomationExecutionBody } from '@/lib/api/contracts/tools/aws/ssm-stop-automation-execution' +import { awsClientCredentials } from '@/lib/internal/aws/credentials' interface SsmConnectionConfig { region: string @@ -73,10 +74,7 @@ interface SsmConnectionConfig { export function createSsmClient(config: SsmConnectionConfig): SSMClient { return new SSMClient({ region: config.region, - credentials: { - accessKeyId: config.accessKeyId, - secretAccessKey: config.secretAccessKey, - }, + credentials: awsClientCredentials(config.accessKeyId, config.secretAccessKey), }) } diff --git a/apps/sim/lib/internal/sts/client.ts b/apps/sim/lib/internal/sts/client.ts index d5fa70efed9..fe708fddcdf 100644 --- a/apps/sim/lib/internal/sts/client.ts +++ b/apps/sim/lib/internal/sts/client.ts @@ -9,15 +9,13 @@ import { STSClient, type Tag, } from '@aws-sdk/client-sts' +import { awsClientCredentials } from '@/lib/internal/aws/credentials' import type { STSConnectionConfig } from '@/tools/sts/types' export function createSTSClient(config: STSConnectionConfig): STSClient { return new STSClient({ region: config.region, - credentials: { - accessKeyId: config.accessKeyId, - secretAccessKey: config.secretAccessKey, - }, + credentials: awsClientCredentials(config.accessKeyId, config.secretAccessKey), }) } diff --git a/apps/sim/lib/internal/textract/operations.ts b/apps/sim/lib/internal/textract/operations.ts index 84b20566792..ca7141071dd 100644 --- a/apps/sim/lib/internal/textract/operations.ts +++ b/apps/sim/lib/internal/textract/operations.ts @@ -22,6 +22,7 @@ import type { textractParseContract, } from '@/lib/api/contracts/tools/media/document-parse' import { validateOpaqueModelInputProvenance } from '@/lib/execution/model-input-provenance' +import { awsClientCredentials } from '@/lib/internal/aws/credentials' import { parseS3Uri, resolveDocumentInput } from '@/lib/internal/textract/document-input' import { mapTextractSdkError, textractErrorResponse } from '@/lib/internal/textract/errors' import { @@ -84,10 +85,7 @@ function createTextractClient(input: { }): TextractClient { return new TextractClient({ region: input.region, - credentials: { - accessKeyId: input.accessKeyId, - secretAccessKey: input.secretAccessKey, - }, + credentials: awsClientCredentials(input.accessKeyId, input.secretAccessKey), }) } diff --git a/apps/sim/lib/internal/tool-operations/registry.server.ts b/apps/sim/lib/internal/tool-operations/registry.server.ts index 9ea7a6bc921..c23f3d8ff9f 100644 --- a/apps/sim/lib/internal/tool-operations/registry.server.ts +++ b/apps/sim/lib/internal/tool-operations/registry.server.ts @@ -1492,75 +1492,145 @@ function registerFamily( } } +/** + * AWS families also accept a saved AWS credential. The wrapper is a no-op for + * calls without an executor-authorized credential, so inline-key calls reach + * the family handler unchanged. + */ +function awsFamily( + load: () => Promise> +): InternalToolOperationHandlerLoader { + return async () => { + const [{ withAwsCredential }, handler] = await Promise.all([ + import('@/lib/internal/aws/credentials'), + load(), + ]) + return withAwsCredential(handler) + } +} + const handlerLoaders = new Map() registerFamily(handlerLoaders, ASHBY_TOOL_IDS, async () => { return (await import('@/lib/internal/ashby/execute-tool')).executeAshbyTool }) -registerFamily(handlerLoaders, STS_TOOL_IDS, async () => { - return (await import('@/lib/internal/sts/execute-tool')).executeStsTool -}) -registerFamily(handlerLoaders, EC2_TOOL_IDS, async () => { - return (await import('@/lib/internal/ec2/execute-tool')).executeEc2Tool -}) -registerFamily(handlerLoaders, APPCONFIG_TOOL_IDS, async () => { - return (await import('@/lib/internal/appconfig/execute-tool')).executeAppConfigTool -}) -registerFamily(handlerLoaders, IAM_TOOL_IDS, async () => { - return (await import('@/lib/internal/iam/execute-tool')).executeIamTool -}) -registerFamily(handlerLoaders, IDENTITY_CENTER_TOOL_IDS, async () => { - return (await import('@/lib/internal/identity-center/execute-tool')).executeIdentityCenterTool -}) -registerFamily(handlerLoaders, SECRETS_MANAGER_TOOL_IDS, async () => { - return (await import('@/lib/internal/secrets-manager/execute-tool')).executeSecretsManagerTool -}) -registerFamily(handlerLoaders, SSM_TOOL_IDS, async () => { - return (await import('@/lib/internal/ssm/execute-tool')).executeSsmTool -}) -registerFamily(handlerLoaders, DYNAMODB_TOOL_IDS, async () => { - return (await import('@/lib/internal/dynamodb/execute-tool')).executeDynamodbTool -}) -registerFamily(handlerLoaders, SES_TOOL_IDS, async () => { - return (await import('@/lib/internal/ses/execute-tool')).executeSesTool -}) -registerFamily(handlerLoaders, SQS_TOOL_IDS, async () => { - return (await import('@/lib/internal/sqs/execute-tool')).executeSqsTool -}) -registerFamily(handlerLoaders, RDS_TOOL_IDS, async () => { - return (await import('@/lib/internal/rds/execute-tool')).executeRdsTool -}) -registerFamily(handlerLoaders, TEXTRACT_TOOL_IDS, async () => { - return (await import('@/lib/internal/textract/execute-tool')).executeTextractTool -}) -registerFamily(handlerLoaders, CLOUDWATCH_TOOL_IDS, async () => { - return (await import('@/lib/internal/cloudwatch/execute-tool')).executeCloudwatchTool -}) -registerFamily(handlerLoaders, CLOUDTRAIL_TOOL_IDS, async () => { - return (await import('@/lib/internal/cloudtrail/execute-tool')).executeCloudtrailTool -}) +registerFamily( + handlerLoaders, + STS_TOOL_IDS, + awsFamily(async () => (await import('@/lib/internal/sts/execute-tool')).executeStsTool) +) +registerFamily( + handlerLoaders, + EC2_TOOL_IDS, + awsFamily(async () => (await import('@/lib/internal/ec2/execute-tool')).executeEc2Tool) +) +registerFamily( + handlerLoaders, + APPCONFIG_TOOL_IDS, + awsFamily( + async () => (await import('@/lib/internal/appconfig/execute-tool')).executeAppConfigTool + ) +) +registerFamily( + handlerLoaders, + IAM_TOOL_IDS, + awsFamily(async () => (await import('@/lib/internal/iam/execute-tool')).executeIamTool) +) +registerFamily( + handlerLoaders, + IDENTITY_CENTER_TOOL_IDS, + awsFamily( + async () => + (await import('@/lib/internal/identity-center/execute-tool')).executeIdentityCenterTool + ) +) +registerFamily( + handlerLoaders, + SECRETS_MANAGER_TOOL_IDS, + awsFamily( + async () => + (await import('@/lib/internal/secrets-manager/execute-tool')).executeSecretsManagerTool + ) +) +registerFamily( + handlerLoaders, + SSM_TOOL_IDS, + awsFamily(async () => (await import('@/lib/internal/ssm/execute-tool')).executeSsmTool) +) +registerFamily( + handlerLoaders, + DYNAMODB_TOOL_IDS, + awsFamily(async () => (await import('@/lib/internal/dynamodb/execute-tool')).executeDynamodbTool) +) +registerFamily( + handlerLoaders, + SES_TOOL_IDS, + awsFamily(async () => (await import('@/lib/internal/ses/execute-tool')).executeSesTool) +) +registerFamily( + handlerLoaders, + SQS_TOOL_IDS, + awsFamily(async () => (await import('@/lib/internal/sqs/execute-tool')).executeSqsTool) +) +registerFamily( + handlerLoaders, + RDS_TOOL_IDS, + awsFamily(async () => (await import('@/lib/internal/rds/execute-tool')).executeRdsTool) +) +registerFamily( + handlerLoaders, + TEXTRACT_TOOL_IDS, + awsFamily(async () => (await import('@/lib/internal/textract/execute-tool')).executeTextractTool) +) +registerFamily( + handlerLoaders, + CLOUDWATCH_TOOL_IDS, + awsFamily( + async () => (await import('@/lib/internal/cloudwatch/execute-tool')).executeCloudwatchTool + ) +) +registerFamily( + handlerLoaders, + CLOUDTRAIL_TOOL_IDS, + awsFamily( + async () => (await import('@/lib/internal/cloudtrail/execute-tool')).executeCloudtrailTool + ) +) registerFamily(handlerLoaders, POSTGRESQL_TOOL_IDS, async () => { return (await import('@/lib/internal/postgresql/execute-tool')).executePostgresqlTool }) registerFamily(handlerLoaders, REDIS_TOOL_IDS, async () => { return (await import('@/lib/internal/redis/execute-tool')).executeRedisTool }) -registerFamily(handlerLoaders, CLOUDFORMATION_TOOL_IDS, async () => { - return (await import('@/lib/internal/cloudformation/execute-tool')).executeCloudformationTool -}) -registerFamily(handlerLoaders, LAMBDA_TOOL_IDS, async () => { - return (await import('@/lib/internal/lambda/execute-tool')).executeLambdaTool -}) -registerFamily(handlerLoaders, CODEPIPELINE_TOOL_IDS, async () => { - return (await import('@/lib/internal/codepipeline/execute-tool')).executeCodepipelineTool -}) +registerFamily( + handlerLoaders, + CLOUDFORMATION_TOOL_IDS, + awsFamily( + async () => + (await import('@/lib/internal/cloudformation/execute-tool')).executeCloudformationTool + ) +) +registerFamily( + handlerLoaders, + LAMBDA_TOOL_IDS, + awsFamily(async () => (await import('@/lib/internal/lambda/execute-tool')).executeLambdaTool) +) +registerFamily( + handlerLoaders, + CODEPIPELINE_TOOL_IDS, + awsFamily( + async () => (await import('@/lib/internal/codepipeline/execute-tool')).executeCodepipelineTool + ) +) registerFamily(handlerLoaders, MYSQL_TOOL_IDS, async () => { return (await import('@/lib/internal/mysql/execute-tool')).executeMysqlTool }) -registerFamily(handlerLoaders, ATHENA_TOOL_IDS, async () => { - return (await import('@/lib/internal/athena/execute-tool')).executeAthenaTool -}) +registerFamily( + handlerLoaders, + ATHENA_TOOL_IDS, + awsFamily(async () => (await import('@/lib/internal/athena/execute-tool')).executeAthenaTool) +) registerFamily(handlerLoaders, CLICKHOUSE_TOOL_IDS, async () => { return (await import('@/lib/internal/clickhouse/execute-tool')).executeClickHouseTool }) @@ -1570,9 +1640,11 @@ registerFamily(handlerLoaders, MONGODB_TOOL_IDS, async () => { registerFamily(handlerLoaders, NEO4J_TOOL_IDS, async () => { return (await import('@/lib/internal/neo4j/execute-tool')).executeNeo4jTool }) -registerFamily(handlerLoaders, S3_TOOL_IDS, async () => { - return (await import('@/lib/internal/s3/execute-tool')).executeS3Tool -}) +registerFamily( + handlerLoaders, + S3_TOOL_IDS, + awsFamily(async () => (await import('@/lib/internal/s3/execute-tool')).executeS3Tool) +) registerFamily(handlerLoaders, JUPYTER_TOOL_IDS, async () => { return (await import('@/lib/internal/jupyter/execute-tool')).executeJupyterTool }) diff --git a/apps/sim/lib/internal/tool-operations/types.ts b/apps/sim/lib/internal/tool-operations/types.ts index 9a6db19cab7..40be6fc16a9 100644 --- a/apps/sim/lib/internal/tool-operations/types.ts +++ b/apps/sim/lib/internal/tool-operations/types.ts @@ -20,6 +20,12 @@ export interface InternalToolOperationContext { executionId?: string userId?: string executorDelegationOrigin?: ExecutorDelegationOrigin + /** + * A saved AWS credential the executor already authorized for this call. + * Set only from executor-resolved credential state, never from tool input; + * AWS operations resolve it to session credentials server-side. + */ + authorizedAwsCredentialId?: string /** Trusted source block for saved MCP operation restrictions. */ mcpBlockId?: string /** diff --git a/apps/sim/lib/mothership/generated/docs-manifest.ts b/apps/sim/lib/mothership/generated/docs-manifest.ts index ed16aa37ae6..ac5992e9c3a 100644 --- a/apps/sim/lib/mothership/generated/docs-manifest.ts +++ b/apps/sim/lib/mothership/generated/docs-manifest.ts @@ -89,6 +89,7 @@ export const DOCS_MANIFEST: readonly string[] = [ 'integrations/atlassian-service-account.mdx', 'integrations/attio-service-account.mdx', 'integrations/attio.mdx', + 'integrations/aws-credentials.mdx', 'integrations/azure_data_explorer.mdx', 'integrations/azure_devops.mdx', 'integrations/bitbucket.mdx', @@ -123,6 +124,7 @@ export const DOCS_MANIFEST: readonly string[] = [ 'integrations/crunchbase.mdx', 'integrations/cursor.mdx', 'integrations/dagster.mdx', + 'integrations/databricks-credentials.mdx', 'integrations/databricks.mdx', 'integrations/datadog.mdx', 'integrations/datagma.mdx', diff --git a/apps/sim/lib/oauth/credential-service.ts b/apps/sim/lib/oauth/credential-service.ts index a203379ecd1..96f0cde0004 100644 --- a/apps/sim/lib/oauth/credential-service.ts +++ b/apps/sim/lib/oauth/credential-service.ts @@ -68,6 +68,8 @@ import { getRecentTerminalError, markCredentialDead } from '@/lib/oauth/terminal import { ATLASSIAN_SERVICE_ACCOUNT_PROVIDER_ID, ATLASSIAN_SERVICE_ACCOUNT_SECRET_TYPE, + AWS_SERVICE_ACCOUNT_PROVIDER_ID, + DATABRICKS_SERVICE_ACCOUNT_PROVIDER_ID, GOOGLE_SERVICE_ACCOUNT_PROVIDER_ID, OCI_API_KEY_SERVICE_ACCOUNT_PROVIDER_ID, ORACLE_DATABASE_SERVICE_ACCOUNT_PROVIDER_ID, @@ -733,6 +735,15 @@ type ServiceAccountTokenResolver = ( * generically: the stored token IS the access token. */ const SERVICE_ACCOUNT_TOKEN_RESOLVERS: Record = { + [AWS_SERVICE_ACCOUNT_PROVIDER_ID]: async (credentialId) => ({ + accessToken: credentialId, + }), + [DATABRICKS_SERVICE_ACCOUNT_PROVIDER_ID]: async (credentialId) => { + const { resolveDatabricksCredentialToken } = await import( + '@/lib/credentials/databricks-service-account.server' + ) + return resolveDatabricksCredentialToken(credentialId) + }, [ORACLE_DATABASE_SERVICE_ACCOUNT_PROVIDER_ID]: async (credentialId) => ({ accessToken: credentialId, }), diff --git a/apps/sim/lib/oauth/oauth.ts b/apps/sim/lib/oauth/oauth.ts index 11a61b87361..60550d2548d 100644 --- a/apps/sim/lib/oauth/oauth.ts +++ b/apps/sim/lib/oauth/oauth.ts @@ -18,6 +18,7 @@ import { ClickUpIcon, CodaIcon, ConfluenceIcon, + DatabricksIcon, DocuSignIcon, DropboxIcon, FivetranIcon, @@ -44,6 +45,7 @@ import { HelpScoutIcon, HiggsfieldIcon, HubspotIcon, + IAMIcon, InstagramIcon, IntuneIcon, JamaIcon, @@ -1180,6 +1182,42 @@ export const OAUTH_PROVIDERS: Record = { }, defaultService: 'netsuite', }, + aws: { + name: 'AWS', + icon: IAMIcon, + services: { + aws: { + name: 'AWS', + description: + 'Use AWS services with saved access keys, an assumed IAM role, or a keyless role trusted through Sim OIDC.', + providerId: 'aws', + serviceAccountProviderId: 'aws-service-account', + authType: 'service_account', + icon: IAMIcon, + baseProviderIcon: IAMIcon, + scopes: [], + }, + }, + defaultService: 'aws', + }, + databricks: { + name: 'Databricks', + icon: DatabricksIcon, + services: { + databricks: { + name: 'Databricks', + description: + 'Use Databricks with a personal access token, a service principal secret, or a keyless service principal trusted through Sim OIDC.', + providerId: 'databricks', + serviceAccountProviderId: 'databricks-service-account', + authType: 'service_account', + icon: DatabricksIcon, + baseProviderIcon: DatabricksIcon, + scopes: [], + }, + }, + defaultService: 'databricks', + }, oracledb: { name: 'Oracle Database', icon: OracleIcon, diff --git a/apps/sim/lib/oauth/token-resolution.test.ts b/apps/sim/lib/oauth/token-resolution.test.ts index bf8351da1a8..f7f654dcaa0 100644 --- a/apps/sim/lib/oauth/token-resolution.test.ts +++ b/apps/sim/lib/oauth/token-resolution.test.ts @@ -475,6 +475,50 @@ describe('ordinary tool credential binding', () => { } ) + describe('hybrid tools (inline secrets or an optional saved credential)', () => { + beforeEach(() => { + mockGetToolMetadata.mockReturnValue({ + id: 'dynamodb_get', + params: {}, + oauth: { required: false, provider: 'aws', credentialKind: 'service-account' }, + }) + }) + + it('resolves a saved credential of the tool provider', async () => { + mockResolveOAuthAccountId.mockResolvedValue({ + ...serviceAccount, + providerId: 'aws-service-account', + }) + const result = await resolveCredentialAccessToken({ + requestId: 'binding-test', + credentialId: 'credential-1', + toolId: 'dynamodb_get', + authenticate, + }) + expect(result).toMatchObject({ ok: true }) + expect(mockResolveServiceAccountToken).toHaveBeenCalled() + }) + + it.each(['oracle-fusion-service-account', 'databricks-service-account', 'unknown-provider'])( + 'still rejects an authorized %s credential', + async (providerId) => { + mockResolveOAuthAccountId.mockResolvedValue({ ...serviceAccount, providerId }) + const result = await resolveCredentialAccessToken({ + requestId: 'binding-test', + credentialId: 'credential-1', + toolId: 'dynamodb_get', + authenticate, + }) + expect(result).toMatchObject({ + ok: false, + status: 400, + code: 'CREDENTIAL_PROVIDER_MISMATCH', + }) + expect(mockResolveServiceAccountToken).not.toHaveBeenCalled() + } + ) + }) + it('does not reveal provider mismatch to an unauthorized caller', async () => { mockResolveOAuthAccountId.mockResolvedValue({ ...serviceAccount, providerId: 'vanta' }) mockAuthorizeCredentialUseForAuth.mockResolvedValue({ ok: false, error: 'Unauthorized' }) diff --git a/apps/sim/lib/oauth/token-resolution.ts b/apps/sim/lib/oauth/token-resolution.ts index 74e41788ed8..234f98e741d 100644 --- a/apps/sim/lib/oauth/token-resolution.ts +++ b/apps/sim/lib/oauth/token-resolution.ts @@ -292,7 +292,12 @@ function validateToolCredentialBinding( const policy = getToolMetadata(toolId)?.oauth const kindError = validateToolCredentialKind(policy?.credentialKind, credentialKind) if (kindError) return kindError - const service = policy?.required + /** + * A tool binds a credential through its declared provider. `required: false` + * marks a hybrid tool (inline keys or a saved credential) — the credential is + * optional, but when one is supplied it must still belong to that provider. + */ + const service = policy ? (getServiceConfigByServiceId(policy.provider) ?? getServiceConfigByProviderId(policy.provider)) : undefined diff --git a/apps/sim/lib/oauth/types.ts b/apps/sim/lib/oauth/types.ts index d180765d17d..c2730fd13c2 100644 --- a/apps/sim/lib/oauth/types.ts +++ b/apps/sim/lib/oauth/types.ts @@ -42,7 +42,15 @@ export const SLACK_CUSTOM_BOT_SECRET_TYPE = 'slack_custom_bot' as const export const ORACLE_DATABASE_SERVICE_ACCOUNT_PROVIDER_ID = 'oracledb-service-account' as const +/** Saved AWS identity (access keys, an assumed role, or a keyless OIDC role) shared by every AWS block. */ +export const AWS_SERVICE_ACCOUNT_PROVIDER_ID = 'aws-service-account' as const + +/** Saved Databricks connection (PAT, service-principal secret, or keyless OIDC federation). */ +export const DATABRICKS_SERVICE_ACCOUNT_PROVIDER_ID = 'databricks-service-account' as const + export type OAuthProvider = + | 'aws' + | 'databricks' | 'oracledb' | 'oracle-epm' | 'oracle-fusion' @@ -120,6 +128,8 @@ export type OAuthProvider = | 'zoho-desk' export type OAuthService = + | 'aws' + | 'databricks' | 'jama' | 'flow' | 'oracledb' diff --git a/apps/sim/proxy.ts b/apps/sim/proxy.ts index 2ef79f36f36..685fc0d22c5 100644 --- a/apps/sim/proxy.ts +++ b/apps/sim/proxy.ts @@ -308,7 +308,8 @@ function handleSecurityFiltering(request: NextRequest): NextResponse | null { pathname.startsWith('/.well-known/oauth-authorization-server') || pathname.startsWith('/.well-known/oauth-protected-resource') || pathname === '/.well-known/openai-apps-challenge' || - pathname === '/.well-known/api-catalog' + pathname === '/.well-known/api-catalog' || + pathname.startsWith('/oidc/workload/') const isSuspicious = SUSPICIOUS_UA_PATTERNS.some((pattern) => pattern.test(userAgent)) // Block suspicious requests, but exempt machine-to-machine endpoints that may diff --git a/apps/sim/serializer/saved-credentials.test.ts b/apps/sim/serializer/saved-credentials.test.ts new file mode 100644 index 00000000000..2840bfddc1f --- /dev/null +++ b/apps/sim/serializer/saved-credentials.test.ts @@ -0,0 +1,141 @@ +import { createBlock } from '@sim/testing/factories/block.factory' +import { blocksMock } from '@sim/testing/mocks/blocks.mock' +import { getErrorMessage } from '@sim/utils/errors' +import { beforeEach, describe, expect, it, vi } from 'vitest' +import * as blocks from '@/blocks' +import { AppConfigBlock } from '@/blocks/blocks/appconfig' +import { AthenaBlock } from '@/blocks/blocks/athena' +import { CloudFormationBlock } from '@/blocks/blocks/cloudformation' +import { CloudTrailBlock } from '@/blocks/blocks/cloudtrail' +import { CloudWatchBlock } from '@/blocks/blocks/cloudwatch' +import { CodePipelineBlock } from '@/blocks/blocks/codepipeline' +import { DatabricksBlock } from '@/blocks/blocks/databricks' +import { DynamoDBBlock } from '@/blocks/blocks/dynamodb' +import { EC2Block } from '@/blocks/blocks/ec2' +import { IAMBlock } from '@/blocks/blocks/iam' +import { IdentityCenterBlock } from '@/blocks/blocks/identity_center' +import { LambdaBlock } from '@/blocks/blocks/lambda' +import { RDSBlock } from '@/blocks/blocks/rds' +import { S3Block } from '@/blocks/blocks/s3' +import { SecretsManagerBlock } from '@/blocks/blocks/secrets_manager' +import { SESBlock } from '@/blocks/blocks/ses' +import { SQSBlock } from '@/blocks/blocks/sqs' +import { SSMBlock } from '@/blocks/blocks/ssm' +import { STSBlock } from '@/blocks/blocks/sts' +import { TextractBlock, TextractV2Block } from '@/blocks/blocks/textract' +import type { BlockConfig } from '@/blocks/types' +import { Serializer } from '@/serializer' +import type { BlockState } from '@/stores/workflows/workflow/types' + +vi.mock('@/blocks', () => blocksMock) + +/** + * Blocks that accept a saved credential while keeping their inline secret + * fields. The contract every one of them must keep: a block saved before the + * credential option existed — inline secrets, no credential — serializes and + * validates exactly as it always did. + */ +const HYBRID_BLOCKS: Array<{ block: BlockConfig; secretIds: [string, string] }> = [ + { block: AppConfigBlock, secretIds: ['accessKeyId', 'secretAccessKey'] }, + { block: AthenaBlock, secretIds: ['awsAccessKeyId', 'awsSecretAccessKey'] }, + { block: CloudFormationBlock, secretIds: ['awsAccessKeyId', 'awsSecretAccessKey'] }, + { block: CloudTrailBlock, secretIds: ['awsAccessKeyId', 'awsSecretAccessKey'] }, + { block: CloudWatchBlock, secretIds: ['awsAccessKeyId', 'awsSecretAccessKey'] }, + { block: CodePipelineBlock, secretIds: ['awsAccessKeyId', 'awsSecretAccessKey'] }, + { block: DynamoDBBlock, secretIds: ['accessKeyId', 'secretAccessKey'] }, + { block: EC2Block, secretIds: ['awsAccessKeyId', 'awsSecretAccessKey'] }, + { block: IAMBlock, secretIds: ['accessKeyId', 'secretAccessKey'] }, + { block: IdentityCenterBlock, secretIds: ['accessKeyId', 'secretAccessKey'] }, + { block: LambdaBlock, secretIds: ['awsAccessKeyId', 'awsSecretAccessKey'] }, + { block: RDSBlock, secretIds: ['accessKeyId', 'secretAccessKey'] }, + { block: S3Block, secretIds: ['accessKeyId', 'secretAccessKey'] }, + { block: SecretsManagerBlock, secretIds: ['accessKeyId', 'secretAccessKey'] }, + { block: SESBlock, secretIds: ['accessKeyId', 'secretAccessKey'] }, + { block: SQSBlock, secretIds: ['accessKeyId', 'secretAccessKey'] }, + { block: SSMBlock, secretIds: ['accessKeyId', 'secretAccessKey'] }, + { block: STSBlock, secretIds: ['accessKeyId', 'secretAccessKey'] }, + { block: TextractBlock, secretIds: ['accessKeyId', 'secretAccessKey'] }, + { block: TextractV2Block, secretIds: ['accessKeyId', 'secretAccessKey'] }, + { block: DatabricksBlock, secretIds: ['host', 'apiKey'] }, +] + +function firstOperation(config: BlockConfig): string | undefined { + const operation = config.subBlocks.find((subBlock) => subBlock.id === 'operation') + const options = + typeof operation?.options === 'function' ? operation.options() : operation?.options + return options?.[0]?.id +} + +function secretTitles(config: BlockConfig, ids: readonly string[]): string[] { + return config.subBlocks + .filter((subBlock) => ids.includes(subBlock.id)) + .map((subBlock) => subBlock.title ?? subBlock.id) +} + +function buildBlock(config: BlockConfig, values: Record): BlockState { + const operation = firstOperation(config) + const all: Record = { ...(operation ? { operation } : {}), ...values } + return createBlock({ + type: config.type, + name: config.name, + subBlocks: Object.fromEntries( + Object.entries(all).map(([id, value]) => [id, { id, type: 'short-input', value }]) + ), + }) +} + +function serialize(block: BlockState) { + return new Serializer().serializeWorkflow({ [block.id]: block }, [], {}, {}, false).blocks[0] + .config.params +} + +function missingRequiredFields(block: BlockState): string { + try { + new Serializer().serializeWorkflow({ [block.id]: block }, [], {}, {}, true) + return '' + } catch (error) { + return getErrorMessage(error, String(error)) + } +} + +describe.each(HYBRID_BLOCKS)('$block.type saved-credential hybrid', ({ block, secretIds }) => { + beforeEach(() => { + vi.spyOn(blocks, 'getBlock').mockReturnValue(block) + }) + + it('serializes a block saved with inline secrets exactly as before', () => { + const params = serialize( + buildBlock(block, { [secretIds[0]]: 'inline-one', [secretIds[1]]: 'inline-two' }) + ) + + expect(params[secretIds[0]]).toBe('inline-one') + expect(params[secretIds[1]]).toBe('inline-two') + expect(params.oauthCredential).toBeUndefined() + }) + + it('still requires the inline secrets when no saved credential is selected', () => { + const message = missingRequiredFields(buildBlock(block, {})) + + for (const title of secretTitles(block, secretIds)) expect(message).toContain(title) + }) + + it('stops requiring the inline secrets once a saved credential is selected', () => { + const message = missingRequiredFields(buildBlock(block, { credential: 'cred-1' })) + + for (const title of secretTitles(block, secretIds)) expect(message).not.toContain(title) + }) + + it('uses the saved credential instead of stale inline secrets', () => { + const params = serialize( + buildBlock(block, { + credential: 'cred-1', + [secretIds[0]]: 'stale-one', + [secretIds[1]]: 'stale-two', + }) + ) + + expect(params.oauthCredential).toBe('cred-1') + expect(params[secretIds[0]]).toBeUndefined() + expect(params[secretIds[1]]).toBeUndefined() + }) +}) diff --git a/apps/sim/tools/appconfig/create_application.ts b/apps/sim/tools/appconfig/create_application.ts index d07ff10acd1..359f952d7de 100644 --- a/apps/sim/tools/appconfig/create_application.ts +++ b/apps/sim/tools/appconfig/create_application.ts @@ -2,6 +2,7 @@ import type { AppConfigCreateApplicationParams, AppConfigCreateApplicationResponse, } from '@/tools/appconfig/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const createApplicationTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const createApplicationTool: InternalToolConfig< name: 'AppConfig Create Application', description: 'Create an application in AWS AppConfig', version: '1.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { region: { diff --git a/apps/sim/tools/appconfig/create_configuration_profile.ts b/apps/sim/tools/appconfig/create_configuration_profile.ts index 83e109c5c3b..155cee62bca 100644 --- a/apps/sim/tools/appconfig/create_configuration_profile.ts +++ b/apps/sim/tools/appconfig/create_configuration_profile.ts @@ -2,6 +2,7 @@ import type { AppConfigCreateConfigurationProfileParams, AppConfigCreateConfigurationProfileResponse, } from '@/tools/appconfig/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const createConfigurationProfileTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const createConfigurationProfileTool: InternalToolConfig< name: 'AppConfig Create Configuration Profile', description: 'Create a configuration profile in an AWS AppConfig application', version: '1.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { region: { diff --git a/apps/sim/tools/appconfig/create_environment.ts b/apps/sim/tools/appconfig/create_environment.ts index 9e9cb0086fe..c6497fc3a54 100644 --- a/apps/sim/tools/appconfig/create_environment.ts +++ b/apps/sim/tools/appconfig/create_environment.ts @@ -2,6 +2,7 @@ import type { AppConfigCreateEnvironmentParams, AppConfigCreateEnvironmentResponse, } from '@/tools/appconfig/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const createEnvironmentTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const createEnvironmentTool: InternalToolConfig< name: 'AppConfig Create Environment', description: 'Create an environment for an AWS AppConfig application', version: '1.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { region: { diff --git a/apps/sim/tools/appconfig/create_hosted_configuration_version.ts b/apps/sim/tools/appconfig/create_hosted_configuration_version.ts index 6c464950f4b..f32ca3d6259 100644 --- a/apps/sim/tools/appconfig/create_hosted_configuration_version.ts +++ b/apps/sim/tools/appconfig/create_hosted_configuration_version.ts @@ -2,6 +2,7 @@ import type { AppConfigCreateHostedConfigurationVersionParams, AppConfigCreateHostedConfigurationVersionResponse, } from '@/tools/appconfig/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const createHostedConfigurationVersionTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const createHostedConfigurationVersionTool: InternalToolConfig< name: 'AppConfig Create Hosted Configuration Version', description: 'Create a new hosted configuration version for an AppConfig configuration profile', version: '1.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { region: { diff --git a/apps/sim/tools/appconfig/delete_application.ts b/apps/sim/tools/appconfig/delete_application.ts index 6942b51ab58..e8a46c51880 100644 --- a/apps/sim/tools/appconfig/delete_application.ts +++ b/apps/sim/tools/appconfig/delete_application.ts @@ -2,6 +2,7 @@ import type { AppConfigDeleteApplicationParams, AppConfigDeleteResourceResponse, } from '@/tools/appconfig/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const deleteApplicationTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const deleteApplicationTool: InternalToolConfig< name: 'AppConfig Delete Application', description: 'Delete an AWS AppConfig application', version: '1.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { region: { diff --git a/apps/sim/tools/appconfig/delete_configuration_profile.ts b/apps/sim/tools/appconfig/delete_configuration_profile.ts index 4e9bdfd533a..60630d4a580 100644 --- a/apps/sim/tools/appconfig/delete_configuration_profile.ts +++ b/apps/sim/tools/appconfig/delete_configuration_profile.ts @@ -2,6 +2,7 @@ import type { AppConfigDeleteConfigurationProfileParams, AppConfigDeleteResourceResponse, } from '@/tools/appconfig/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const deleteConfigurationProfileTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const deleteConfigurationProfileTool: InternalToolConfig< name: 'AppConfig Delete Configuration Profile', description: 'Delete an AWS AppConfig configuration profile', version: '1.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { region: { diff --git a/apps/sim/tools/appconfig/delete_environment.ts b/apps/sim/tools/appconfig/delete_environment.ts index 860e614f063..bc6a5465d4c 100644 --- a/apps/sim/tools/appconfig/delete_environment.ts +++ b/apps/sim/tools/appconfig/delete_environment.ts @@ -2,6 +2,7 @@ import type { AppConfigDeleteEnvironmentParams, AppConfigDeleteResourceResponse, } from '@/tools/appconfig/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const deleteEnvironmentTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const deleteEnvironmentTool: InternalToolConfig< name: 'AppConfig Delete Environment', description: 'Delete an AWS AppConfig environment', version: '1.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { region: { diff --git a/apps/sim/tools/appconfig/delete_hosted_configuration_version.ts b/apps/sim/tools/appconfig/delete_hosted_configuration_version.ts index a6c58dd241b..ae9b34a6b7a 100644 --- a/apps/sim/tools/appconfig/delete_hosted_configuration_version.ts +++ b/apps/sim/tools/appconfig/delete_hosted_configuration_version.ts @@ -2,6 +2,7 @@ import type { AppConfigDeleteHostedConfigurationVersionParams, AppConfigDeleteHostedConfigurationVersionResponse, } from '@/tools/appconfig/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const deleteHostedConfigurationVersionTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const deleteHostedConfigurationVersionTool: InternalToolConfig< name: 'AppConfig Delete Hosted Configuration Version', description: 'Delete a specific hosted configuration version from an AppConfig profile', version: '1.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { region: { diff --git a/apps/sim/tools/appconfig/get_application.ts b/apps/sim/tools/appconfig/get_application.ts index 92f70ffd4de..a89f2211eb4 100644 --- a/apps/sim/tools/appconfig/get_application.ts +++ b/apps/sim/tools/appconfig/get_application.ts @@ -2,6 +2,7 @@ import type { AppConfigGetApplicationParams, AppConfigGetApplicationResponse, } from '@/tools/appconfig/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const getApplicationTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const getApplicationTool: InternalToolConfig< name: 'AppConfig Get Application', description: 'Get details about a single AWS AppConfig application', version: '1.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { region: { diff --git a/apps/sim/tools/appconfig/get_configuration.ts b/apps/sim/tools/appconfig/get_configuration.ts index dae8c617f4f..b96bc4f3990 100644 --- a/apps/sim/tools/appconfig/get_configuration.ts +++ b/apps/sim/tools/appconfig/get_configuration.ts @@ -2,6 +2,7 @@ import type { AppConfigGetConfigurationParams, AppConfigGetConfigurationResponse, } from '@/tools/appconfig/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const getConfigurationTool: InternalToolConfig< @@ -13,6 +14,7 @@ export const getConfigurationTool: InternalToolConfig< description: 'Retrieve the latest deployed configuration for an AppConfig application, environment, and profile', version: '1.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { region: { diff --git a/apps/sim/tools/appconfig/get_configuration_profile.ts b/apps/sim/tools/appconfig/get_configuration_profile.ts index 6733d34dbda..31e8a968536 100644 --- a/apps/sim/tools/appconfig/get_configuration_profile.ts +++ b/apps/sim/tools/appconfig/get_configuration_profile.ts @@ -2,6 +2,7 @@ import type { AppConfigGetConfigurationProfileParams, AppConfigGetConfigurationProfileResponse, } from '@/tools/appconfig/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const getConfigurationProfileTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const getConfigurationProfileTool: InternalToolConfig< name: 'AppConfig Get Configuration Profile', description: 'Get details about a single AWS AppConfig configuration profile', version: '1.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { region: { diff --git a/apps/sim/tools/appconfig/get_deployment.ts b/apps/sim/tools/appconfig/get_deployment.ts index 2e0a812753b..d4049f08b50 100644 --- a/apps/sim/tools/appconfig/get_deployment.ts +++ b/apps/sim/tools/appconfig/get_deployment.ts @@ -2,6 +2,7 @@ import type { AppConfigGetDeploymentParams, AppConfigGetDeploymentResponse, } from '@/tools/appconfig/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const getDeploymentTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const getDeploymentTool: InternalToolConfig< name: 'AppConfig Get Deployment', description: 'Get details about a specific AWS AppConfig deployment', version: '1.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { region: { diff --git a/apps/sim/tools/appconfig/get_environment.ts b/apps/sim/tools/appconfig/get_environment.ts index 2f6ffc5a4be..47760695fa6 100644 --- a/apps/sim/tools/appconfig/get_environment.ts +++ b/apps/sim/tools/appconfig/get_environment.ts @@ -2,6 +2,7 @@ import type { AppConfigGetEnvironmentParams, AppConfigGetEnvironmentResponse, } from '@/tools/appconfig/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const getEnvironmentTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const getEnvironmentTool: InternalToolConfig< name: 'AppConfig Get Environment', description: 'Get details about a single AWS AppConfig environment', version: '1.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { region: { diff --git a/apps/sim/tools/appconfig/get_hosted_configuration_version.ts b/apps/sim/tools/appconfig/get_hosted_configuration_version.ts index 385d070b54b..5ddea301473 100644 --- a/apps/sim/tools/appconfig/get_hosted_configuration_version.ts +++ b/apps/sim/tools/appconfig/get_hosted_configuration_version.ts @@ -2,6 +2,7 @@ import type { AppConfigGetHostedConfigurationVersionParams, AppConfigGetHostedConfigurationVersionResponse, } from '@/tools/appconfig/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const getHostedConfigurationVersionTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const getHostedConfigurationVersionTool: InternalToolConfig< name: 'AppConfig Get Hosted Configuration Version', description: 'Retrieve a specific hosted configuration version from an AppConfig profile', version: '1.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { region: { diff --git a/apps/sim/tools/appconfig/list_applications.ts b/apps/sim/tools/appconfig/list_applications.ts index e80f5516814..98fa9fad840 100644 --- a/apps/sim/tools/appconfig/list_applications.ts +++ b/apps/sim/tools/appconfig/list_applications.ts @@ -2,6 +2,7 @@ import type { AppConfigListApplicationsParams, AppConfigListApplicationsResponse, } from '@/tools/appconfig/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const listApplicationsTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const listApplicationsTool: InternalToolConfig< name: 'AppConfig List Applications', description: 'List applications in AWS AppConfig', version: '1.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { region: { diff --git a/apps/sim/tools/appconfig/list_configuration_profiles.ts b/apps/sim/tools/appconfig/list_configuration_profiles.ts index e6c4ba37244..1c2bff56320 100644 --- a/apps/sim/tools/appconfig/list_configuration_profiles.ts +++ b/apps/sim/tools/appconfig/list_configuration_profiles.ts @@ -2,6 +2,7 @@ import type { AppConfigListConfigurationProfilesParams, AppConfigListConfigurationProfilesResponse, } from '@/tools/appconfig/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const listConfigurationProfilesTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const listConfigurationProfilesTool: InternalToolConfig< name: 'AppConfig List Configuration Profiles', description: 'List configuration profiles for an AWS AppConfig application', version: '1.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { region: { diff --git a/apps/sim/tools/appconfig/list_deployment_strategies.ts b/apps/sim/tools/appconfig/list_deployment_strategies.ts index 46676aef005..9ef0ca06e05 100644 --- a/apps/sim/tools/appconfig/list_deployment_strategies.ts +++ b/apps/sim/tools/appconfig/list_deployment_strategies.ts @@ -2,6 +2,7 @@ import type { AppConfigListDeploymentStrategiesParams, AppConfigListDeploymentStrategiesResponse, } from '@/tools/appconfig/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const listDeploymentStrategiesTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const listDeploymentStrategiesTool: InternalToolConfig< name: 'AppConfig List Deployment Strategies', description: 'List deployment strategies available in AWS AppConfig', version: '1.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { region: { diff --git a/apps/sim/tools/appconfig/list_deployments.ts b/apps/sim/tools/appconfig/list_deployments.ts index 4dd20e1797a..4f71c85456a 100644 --- a/apps/sim/tools/appconfig/list_deployments.ts +++ b/apps/sim/tools/appconfig/list_deployments.ts @@ -2,6 +2,7 @@ import type { AppConfigListDeploymentsParams, AppConfigListDeploymentsResponse, } from '@/tools/appconfig/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const listDeploymentsTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const listDeploymentsTool: InternalToolConfig< name: 'AppConfig List Deployments', description: 'List deployments for an AWS AppConfig environment', version: '1.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { region: { diff --git a/apps/sim/tools/appconfig/list_environments.ts b/apps/sim/tools/appconfig/list_environments.ts index 8b71befd69e..df521dac423 100644 --- a/apps/sim/tools/appconfig/list_environments.ts +++ b/apps/sim/tools/appconfig/list_environments.ts @@ -2,6 +2,7 @@ import type { AppConfigListEnvironmentsParams, AppConfigListEnvironmentsResponse, } from '@/tools/appconfig/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const listEnvironmentsTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const listEnvironmentsTool: InternalToolConfig< name: 'AppConfig List Environments', description: 'List environments for an AWS AppConfig application', version: '1.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { region: { diff --git a/apps/sim/tools/appconfig/list_hosted_configuration_versions.ts b/apps/sim/tools/appconfig/list_hosted_configuration_versions.ts index e9366997551..ffcaed30219 100644 --- a/apps/sim/tools/appconfig/list_hosted_configuration_versions.ts +++ b/apps/sim/tools/appconfig/list_hosted_configuration_versions.ts @@ -2,6 +2,7 @@ import type { AppConfigListHostedConfigurationVersionsParams, AppConfigListHostedConfigurationVersionsResponse, } from '@/tools/appconfig/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const listHostedConfigurationVersionsTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const listHostedConfigurationVersionsTool: InternalToolConfig< name: 'AppConfig List Hosted Configuration Versions', description: 'List hosted configuration versions for an AWS AppConfig configuration profile', version: '1.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { region: { diff --git a/apps/sim/tools/appconfig/start_deployment.ts b/apps/sim/tools/appconfig/start_deployment.ts index 8eb431f6f7a..0a12a4001b2 100644 --- a/apps/sim/tools/appconfig/start_deployment.ts +++ b/apps/sim/tools/appconfig/start_deployment.ts @@ -2,6 +2,7 @@ import type { AppConfigStartDeploymentParams, AppConfigStartDeploymentResponse, } from '@/tools/appconfig/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const startDeploymentTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const startDeploymentTool: InternalToolConfig< name: 'AppConfig Start Deployment', description: 'Start deploying a configuration version to an AWS AppConfig environment', version: '1.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { region: { diff --git a/apps/sim/tools/appconfig/stop_deployment.ts b/apps/sim/tools/appconfig/stop_deployment.ts index 59e844416de..31229878785 100644 --- a/apps/sim/tools/appconfig/stop_deployment.ts +++ b/apps/sim/tools/appconfig/stop_deployment.ts @@ -2,6 +2,7 @@ import type { AppConfigStopDeploymentParams, AppConfigStopDeploymentResponse, } from '@/tools/appconfig/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const stopDeploymentTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const stopDeploymentTool: InternalToolConfig< name: 'AppConfig Stop Deployment', description: 'Stop an in-progress AWS AppConfig deployment', version: '1.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { region: { diff --git a/apps/sim/tools/appconfig/update_application.ts b/apps/sim/tools/appconfig/update_application.ts index 68e252c90da..53830cd8ea9 100644 --- a/apps/sim/tools/appconfig/update_application.ts +++ b/apps/sim/tools/appconfig/update_application.ts @@ -2,6 +2,7 @@ import type { AppConfigUpdateApplicationParams, AppConfigUpdateApplicationResponse, } from '@/tools/appconfig/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const updateApplicationTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const updateApplicationTool: InternalToolConfig< name: 'AppConfig Update Application', description: 'Update the name or description of an AWS AppConfig application', version: '1.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { region: { diff --git a/apps/sim/tools/appconfig/update_configuration_profile.ts b/apps/sim/tools/appconfig/update_configuration_profile.ts index 76ccbc687eb..a27fbc22d7a 100644 --- a/apps/sim/tools/appconfig/update_configuration_profile.ts +++ b/apps/sim/tools/appconfig/update_configuration_profile.ts @@ -2,6 +2,7 @@ import type { AppConfigUpdateConfigurationProfileParams, AppConfigUpdateConfigurationProfileResponse, } from '@/tools/appconfig/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const updateConfigurationProfileTool: InternalToolConfig< @@ -13,6 +14,7 @@ export const updateConfigurationProfileTool: InternalToolConfig< description: 'Update the name, description, or retrieval role of an AppConfig configuration profile', version: '1.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { region: { diff --git a/apps/sim/tools/appconfig/update_environment.ts b/apps/sim/tools/appconfig/update_environment.ts index 61c3a133050..9607533b6e1 100644 --- a/apps/sim/tools/appconfig/update_environment.ts +++ b/apps/sim/tools/appconfig/update_environment.ts @@ -2,6 +2,7 @@ import type { AppConfigUpdateEnvironmentParams, AppConfigUpdateEnvironmentResponse, } from '@/tools/appconfig/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const updateEnvironmentTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const updateEnvironmentTool: InternalToolConfig< name: 'AppConfig Update Environment', description: 'Update the name or description of an AWS AppConfig environment', version: '1.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { region: { diff --git a/apps/sim/tools/athena/batch_get_named_query.ts b/apps/sim/tools/athena/batch_get_named_query.ts index f91421e343d..94e54a4159f 100644 --- a/apps/sim/tools/athena/batch_get_named_query.ts +++ b/apps/sim/tools/athena/batch_get_named_query.ts @@ -2,6 +2,7 @@ import type { AthenaBatchGetNamedQueryParams, AthenaBatchGetNamedQueryResponse, } from '@/tools/athena/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const batchGetNamedQueryTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const batchGetNamedQueryTool: InternalToolConfig< name: 'Athena Batch Get Named Queries', description: 'Get the details of up to 50 Athena named queries by ID in a single call', version: '1.0.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { awsRegion: { diff --git a/apps/sim/tools/athena/batch_get_prepared_statement.ts b/apps/sim/tools/athena/batch_get_prepared_statement.ts index 27029f460e0..b34fe78edf4 100644 --- a/apps/sim/tools/athena/batch_get_prepared_statement.ts +++ b/apps/sim/tools/athena/batch_get_prepared_statement.ts @@ -2,6 +2,7 @@ import type { AthenaBatchGetPreparedStatementParams, AthenaBatchGetPreparedStatementResponse, } from '@/tools/athena/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const batchGetPreparedStatementTool: InternalToolConfig< @@ -13,6 +14,7 @@ export const batchGetPreparedStatementTool: InternalToolConfig< description: 'Get the details of up to 256 prepared statements in an Athena workgroup by name in a single call', version: '1.0.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { awsRegion: { diff --git a/apps/sim/tools/athena/batch_get_query_execution.ts b/apps/sim/tools/athena/batch_get_query_execution.ts index b6471abb9bf..19249a70de8 100644 --- a/apps/sim/tools/athena/batch_get_query_execution.ts +++ b/apps/sim/tools/athena/batch_get_query_execution.ts @@ -2,6 +2,7 @@ import type { AthenaBatchGetQueryExecutionParams, AthenaBatchGetQueryExecutionResponse, } from '@/tools/athena/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const batchGetQueryExecutionTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const batchGetQueryExecutionTool: InternalToolConfig< name: 'Athena Batch Get Query Executions', description: 'Get the status and details of up to 50 Athena query executions in one call', version: '1.0.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { awsRegion: { diff --git a/apps/sim/tools/athena/create_named_query.ts b/apps/sim/tools/athena/create_named_query.ts index 22ace5f736b..5ca926fddda 100644 --- a/apps/sim/tools/athena/create_named_query.ts +++ b/apps/sim/tools/athena/create_named_query.ts @@ -2,6 +2,7 @@ import type { AthenaCreateNamedQueryParams, AthenaCreateNamedQueryResponse, } from '@/tools/athena/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const createNamedQueryTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const createNamedQueryTool: InternalToolConfig< name: 'Athena Create Named Query', description: 'Create a saved/named query in AWS Athena', version: '1.0.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { awsRegion: { diff --git a/apps/sim/tools/athena/create_prepared_statement.ts b/apps/sim/tools/athena/create_prepared_statement.ts index 7ec9872b22b..14ddf13d188 100644 --- a/apps/sim/tools/athena/create_prepared_statement.ts +++ b/apps/sim/tools/athena/create_prepared_statement.ts @@ -2,6 +2,7 @@ import type { AthenaCreatePreparedStatementParams, AthenaCreatePreparedStatementResponse, } from '@/tools/athena/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const createPreparedStatementTool: InternalToolConfig< @@ -13,6 +14,7 @@ export const createPreparedStatementTool: InternalToolConfig< description: 'Create a parameterized prepared statement in an Athena workgroup for use with EXECUTE or execution parameters', version: '1.0.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { awsRegion: { diff --git a/apps/sim/tools/athena/delete_named_query.ts b/apps/sim/tools/athena/delete_named_query.ts index c87e285cc3c..e8849cc19db 100644 --- a/apps/sim/tools/athena/delete_named_query.ts +++ b/apps/sim/tools/athena/delete_named_query.ts @@ -2,6 +2,7 @@ import type { AthenaDeleteNamedQueryParams, AthenaDeleteNamedQueryResponse, } from '@/tools/athena/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const deleteNamedQueryTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const deleteNamedQueryTool: InternalToolConfig< name: 'Athena Delete Named Query', description: 'Delete a saved/named query in AWS Athena', version: '1.0.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { awsRegion: { diff --git a/apps/sim/tools/athena/delete_prepared_statement.ts b/apps/sim/tools/athena/delete_prepared_statement.ts index 50d91c618ec..ec6a33d7228 100644 --- a/apps/sim/tools/athena/delete_prepared_statement.ts +++ b/apps/sim/tools/athena/delete_prepared_statement.ts @@ -2,6 +2,7 @@ import type { AthenaDeletePreparedStatementParams, AthenaDeletePreparedStatementResponse, } from '@/tools/athena/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const deletePreparedStatementTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const deletePreparedStatementTool: InternalToolConfig< name: 'Athena Delete Prepared Statement', description: 'Delete a prepared statement from an Athena workgroup', version: '1.0.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { awsRegion: { diff --git a/apps/sim/tools/athena/get_data_catalog.ts b/apps/sim/tools/athena/get_data_catalog.ts index 80d499f02a5..54f7eb37016 100644 --- a/apps/sim/tools/athena/get_data_catalog.ts +++ b/apps/sim/tools/athena/get_data_catalog.ts @@ -1,4 +1,5 @@ import type { AthenaGetDataCatalogParams, AthenaGetDataCatalogResponse } from '@/tools/athena/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const getDataCatalogTool: InternalToolConfig< @@ -9,6 +10,7 @@ export const getDataCatalogTool: InternalToolConfig< name: 'Athena Get Data Catalog', description: 'Get the type, status, and connection parameters of an Athena data catalog', version: '1.0.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { awsRegion: { diff --git a/apps/sim/tools/athena/get_database.ts b/apps/sim/tools/athena/get_database.ts index 7a9bd85577c..ee30fbbf2fe 100644 --- a/apps/sim/tools/athena/get_database.ts +++ b/apps/sim/tools/athena/get_database.ts @@ -1,4 +1,5 @@ import type { AthenaGetDatabaseParams, AthenaGetDatabaseResponse } from '@/tools/athena/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const getDatabaseTool: InternalToolConfig< @@ -10,6 +11,7 @@ export const getDatabaseTool: InternalToolConfig< description: 'Get a single database (name, description, and parameters) from an Athena data catalog', version: '1.0.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { awsRegion: { diff --git a/apps/sim/tools/athena/get_named_query.ts b/apps/sim/tools/athena/get_named_query.ts index d484c31e70b..d4f9dfc63d8 100644 --- a/apps/sim/tools/athena/get_named_query.ts +++ b/apps/sim/tools/athena/get_named_query.ts @@ -1,4 +1,5 @@ import type { AthenaGetNamedQueryParams, AthenaGetNamedQueryResponse } from '@/tools/athena/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const getNamedQueryTool: InternalToolConfig< @@ -9,6 +10,7 @@ export const getNamedQueryTool: InternalToolConfig< name: 'Athena Get Named Query', description: 'Get details of a saved/named query in AWS Athena', version: '1.0.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { awsRegion: { diff --git a/apps/sim/tools/athena/get_prepared_statement.ts b/apps/sim/tools/athena/get_prepared_statement.ts index 80f7cd847d2..1109e73234e 100644 --- a/apps/sim/tools/athena/get_prepared_statement.ts +++ b/apps/sim/tools/athena/get_prepared_statement.ts @@ -2,6 +2,7 @@ import type { AthenaGetPreparedStatementParams, AthenaGetPreparedStatementResponse, } from '@/tools/athena/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const getPreparedStatementTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const getPreparedStatementTool: InternalToolConfig< name: 'Athena Get Prepared Statement', description: 'Get the SQL and metadata of a prepared statement in an Athena workgroup', version: '1.0.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { awsRegion: { diff --git a/apps/sim/tools/athena/get_query_execution.ts b/apps/sim/tools/athena/get_query_execution.ts index 7f18331220e..1f6896b5e8a 100644 --- a/apps/sim/tools/athena/get_query_execution.ts +++ b/apps/sim/tools/athena/get_query_execution.ts @@ -2,6 +2,7 @@ import type { AthenaGetQueryExecutionParams, AthenaGetQueryExecutionResponse, } from '@/tools/athena/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const getQueryExecutionTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const getQueryExecutionTool: InternalToolConfig< name: 'Athena Get Query Execution', description: 'Get the status and details of an Athena query execution', version: '1.0.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { awsRegion: { diff --git a/apps/sim/tools/athena/get_query_results.ts b/apps/sim/tools/athena/get_query_results.ts index 6f44a5fe555..b3ca92bd117 100644 --- a/apps/sim/tools/athena/get_query_results.ts +++ b/apps/sim/tools/athena/get_query_results.ts @@ -2,6 +2,7 @@ import type { AthenaGetQueryResultsParams, AthenaGetQueryResultsResponse, } from '@/tools/athena/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const getQueryResultsTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const getQueryResultsTool: InternalToolConfig< name: 'Athena Get Query Results', description: 'Retrieve the results of a completed Athena query execution', version: '1.0.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { awsRegion: { diff --git a/apps/sim/tools/athena/get_query_runtime_statistics.ts b/apps/sim/tools/athena/get_query_runtime_statistics.ts index 7fcfac485bf..8330c1ecaca 100644 --- a/apps/sim/tools/athena/get_query_runtime_statistics.ts +++ b/apps/sim/tools/athena/get_query_runtime_statistics.ts @@ -2,6 +2,7 @@ import type { AthenaGetQueryRuntimeStatisticsParams, AthenaGetQueryRuntimeStatisticsResponse, } from '@/tools/athena/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const getQueryRuntimeStatisticsTool: InternalToolConfig< @@ -13,6 +14,7 @@ export const getQueryRuntimeStatisticsTool: InternalToolConfig< description: 'Get runtime statistics (timeline, row counts, and output stage) for a completed Athena query execution', version: '1.0.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { awsRegion: { diff --git a/apps/sim/tools/athena/get_table_metadata.ts b/apps/sim/tools/athena/get_table_metadata.ts index 9ee30fb0104..69d1f185583 100644 --- a/apps/sim/tools/athena/get_table_metadata.ts +++ b/apps/sim/tools/athena/get_table_metadata.ts @@ -2,6 +2,7 @@ import type { AthenaGetTableMetadataParams, AthenaGetTableMetadataResponse, } from '@/tools/athena/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const getTableMetadataTool: InternalToolConfig< @@ -13,6 +14,7 @@ export const getTableMetadataTool: InternalToolConfig< description: 'Get the columns, partition keys, and properties of a single table in an Athena data catalog database', version: '1.0.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { awsRegion: { diff --git a/apps/sim/tools/athena/get_work_group.ts b/apps/sim/tools/athena/get_work_group.ts index 6a393de566e..ac8a7da0f64 100644 --- a/apps/sim/tools/athena/get_work_group.ts +++ b/apps/sim/tools/athena/get_work_group.ts @@ -1,4 +1,5 @@ import type { AthenaGetWorkGroupParams, AthenaGetWorkGroupResponse } from '@/tools/athena/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const getWorkGroupTool: InternalToolConfig< @@ -10,6 +11,7 @@ export const getWorkGroupTool: InternalToolConfig< description: 'Get the configuration of an Athena workgroup, including its result location, encryption, and limits', version: '1.0.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { awsRegion: { diff --git a/apps/sim/tools/athena/list_data_catalogs.ts b/apps/sim/tools/athena/list_data_catalogs.ts index 56f987bc42c..64697f17f36 100644 --- a/apps/sim/tools/athena/list_data_catalogs.ts +++ b/apps/sim/tools/athena/list_data_catalogs.ts @@ -2,6 +2,7 @@ import type { AthenaListDataCatalogsParams, AthenaListDataCatalogsResponse, } from '@/tools/athena/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const listDataCatalogsTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const listDataCatalogsTool: InternalToolConfig< name: 'Athena List Data Catalogs', description: 'List the data catalogs (data sources) registered in the AWS account', version: '1.0.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { awsRegion: { diff --git a/apps/sim/tools/athena/list_databases.ts b/apps/sim/tools/athena/list_databases.ts index 7322edce537..e961fd516d0 100644 --- a/apps/sim/tools/athena/list_databases.ts +++ b/apps/sim/tools/athena/list_databases.ts @@ -1,4 +1,5 @@ import type { AthenaListDatabasesParams, AthenaListDatabasesResponse } from '@/tools/athena/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const listDatabasesTool: InternalToolConfig< @@ -9,6 +10,7 @@ export const listDatabasesTool: InternalToolConfig< name: 'Athena List Databases', description: 'List the databases available in an Athena data catalog', version: '1.0.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { awsRegion: { diff --git a/apps/sim/tools/athena/list_named_queries.ts b/apps/sim/tools/athena/list_named_queries.ts index 347e94ef7fe..2d650a8e3bd 100644 --- a/apps/sim/tools/athena/list_named_queries.ts +++ b/apps/sim/tools/athena/list_named_queries.ts @@ -2,6 +2,7 @@ import type { AthenaListNamedQueriesParams, AthenaListNamedQueriesResponse, } from '@/tools/athena/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const listNamedQueriesTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const listNamedQueriesTool: InternalToolConfig< name: 'Athena List Named Queries', description: 'List saved/named query IDs in AWS Athena', version: '1.0.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { awsRegion: { diff --git a/apps/sim/tools/athena/list_prepared_statements.ts b/apps/sim/tools/athena/list_prepared_statements.ts index e0dc00a7585..1d608c223f7 100644 --- a/apps/sim/tools/athena/list_prepared_statements.ts +++ b/apps/sim/tools/athena/list_prepared_statements.ts @@ -2,6 +2,7 @@ import type { AthenaListPreparedStatementsParams, AthenaListPreparedStatementsResponse, } from '@/tools/athena/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const listPreparedStatementsTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const listPreparedStatementsTool: InternalToolConfig< name: 'Athena List Prepared Statements', description: 'List the prepared statements saved in an Athena workgroup', version: '1.0.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { awsRegion: { diff --git a/apps/sim/tools/athena/list_query_executions.ts b/apps/sim/tools/athena/list_query_executions.ts index 4e2aaa16b4a..7cb75c61814 100644 --- a/apps/sim/tools/athena/list_query_executions.ts +++ b/apps/sim/tools/athena/list_query_executions.ts @@ -2,6 +2,7 @@ import type { AthenaListQueryExecutionsParams, AthenaListQueryExecutionsResponse, } from '@/tools/athena/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const listQueryExecutionsTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const listQueryExecutionsTool: InternalToolConfig< name: 'Athena List Query Executions', description: 'List recent Athena query execution IDs', version: '1.0.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { awsRegion: { diff --git a/apps/sim/tools/athena/list_table_metadata.ts b/apps/sim/tools/athena/list_table_metadata.ts index 77f2c3148b6..9864838ae65 100644 --- a/apps/sim/tools/athena/list_table_metadata.ts +++ b/apps/sim/tools/athena/list_table_metadata.ts @@ -2,6 +2,7 @@ import type { AthenaListTableMetadataParams, AthenaListTableMetadataResponse, } from '@/tools/athena/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const listTableMetadataTool: InternalToolConfig< @@ -12,6 +13,7 @@ export const listTableMetadataTool: InternalToolConfig< name: 'Athena List Table Metadata', description: 'List tables and their column/partition metadata for an Athena database', version: '1.0.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { awsRegion: { diff --git a/apps/sim/tools/athena/list_work_groups.ts b/apps/sim/tools/athena/list_work_groups.ts index a90f04182be..985073c03d1 100644 --- a/apps/sim/tools/athena/list_work_groups.ts +++ b/apps/sim/tools/athena/list_work_groups.ts @@ -1,4 +1,5 @@ import type { AthenaListWorkGroupsParams, AthenaListWorkGroupsResponse } from '@/tools/athena/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const listWorkGroupsTool: InternalToolConfig< @@ -9,6 +10,7 @@ export const listWorkGroupsTool: InternalToolConfig< name: 'Athena List Workgroups', description: 'List the Athena workgroups available in the AWS account', version: '1.0.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { awsRegion: { diff --git a/apps/sim/tools/athena/start_query.ts b/apps/sim/tools/athena/start_query.ts index fa743eee05c..c6c241d4e52 100644 --- a/apps/sim/tools/athena/start_query.ts +++ b/apps/sim/tools/athena/start_query.ts @@ -1,4 +1,5 @@ import type { AthenaStartQueryParams, AthenaStartQueryResponse } from '@/tools/athena/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' /** @@ -37,6 +38,7 @@ export const startQueryTool: InternalToolConfig = { @@ -6,6 +7,7 @@ export const stopQueryTool: InternalToolConfig databricksUrl(params.host, `/api/2.2/jobs/runs/cancel-all`), + url: (params) => databricksUrl(databricksHost(params), `/api/2.2/jobs/runs/cancel-all`), method: 'POST', headers: (params) => ({ - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, 'Content-Type': 'application/json', }), body: (params) => { diff --git a/apps/sim/tools/databricks/cancel_run.ts b/apps/sim/tools/databricks/cancel_run.ts index eb1f905b192..04967968f81 100644 --- a/apps/sim/tools/databricks/cancel_run.ts +++ b/apps/sim/tools/databricks/cancel_run.ts @@ -2,7 +2,8 @@ import type { DatabricksCancelRunParams, DatabricksCancelRunResponse, } from '@/tools/databricks/types' -import { databricksUrl } from '@/tools/databricks/utils' +import { databricksHost, databricksToken, databricksUrl } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const cancelRunTool: ToolConfig = { @@ -11,6 +12,7 @@ export const cancelRunTool: ToolConfig databricksUrl(params.host, '/api/2.2/jobs/runs/cancel'), + url: (params) => databricksUrl(databricksHost(params), '/api/2.2/jobs/runs/cancel'), method: 'POST', headers: (params) => ({ 'Content-Type': 'application/json', - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, }), body: (params) => ({ run_id: params.runId, diff --git a/apps/sim/tools/databricks/cancel_statement.ts b/apps/sim/tools/databricks/cancel_statement.ts index dbe9cb8743e..ce1c848ffc8 100644 --- a/apps/sim/tools/databricks/cancel_statement.ts +++ b/apps/sim/tools/databricks/cancel_statement.ts @@ -5,10 +5,13 @@ import type { } from '@/tools/databricks/types' import { DATABRICKS_AUTH_PARAMS, + databricksHost, + databricksToken, databricksUrl, optionalDatabricksString, readDatabricksError, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' import { safeUrlPathSegment } from '@/tools/url-path' @@ -21,6 +24,7 @@ export const cancelStatementTool: ToolConfig< description: 'Request cancellation of an executing SQL statement; poll Get Statement to confirm its final status.', version: '1.0.0', + oauth: DATABRICKS_CREDENTIAL_OAUTH, params: { ...DATABRICKS_AUTH_PARAMS, statementId: { @@ -39,12 +43,12 @@ export const cancelStatementTool: ToolConfig< request: { url: (params) => databricksUrl( - params.host, + databricksHost(params), `/api/2.0/sql/statements/${safeUrlPathSegment(params.statementId, 'statementId')}/cancel` ), method: 'POST', headers: (params) => ({ - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, 'Content-Type': 'application/json', }), body: (params) => diff --git a/apps/sim/tools/databricks/create_cluster.ts b/apps/sim/tools/databricks/create_cluster.ts index 9b58e20c7c5..571557d6548 100644 --- a/apps/sim/tools/databricks/create_cluster.ts +++ b/apps/sim/tools/databricks/create_cluster.ts @@ -5,11 +5,14 @@ import type { } from '@/tools/databricks/types' import { DATABRICKS_AUTH_PARAMS, + databricksHost, + databricksToken, databricksUrl, optionalDatabricksString, parseDatabricksJson, readDatabricksError, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const createClusterTool: ToolConfig< @@ -21,6 +24,7 @@ export const createClusterTool: ToolConfig< description: 'Create a compute cluster with runtime, sizing, policy, and cloud-specific settings.', version: '1.0.0', + oauth: DATABRICKS_CREDENTIAL_OAUTH, params: { ...DATABRICKS_AUTH_PARAMS, applyPolicyDefaultValues: { @@ -242,10 +246,10 @@ export const createClusterTool: ToolConfig< }, }, request: { - url: (params) => databricksUrl(params.host, `/api/2.1/clusters/create`), + url: (params) => databricksUrl(databricksHost(params), `/api/2.1/clusters/create`), method: 'POST', headers: (params) => ({ - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, 'Content-Type': 'application/json', }), body: (params) => { diff --git a/apps/sim/tools/databricks/create_job.ts b/apps/sim/tools/databricks/create_job.ts index d59583a2867..f4448f2aab2 100644 --- a/apps/sim/tools/databricks/create_job.ts +++ b/apps/sim/tools/databricks/create_job.ts @@ -5,11 +5,14 @@ import type { } from '@/tools/databricks/types' import { DATABRICKS_AUTH_PARAMS, + databricksHost, + databricksToken, databricksUrl, optionalDatabricksString, parseDatabricksJson, readDatabricksError, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const createJobTool: ToolConfig = { @@ -18,6 +21,7 @@ export const createJobTool: ToolConfig databricksUrl(params.host, `/api/2.2/jobs/create`), + url: (params) => databricksUrl(databricksHost(params), `/api/2.2/jobs/create`), method: 'POST', headers: (params) => ({ - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, 'Content-Type': 'application/json', }), body: (params) => { diff --git a/apps/sim/tools/databricks/create_warehouse.ts b/apps/sim/tools/databricks/create_warehouse.ts index 7af97c12b7f..92f47e3da46 100644 --- a/apps/sim/tools/databricks/create_warehouse.ts +++ b/apps/sim/tools/databricks/create_warehouse.ts @@ -5,11 +5,14 @@ import type { } from '@/tools/databricks/types' import { DATABRICKS_AUTH_PARAMS, + databricksHost, + databricksToken, databricksUrl, optionalDatabricksString, parseDatabricksJson, readDatabricksError, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const createWarehouseTool: ToolConfig< @@ -20,6 +23,7 @@ export const createWarehouseTool: ToolConfig< name: 'Databricks Create Warehouse', description: 'Create a SQL warehouse with sizing, autoscaling, and serverless settings.', version: '1.0.0', + oauth: DATABRICKS_CREDENTIAL_OAUTH, params: { ...DATABRICKS_AUTH_PARAMS, name: { @@ -102,10 +106,10 @@ export const createWarehouseTool: ToolConfig< }, }, request: { - url: (params) => databricksUrl(params.host, `/api/2.0/sql/warehouses`), + url: (params) => databricksUrl(databricksHost(params), `/api/2.0/sql/warehouses`), method: 'POST', headers: (params) => ({ - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, 'Content-Type': 'application/json', }), body: (params) => { diff --git a/apps/sim/tools/databricks/databricks.test.ts b/apps/sim/tools/databricks/databricks.test.ts index f0823fc6152..c5a4df49af3 100644 --- a/apps/sim/tools/databricks/databricks.test.ts +++ b/apps/sim/tools/databricks/databricks.test.ts @@ -10,6 +10,7 @@ vi.mock('@/lib/core/security/input-validation.server', () => inputValidationMock import * as databricksTools from '@/tools/databricks' import { executeSqlTool } from '@/tools/databricks/execute_sql' import { getRunTool } from '@/tools/databricks/get_run' +import { databricksHost, databricksToken } from '@/tools/databricks/utils' import { executeTool } from '@/tools/index' import { tools } from '@/tools/registry' import { prepareToolRequest } from '@/tools/request-transport' @@ -216,3 +217,33 @@ describe('Databricks paginated results', () => { }) }) }) + +describe('Databricks saved-connection auth', () => { + it('keeps the inline host and token when no saved connection resolved', () => { + const params = { host: 'dbc-inline.cloud.databricks.com', apiKey: 'dapi-inline' } + + expect(databricksHost(params)).toBe('dbc-inline.cloud.databricks.com') + expect(databricksToken(params)).toBe('dapi-inline') + }) + + it('ignores a stray domain that did not come with a resolved token', () => { + expect( + databricksHost({ + host: 'dbc-inline.cloud.databricks.com', + domain: 'dbc-other.cloud.databricks.com', + }) + ).toBe('dbc-inline.cloud.databricks.com') + }) + + it('uses the resolved token and its bound workspace host', () => { + const params = { + accessToken: 'oauth-token', + domain: 'dbc-saved.cloud.databricks.com', + host: '', + apiKey: '', + } + + expect(databricksHost(params)).toBe('dbc-saved.cloud.databricks.com') + expect(databricksToken(params)).toBe('oauth-token') + }) +}) diff --git a/apps/sim/tools/databricks/delete_cluster.ts b/apps/sim/tools/databricks/delete_cluster.ts index 22e709f4656..e35cdf0bfa0 100644 --- a/apps/sim/tools/databricks/delete_cluster.ts +++ b/apps/sim/tools/databricks/delete_cluster.ts @@ -5,9 +5,12 @@ import type { } from '@/tools/databricks/types' import { DATABRICKS_AUTH_PARAMS, + databricksHost, + databricksToken, databricksUrl, readDatabricksError, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const deleteClusterTool: ToolConfig< @@ -18,6 +21,7 @@ export const deleteClusterTool: ToolConfig< name: 'Databricks Delete Cluster', description: 'Permanently delete a compute cluster and its configuration.', version: '1.0.0', + oauth: DATABRICKS_CREDENTIAL_OAUTH, params: { ...DATABRICKS_AUTH_PARAMS, clusterId: { @@ -28,10 +32,10 @@ export const deleteClusterTool: ToolConfig< }, }, request: { - url: (params) => databricksUrl(params.host, `/api/2.1/clusters/permanent-delete`), + url: (params) => databricksUrl(databricksHost(params), `/api/2.1/clusters/permanent-delete`), method: 'POST', headers: (params) => ({ - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, 'Content-Type': 'application/json', }), body: (params) => { diff --git a/apps/sim/tools/databricks/delete_job.ts b/apps/sim/tools/databricks/delete_job.ts index 9cc90abfd2f..4b98c63ec4a 100644 --- a/apps/sim/tools/databricks/delete_job.ts +++ b/apps/sim/tools/databricks/delete_job.ts @@ -2,9 +2,12 @@ import { filterUndefined } from '@sim/utils/object' import type { DatabricksDeleteJobParams, DatabricksSuccessResponse } from '@/tools/databricks/types' import { DATABRICKS_AUTH_PARAMS, + databricksHost, + databricksToken, databricksUrl, readDatabricksError, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const deleteJobTool: ToolConfig = { @@ -12,6 +15,7 @@ export const deleteJobTool: ToolConfig databricksUrl(params.host, `/api/2.2/jobs/delete`), + url: (params) => databricksUrl(databricksHost(params), `/api/2.2/jobs/delete`), method: 'POST', headers: (params) => ({ - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, 'Content-Type': 'application/json', }), body: (params) => { diff --git a/apps/sim/tools/databricks/delete_run.ts b/apps/sim/tools/databricks/delete_run.ts index 57b4c21fdd0..5585b42abd8 100644 --- a/apps/sim/tools/databricks/delete_run.ts +++ b/apps/sim/tools/databricks/delete_run.ts @@ -2,9 +2,12 @@ import { filterUndefined } from '@sim/utils/object' import type { DatabricksDeleteRunParams, DatabricksSuccessResponse } from '@/tools/databricks/types' import { DATABRICKS_AUTH_PARAMS, + databricksHost, + databricksToken, databricksUrl, readDatabricksError, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const deleteRunTool: ToolConfig = { @@ -12,6 +15,7 @@ export const deleteRunTool: ToolConfig databricksUrl(params.host, `/api/2.2/jobs/runs/delete`), + url: (params) => databricksUrl(databricksHost(params), `/api/2.2/jobs/runs/delete`), method: 'POST', headers: (params) => ({ - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, 'Content-Type': 'application/json', }), body: (params) => { diff --git a/apps/sim/tools/databricks/delete_warehouse.ts b/apps/sim/tools/databricks/delete_warehouse.ts index ba5e8cff15a..2e2f001d60a 100644 --- a/apps/sim/tools/databricks/delete_warehouse.ts +++ b/apps/sim/tools/databricks/delete_warehouse.ts @@ -4,9 +4,12 @@ import type { } from '@/tools/databricks/types' import { DATABRICKS_AUTH_PARAMS, + databricksHost, + databricksToken, databricksUrl, readDatabricksError, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' import { safeUrlPathSegment } from '@/tools/url-path' @@ -18,6 +21,7 @@ export const deleteWarehouseTool: ToolConfig< name: 'Databricks Delete Warehouse', description: 'Delete a SQL warehouse.', version: '1.0.0', + oauth: DATABRICKS_CREDENTIAL_OAUTH, params: { ...DATABRICKS_AUTH_PARAMS, warehouseId: { @@ -30,12 +34,12 @@ export const deleteWarehouseTool: ToolConfig< request: { url: (params) => databricksUrl( - params.host, + databricksHost(params), `/api/2.0/sql/warehouses/${safeUrlPathSegment(params.warehouseId, 'warehouseId')}` ), method: 'DELETE', headers: (params) => ({ - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, 'Content-Type': 'application/json', }), }, diff --git a/apps/sim/tools/databricks/edit_cluster.ts b/apps/sim/tools/databricks/edit_cluster.ts index ecf4a777753..b5f7a18fa0a 100644 --- a/apps/sim/tools/databricks/edit_cluster.ts +++ b/apps/sim/tools/databricks/edit_cluster.ts @@ -5,11 +5,14 @@ import type { } from '@/tools/databricks/types' import { DATABRICKS_AUTH_PARAMS, + databricksHost, + databricksToken, databricksUrl, optionalDatabricksString, parseDatabricksJson, readDatabricksError, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const editClusterTool: ToolConfig = { @@ -18,6 +21,7 @@ export const editClusterTool: ToolConfig databricksUrl(params.host, `/api/2.1/clusters/edit`), + url: (params) => databricksUrl(databricksHost(params), `/api/2.1/clusters/edit`), method: 'POST', headers: (params) => ({ - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, 'Content-Type': 'application/json', }), body: (params) => { diff --git a/apps/sim/tools/databricks/edit_warehouse.ts b/apps/sim/tools/databricks/edit_warehouse.ts index 18d7fb1d43e..3fbf474e671 100644 --- a/apps/sim/tools/databricks/edit_warehouse.ts +++ b/apps/sim/tools/databricks/edit_warehouse.ts @@ -5,11 +5,14 @@ import type { } from '@/tools/databricks/types' import { DATABRICKS_AUTH_PARAMS, + databricksHost, + databricksToken, databricksUrl, optionalDatabricksString, parseDatabricksJson, readDatabricksError, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' import { safeUrlPathSegment } from '@/tools/url-path' @@ -21,6 +24,7 @@ export const editWarehouseTool: ToolConfig< name: 'Databricks Edit Warehouse', description: 'Update a SQL warehouse configuration.', version: '1.0.0', + oauth: DATABRICKS_CREDENTIAL_OAUTH, params: { ...DATABRICKS_AUTH_PARAMS, warehouseId: { @@ -111,12 +115,12 @@ export const editWarehouseTool: ToolConfig< request: { url: (params) => databricksUrl( - params.host, + databricksHost(params), `/api/2.0/sql/warehouses/${safeUrlPathSegment(params.warehouseId, 'warehouseId')}/edit` ), method: 'POST', headers: (params) => ({ - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, 'Content-Type': 'application/json', }), body: (params) => { diff --git a/apps/sim/tools/databricks/execute_sql.ts b/apps/sim/tools/databricks/execute_sql.ts index a7c588246ae..3f415b6eeb0 100644 --- a/apps/sim/tools/databricks/execute_sql.ts +++ b/apps/sim/tools/databricks/execute_sql.ts @@ -3,7 +3,14 @@ import type { DatabricksExecuteSqlResponse, } from '@/tools/databricks/types' import { GENIE_QUERY_RESULT_OUTPUTS } from '@/tools/databricks/types' -import { databricksUrl, mapStatementResult, parseDatabricksJson } from '@/tools/databricks/utils' +import { + databricksHost, + databricksToken, + databricksUrl, + mapStatementResult, + parseDatabricksJson, +} from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const executeSqlTool: ToolConfig = @@ -13,6 +20,7 @@ export const executeSqlTool: ToolConfig databricksUrl(params.host, '/api/2.0/sql/statements/'), + url: (params) => databricksUrl(databricksHost(params), '/api/2.0/sql/statements/'), method: 'POST', headers: (params) => ({ 'Content-Type': 'application/json', - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, }), body: (params) => { const body: Record = { diff --git a/apps/sim/tools/databricks/genie_agent_ask.ts b/apps/sim/tools/databricks/genie_agent_ask.ts index 9a0774dea9e..fe635bbdd06 100644 --- a/apps/sim/tools/databricks/genie_agent_ask.ts +++ b/apps/sim/tools/databricks/genie_agent_ask.ts @@ -4,6 +4,8 @@ import { GENIE_AGENT_ITEM_OUTPUT_PROPERTIES, } from '@/tools/databricks/types' import { + databricksHost, + databricksToken, databricksUrl, GENIE_SPACE_PARAMS, genieAgentErrorMessage, @@ -12,6 +14,7 @@ import { parseGenieAgentQuery, parseGenieAgentStream, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const genieAgentAskTool: ToolConfig< @@ -23,6 +26,7 @@ export const genieAgentAskTool: ToolConfig< description: 'Ask a Genie agent a question in agent mode, where Genie plans multi-step research, runs several SQL queries, and writes a report with citations. Waits for the final report. Starts a new agent-mode conversation, or continues one when a conversation ID is given. Agent mode is in preview and must be enabled on the workspace.', version: '1.0.0', + oauth: DATABRICKS_CREDENTIAL_OAUTH, params: { ...GENIE_SPACE_PARAMS, @@ -55,12 +59,13 @@ export const genieAgentAskTool: ToolConfig< mode: 'project', select: (params) => ({ content: params.content }), }, - url: (params) => databricksUrl(params.host, `${genieAgentPath(params.spaceId)}/responses`), + url: (params) => + databricksUrl(databricksHost(params), `${genieAgentPath(params.spaceId)}/responses`), method: 'POST', headers: (params) => ({ 'Content-Type': 'application/json', Accept: 'text/event-stream', - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, }), body: (params) => { const conversationId = params.conversationId?.trim() diff --git a/apps/sim/tools/databricks/genie_agent_cancel.ts b/apps/sim/tools/databricks/genie_agent_cancel.ts index 62a02c76460..39da403f63a 100644 --- a/apps/sim/tools/databricks/genie_agent_cancel.ts +++ b/apps/sim/tools/databricks/genie_agent_cancel.ts @@ -4,12 +4,15 @@ import type { } from '@/tools/databricks/types' import { GENIE_MESSAGE_OUTPUT_PROPERTIES } from '@/tools/databricks/types' import { + databricksHost, + databricksToken, databricksUrl, GENIE_SPACE_PARAMS, genieAgentPath, mapGenieMessage, readDatabricksError, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' import { safeUrlPathSegment } from '@/tools/url-path' @@ -22,6 +25,7 @@ export const genieAgentCancelTool: ToolConfig< description: 'Cancel an in-flight Genie agent response using the response ID returned by the agent stream.', version: '1.0.0', + oauth: DATABRICKS_CREDENTIAL_OAUTH, params: { ...GENIE_SPACE_PARAMS, conversationId: { @@ -40,12 +44,12 @@ export const genieAgentCancelTool: ToolConfig< request: { url: (params) => databricksUrl( - params.host, + databricksHost(params), `${genieAgentPath(params.spaceId)}/conversations/${safeUrlPathSegment(params.conversationId, 'conversationId')}/responses/${safeUrlPathSegment(params.responseId, 'responseId')}/cancel` ), method: 'POST', headers: (params) => ({ - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, 'Content-Type': 'application/json', }), body: () => ({}), diff --git a/apps/sim/tools/databricks/genie_agent_list_items.ts b/apps/sim/tools/databricks/genie_agent_list_items.ts index 80e3f34142b..1ee4ba52faa 100644 --- a/apps/sim/tools/databricks/genie_agent_list_items.ts +++ b/apps/sim/tools/databricks/genie_agent_list_items.ts @@ -5,12 +5,15 @@ import { } from '@/tools/databricks/types' import { databricksErrorMessage, + databricksHost, + databricksToken, databricksUrl, GENIE_READ_RETRY, GENIE_SPACE_PARAMS, genieAgentPath, mapGenieAgentItem, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' import { safeUrlPathSegment } from '@/tools/url-path' @@ -23,6 +26,7 @@ export const genieAgentListItemsTool: ToolConfig< description: "List an agent-mode conversation's full history in order: questions, reasoning, SQL calls, query results, and reports. Agent mode is in preview and must be enabled on the workspace.", version: '1.0.0', + oauth: DATABRICKS_CREDENTIAL_OAUTH, params: { ...GENIE_SPACE_PARAMS, @@ -60,7 +64,7 @@ export const genieAgentListItemsTool: ToolConfig< url: (params) => { const url = new URL( databricksUrl( - params.host, + databricksHost(params), `${genieAgentPath(params.spaceId)}/conversations/${safeUrlPathSegment(params.conversationId, 'conversationId')}/items` ) ) @@ -72,7 +76,7 @@ export const genieAgentListItemsTool: ToolConfig< method: 'GET', headers: (params) => ({ Accept: 'application/json', - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, }), retry: GENIE_READ_RETRY, }, diff --git a/apps/sim/tools/databricks/genie_ask.ts b/apps/sim/tools/databricks/genie_ask.ts index b94d96e8a05..6a40a3cf1d4 100644 --- a/apps/sim/tools/databricks/genie_ask.ts +++ b/apps/sim/tools/databricks/genie_ask.ts @@ -12,6 +12,8 @@ import { } from '@/tools/databricks/types' import { databricksErrorMessage, + databricksHost, + databricksToken, databricksUrl, GENIE_SPACE_PARAMS, GENIE_TERMINAL_STATUSES, @@ -19,6 +21,7 @@ import { genieSpacePath, mapGenieMessage, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' const logger = createLogger('DatabricksGenieAskTool') @@ -45,6 +48,7 @@ export const genieAskTool: ToolConfig { const conversationId = params.conversationId?.trim() return databricksUrl( - params.host, + databricksHost(params), conversationId ? `${genieConversationPath(params.spaceId, conversationId)}/messages` : `${genieSpacePath(params.spaceId)}/start-conversation` @@ -87,7 +91,7 @@ export const genieAskTool: ToolConfig ({ 'Content-Type': 'application/json', Accept: 'application/json', - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, }), body: (params) => ({ content: params.content, @@ -127,8 +131,8 @@ export const genieAskTool: ToolConfig ({ serializedSpace: params.serializedSpace }), }, - url: (params) => databricksUrl(params.host, `/api/2.0/genie/spaces`), + url: (params) => databricksUrl(databricksHost(params), `/api/2.0/genie/spaces`), method: 'POST', headers: (params) => ({ - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, 'Content-Type': 'application/json', }), body: (params) => { diff --git a/apps/sim/tools/databricks/genie_delete_conversation.ts b/apps/sim/tools/databricks/genie_delete_conversation.ts index 2cf39522ea1..104af8c4ec6 100644 --- a/apps/sim/tools/databricks/genie_delete_conversation.ts +++ b/apps/sim/tools/databricks/genie_delete_conversation.ts @@ -3,11 +3,14 @@ import type { DatabricksGenieSuccessResponse, } from '@/tools/databricks/types' import { + databricksHost, + databricksToken, databricksUrl, GENIE_SPACE_PARAMS, genieConversationPath, readDatabricksError, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const genieDeleteConversationTool: ToolConfig< @@ -18,6 +21,7 @@ export const genieDeleteConversationTool: ToolConfig< name: 'Databricks Genie Delete Conversation', description: 'Delete a Genie conversation you no longer need.', version: '1.0.0', + oauth: DATABRICKS_CREDENTIAL_OAUTH, params: { ...GENIE_SPACE_PARAMS, @@ -31,11 +35,14 @@ export const genieDeleteConversationTool: ToolConfig< request: { url: (params) => - databricksUrl(params.host, genieConversationPath(params.spaceId, params.conversationId)), + databricksUrl( + databricksHost(params), + genieConversationPath(params.spaceId, params.conversationId) + ), method: 'DELETE', headers: (params) => ({ Accept: 'application/json', - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, }), }, diff --git a/apps/sim/tools/databricks/genie_delete_message.ts b/apps/sim/tools/databricks/genie_delete_message.ts index 83e8d638169..4b58fd8c2f1 100644 --- a/apps/sim/tools/databricks/genie_delete_message.ts +++ b/apps/sim/tools/databricks/genie_delete_message.ts @@ -3,11 +3,14 @@ import type { DatabricksGenieSuccessResponse, } from '@/tools/databricks/types' import { + databricksHost, + databricksToken, databricksUrl, GENIE_MESSAGE_PARAMS, genieMessagePath, readDatabricksError, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const genieDeleteMessageTool: ToolConfig< @@ -18,15 +21,16 @@ export const genieDeleteMessageTool: ToolConfig< name: 'Databricks Genie Delete Message', description: 'Delete a message from a Genie conversation.', version: '1.0.0', + oauth: DATABRICKS_CREDENTIAL_OAUTH, params: GENIE_MESSAGE_PARAMS, request: { - url: (params) => databricksUrl(params.host, genieMessagePath(params)), + url: (params) => databricksUrl(databricksHost(params), genieMessagePath(params)), method: 'DELETE', headers: (params) => ({ Accept: 'application/json', - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, }), }, diff --git a/apps/sim/tools/databricks/genie_delete_space.ts b/apps/sim/tools/databricks/genie_delete_space.ts index 910c1ff4cf4..671a53df182 100644 --- a/apps/sim/tools/databricks/genie_delete_space.ts +++ b/apps/sim/tools/databricks/genie_delete_space.ts @@ -4,9 +4,12 @@ import type { } from '@/tools/databricks/types' import { DATABRICKS_AUTH_PARAMS, + databricksHost, + databricksToken, databricksUrl, readDatabricksError, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' import { safeUrlPathSegment } from '@/tools/url-path' @@ -18,6 +21,7 @@ export const genieDeleteSpaceTool: ToolConfig< name: 'Databricks Trash Genie Space', description: 'Move a Genie space to the trash.', version: '1.0.0', + oauth: DATABRICKS_CREDENTIAL_OAUTH, params: { ...DATABRICKS_AUTH_PARAMS, spaceId: { @@ -30,12 +34,12 @@ export const genieDeleteSpaceTool: ToolConfig< request: { url: (params) => databricksUrl( - params.host, + databricksHost(params), `/api/2.0/genie/spaces/${safeUrlPathSegment(params.spaceId, 'spaceId')}` ), method: 'DELETE', headers: (params) => ({ - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, 'Content-Type': 'application/json', }), }, diff --git a/apps/sim/tools/databricks/genie_download_visualization.ts b/apps/sim/tools/databricks/genie_download_visualization.ts index bd7f220c4c6..0be4210ee99 100644 --- a/apps/sim/tools/databricks/genie_download_visualization.ts +++ b/apps/sim/tools/databricks/genie_download_visualization.ts @@ -3,11 +3,14 @@ import type { DatabricksGenieDownloadVisualizationResponse, } from '@/tools/databricks/types' import { + databricksHost, + databricksToken, databricksUrl, GENIE_MESSAGE_PARAMS, GENIE_READ_RETRY, genieAttachmentPath, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const genieDownloadVisualizationTool: ToolConfig< @@ -19,6 +22,7 @@ export const genieDownloadVisualizationTool: ToolConfig< description: 'Download a chart Genie generated as a PNG image, for example to post it to Slack. The message must be COMPLETED and asked with visualization enabled. Not supported on Private Link workspaces.', version: '1.0.0', + oauth: DATABRICKS_CREDENTIAL_OAUTH, params: { ...GENIE_MESSAGE_PARAMS, @@ -32,11 +36,14 @@ export const genieDownloadVisualizationTool: ToolConfig< request: { url: (params) => - databricksUrl(params.host, `${genieAttachmentPath(params)}/download-visualization`), + databricksUrl( + databricksHost(params), + `${genieAttachmentPath(params)}/download-visualization` + ), method: 'GET', headers: (params) => ({ Accept: 'application/octet-stream', - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, }), responseType: 'binary', retry: GENIE_READ_RETRY, diff --git a/apps/sim/tools/databricks/genie_execute_query.ts b/apps/sim/tools/databricks/genie_execute_query.ts index 29bf23cc193..a30b7eeec10 100644 --- a/apps/sim/tools/databricks/genie_execute_query.ts +++ b/apps/sim/tools/databricks/genie_execute_query.ts @@ -5,11 +5,14 @@ import { } from '@/tools/databricks/types' import { databricksErrorMessage, + databricksHost, + databricksToken, databricksUrl, GENIE_QUERY_ATTACHMENT_PARAMS, genieAttachmentPath, mapStatementResult, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const genieExecuteQueryTool: ToolConfig< @@ -21,16 +24,18 @@ export const genieExecuteQueryTool: ToolConfig< description: "Re-run the SQL query Genie generated for a message. Use this when the message's query result has expired (status QUERY_RESULT_EXPIRED). If the returned status is PENDING or RUNNING, fetch the rows afterwards with Get Genie Query Result.", version: '1.0.0', + oauth: DATABRICKS_CREDENTIAL_OAUTH, params: GENIE_QUERY_ATTACHMENT_PARAMS, request: { - url: (params) => databricksUrl(params.host, `${genieAttachmentPath(params)}/execute-query`), + url: (params) => + databricksUrl(databricksHost(params), `${genieAttachmentPath(params)}/execute-query`), method: 'POST', headers: (params) => ({ 'Content-Type': 'application/json', Accept: 'application/json', - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, }), body: () => ({}), }, diff --git a/apps/sim/tools/databricks/genie_get_message.ts b/apps/sim/tools/databricks/genie_get_message.ts index ea5e83b7b60..0af654d8ec8 100644 --- a/apps/sim/tools/databricks/genie_get_message.ts +++ b/apps/sim/tools/databricks/genie_get_message.ts @@ -5,12 +5,15 @@ import { } from '@/tools/databricks/types' import { databricksErrorMessage, + databricksHost, + databricksToken, databricksUrl, GENIE_MESSAGE_PARAMS, GENIE_READ_RETRY, genieMessagePath, mapGenieMessage, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const genieGetMessageTool: ToolConfig< @@ -22,15 +25,16 @@ export const genieGetMessageTool: ToolConfig< description: "Get a Genie message's status and answer, including the generated SQL, visualizations, and suggested follow-up questions.", version: '1.0.0', + oauth: DATABRICKS_CREDENTIAL_OAUTH, params: GENIE_MESSAGE_PARAMS, request: { - url: (params) => databricksUrl(params.host, genieMessagePath(params)), + url: (params) => databricksUrl(databricksHost(params), genieMessagePath(params)), method: 'GET', headers: (params) => ({ Accept: 'application/json', - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, }), retry: GENIE_READ_RETRY, }, diff --git a/apps/sim/tools/databricks/genie_get_query_result.ts b/apps/sim/tools/databricks/genie_get_query_result.ts index 68ea71649e4..93876f0b5df 100644 --- a/apps/sim/tools/databricks/genie_get_query_result.ts +++ b/apps/sim/tools/databricks/genie_get_query_result.ts @@ -5,12 +5,15 @@ import { } from '@/tools/databricks/types' import { databricksErrorMessage, + databricksHost, + databricksToken, databricksUrl, GENIE_QUERY_ATTACHMENT_PARAMS, GENIE_READ_RETRY, genieAttachmentPath, mapStatementResult, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const genieGetQueryResultTool: ToolConfig< @@ -22,15 +25,17 @@ export const genieGetQueryResultTool: ToolConfig< description: 'Get the rows returned by the SQL query Genie generated for a message. Available once the message is EXECUTING_QUERY or COMPLETED.', version: '1.0.0', + oauth: DATABRICKS_CREDENTIAL_OAUTH, params: GENIE_QUERY_ATTACHMENT_PARAMS, request: { - url: (params) => databricksUrl(params.host, `${genieAttachmentPath(params)}/query-result`), + url: (params) => + databricksUrl(databricksHost(params), `${genieAttachmentPath(params)}/query-result`), method: 'GET', headers: (params) => ({ Accept: 'application/json', - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, }), retry: GENIE_READ_RETRY, }, diff --git a/apps/sim/tools/databricks/genie_get_space.ts b/apps/sim/tools/databricks/genie_get_space.ts index b18b2098bca..dd33f8e237b 100644 --- a/apps/sim/tools/databricks/genie_get_space.ts +++ b/apps/sim/tools/databricks/genie_get_space.ts @@ -5,12 +5,15 @@ import { } from '@/tools/databricks/types' import { databricksErrorMessage, + databricksHost, + databricksToken, databricksUrl, GENIE_READ_RETRY, GENIE_SPACE_PARAMS, genieSpacePath, mapGenieSpace, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const genieGetSpaceTool: ToolConfig< @@ -22,6 +25,7 @@ export const genieGetSpaceTool: ToolConfig< description: "Get a Genie space's title, description, and SQL warehouse, optionally with its full configuration export (tables, instructions, sample questions).", version: '1.0.0', + oauth: DATABRICKS_CREDENTIAL_OAUTH, params: { ...GENIE_SPACE_PARAMS, @@ -36,14 +40,14 @@ export const genieGetSpaceTool: ToolConfig< request: { url: (params) => { - const url = new URL(databricksUrl(params.host, genieSpacePath(params.spaceId))) + const url = new URL(databricksUrl(databricksHost(params), genieSpacePath(params.spaceId))) if (params.includeSerializedSpace) url.searchParams.set('include_serialized_space', 'true') return url.toString() }, method: 'GET', headers: (params) => ({ Accept: 'application/json', - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, }), retry: GENIE_READ_RETRY, }, diff --git a/apps/sim/tools/databricks/genie_list_conversations.ts b/apps/sim/tools/databricks/genie_list_conversations.ts index 798f7f96f0b..cea7eab3662 100644 --- a/apps/sim/tools/databricks/genie_list_conversations.ts +++ b/apps/sim/tools/databricks/genie_list_conversations.ts @@ -4,11 +4,14 @@ import type { } from '@/tools/databricks/types' import { databricksErrorMessage, + databricksHost, + databricksToken, databricksUrl, GENIE_READ_RETRY, GENIE_SPACE_PARAMS, genieSpacePath, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const genieListConversationsTool: ToolConfig< @@ -20,6 +23,7 @@ export const genieListConversationsTool: ToolConfig< description: 'List conversations in a Genie space, including whether each is a chat-mode or agent-mode conversation. By default only your own conversations are returned.', version: '1.0.0', + oauth: DATABRICKS_CREDENTIAL_OAUTH, params: { ...GENIE_SPACE_PARAMS, @@ -47,7 +51,7 @@ export const genieListConversationsTool: ToolConfig< request: { url: (params) => { const url = new URL( - databricksUrl(params.host, `${genieSpacePath(params.spaceId)}/conversations`) + databricksUrl(databricksHost(params), `${genieSpacePath(params.spaceId)}/conversations`) ) if (params.includeAll) url.searchParams.set('include_all', 'true') if (params.pageSize) url.searchParams.set('page_size', String(params.pageSize)) @@ -57,7 +61,7 @@ export const genieListConversationsTool: ToolConfig< method: 'GET', headers: (params) => ({ Accept: 'application/json', - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, }), retry: GENIE_READ_RETRY, }, diff --git a/apps/sim/tools/databricks/genie_list_messages.ts b/apps/sim/tools/databricks/genie_list_messages.ts index 30e7989f8bb..97a715045df 100644 --- a/apps/sim/tools/databricks/genie_list_messages.ts +++ b/apps/sim/tools/databricks/genie_list_messages.ts @@ -5,6 +5,8 @@ import { } from '@/tools/databricks/types' import { databricksErrorMessage, + databricksHost, + databricksToken, databricksUrl, GENIE_READ_RETRY, GENIE_SPACE_PARAMS, @@ -12,6 +14,7 @@ import { genieConversationPath, mapGenieMessage, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const genieListMessagesTool: ToolConfig< @@ -23,6 +26,7 @@ export const genieListMessagesTool: ToolConfig< description: 'List the messages in a Genie conversation with their answers and generated SQL, for example to replay a conversation history.', version: '1.0.0', + oauth: DATABRICKS_CREDENTIAL_OAUTH, params: { ...GENIE_SPACE_PARAMS, @@ -50,7 +54,7 @@ export const genieListMessagesTool: ToolConfig< url: (params) => { const url = new URL( databricksUrl( - params.host, + databricksHost(params), `${genieConversationPath(params.spaceId, params.conversationId)}/messages` ) ) @@ -61,7 +65,7 @@ export const genieListMessagesTool: ToolConfig< method: 'GET', headers: (params) => ({ Accept: 'application/json', - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, }), retry: GENIE_READ_RETRY, }, diff --git a/apps/sim/tools/databricks/genie_list_spaces.ts b/apps/sim/tools/databricks/genie_list_spaces.ts index 93553aef50e..edddce19542 100644 --- a/apps/sim/tools/databricks/genie_list_spaces.ts +++ b/apps/sim/tools/databricks/genie_list_spaces.ts @@ -6,10 +6,13 @@ import { import { DATABRICKS_AUTH_PARAMS, databricksErrorMessage, + databricksHost, + databricksToken, databricksUrl, GENIE_READ_RETRY, mapGenieSpace, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const genieListSpacesTool: ToolConfig< @@ -21,6 +24,7 @@ export const genieListSpacesTool: ToolConfig< description: 'List the Genie spaces (Genie agents) you can access. Use this to find the space ID needed to ask Genie a question.', version: '1.0.0', + oauth: DATABRICKS_CREDENTIAL_OAUTH, params: { ...DATABRICKS_AUTH_PARAMS, @@ -40,7 +44,7 @@ export const genieListSpacesTool: ToolConfig< request: { url: (params) => { - const url = new URL(databricksUrl(params.host, '/api/2.0/genie/spaces')) + const url = new URL(databricksUrl(databricksHost(params), '/api/2.0/genie/spaces')) if (params.pageSize) url.searchParams.set('page_size', String(params.pageSize)) if (params.pageToken) url.searchParams.set('page_token', params.pageToken) return url.toString() @@ -48,7 +52,7 @@ export const genieListSpacesTool: ToolConfig< method: 'GET', headers: (params) => ({ Accept: 'application/json', - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, }), retry: GENIE_READ_RETRY, }, diff --git a/apps/sim/tools/databricks/genie_send_feedback.ts b/apps/sim/tools/databricks/genie_send_feedback.ts index e45028a0e21..23ee636654d 100644 --- a/apps/sim/tools/databricks/genie_send_feedback.ts +++ b/apps/sim/tools/databricks/genie_send_feedback.ts @@ -3,11 +3,14 @@ import type { DatabricksGenieSuccessResponse, } from '@/tools/databricks/types' import { + databricksHost, + databricksToken, databricksUrl, GENIE_MESSAGE_PARAMS, genieMessagePath, readDatabricksError, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const genieSendFeedbackTool: ToolConfig< @@ -19,6 +22,7 @@ export const genieSendFeedbackTool: ToolConfig< description: "Rate a Genie answer as positive or negative, with an optional comment. Space authors use this feedback to improve the space's instructions.", version: '1.0.0', + oauth: DATABRICKS_CREDENTIAL_OAUTH, params: { ...GENIE_MESSAGE_PARAMS, @@ -37,12 +41,12 @@ export const genieSendFeedbackTool: ToolConfig< }, request: { - url: (params) => databricksUrl(params.host, `${genieMessagePath(params)}/feedback`), + url: (params) => databricksUrl(databricksHost(params), `${genieMessagePath(params)}/feedback`), method: 'POST', headers: (params) => ({ 'Content-Type': 'application/json', Accept: 'application/json', - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, }), body: (params) => ({ rating: params.rating, diff --git a/apps/sim/tools/databricks/genie_update_space.ts b/apps/sim/tools/databricks/genie_update_space.ts index 9ccd22081d9..4541070863c 100644 --- a/apps/sim/tools/databricks/genie_update_space.ts +++ b/apps/sim/tools/databricks/genie_update_space.ts @@ -6,11 +6,14 @@ import type { import { GENIE_SPACE_OUTPUT_PROPERTIES } from '@/tools/databricks/types' import { DATABRICKS_AUTH_PARAMS, + databricksHost, + databricksToken, databricksUrl, mapGenieSpace, optionalDatabricksString, readDatabricksError, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' import { safeUrlPathSegment } from '@/tools/url-path' @@ -22,6 +25,7 @@ export const genieUpdateSpaceTool: ToolConfig< name: 'Databricks Update Genie Space', description: 'Update a Genie space, optionally protecting the change with its current ETag.', version: '1.0.0', + oauth: DATABRICKS_CREDENTIAL_OAUTH, params: { ...DATABRICKS_AUTH_PARAMS, spaceId: { @@ -75,12 +79,12 @@ export const genieUpdateSpaceTool: ToolConfig< }, url: (params) => databricksUrl( - params.host, + databricksHost(params), `/api/2.0/genie/spaces/${safeUrlPathSegment(params.spaceId, 'spaceId')}` ), method: 'PATCH', headers: (params) => ({ - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, 'Content-Type': 'application/json', }), body: (params) => { diff --git a/apps/sim/tools/databricks/get_cluster.ts b/apps/sim/tools/databricks/get_cluster.ts index f4a0f48664d..045a549ec6f 100644 --- a/apps/sim/tools/databricks/get_cluster.ts +++ b/apps/sim/tools/databricks/get_cluster.ts @@ -2,7 +2,8 @@ import type { DatabricksGetClusterParams, DatabricksGetClusterResponse, } from '@/tools/databricks/types' -import { databricksUrl } from '@/tools/databricks/utils' +import { databricksHost, databricksToken, databricksUrl } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const getClusterTool: ToolConfig = @@ -12,6 +13,7 @@ export const getClusterTool: ToolConfig { - const url = new URL(databricksUrl(params.host, '/api/2.1/clusters/get')) + const url = new URL(databricksUrl(databricksHost(params), '/api/2.1/clusters/get')) url.searchParams.set('cluster_id', params.clusterId.trim()) return url.toString() }, method: 'GET', headers: (params) => ({ Accept: 'application/json', - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, }), }, diff --git a/apps/sim/tools/databricks/get_job.ts b/apps/sim/tools/databricks/get_job.ts index c22b007ee58..f288683a2ed 100644 --- a/apps/sim/tools/databricks/get_job.ts +++ b/apps/sim/tools/databricks/get_job.ts @@ -1,6 +1,7 @@ import type { DatabricksGetJobParams, DatabricksGetJobResponse } from '@/tools/databricks/types' import { JOB_CLUSTERS_OUTPUT, JOB_TASK_OUTPUT } from '@/tools/databricks/types' -import { databricksUrl } from '@/tools/databricks/utils' +import { databricksHost, databricksToken, databricksUrl } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const getJobTool: ToolConfig = { @@ -8,6 +9,7 @@ export const getJobTool: ToolConfig { - const url = new URL(databricksUrl(params.host, '/api/2.2/jobs/get')) + const url = new URL(databricksUrl(databricksHost(params), '/api/2.2/jobs/get')) url.searchParams.set('job_id', String(params.jobId)) if (params.pageToken) url.searchParams.set('page_token', params.pageToken) if (params.includeTriggerState != null) @@ -54,7 +56,7 @@ export const getJobTool: ToolConfig ({ Accept: 'application/json', - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, }), }, diff --git a/apps/sim/tools/databricks/get_run.ts b/apps/sim/tools/databricks/get_run.ts index 28d9778488d..f7ef6469d0d 100644 --- a/apps/sim/tools/databricks/get_run.ts +++ b/apps/sim/tools/databricks/get_run.ts @@ -5,7 +5,8 @@ import { RUN_STATUS_OUTPUT, RUN_STATUS_OUTPUT_PROPERTIES, } from '@/tools/databricks/types' -import { databricksUrl } from '@/tools/databricks/utils' +import { databricksHost, databricksToken, databricksUrl } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const getRunTool: ToolConfig = { @@ -13,6 +14,7 @@ export const getRunTool: ToolConfig { - const url = new URL(databricksUrl(params.host, '/api/2.2/jobs/runs/get')) + const url = new URL(databricksUrl(databricksHost(params), '/api/2.2/jobs/runs/get')) url.searchParams.set('run_id', String(params.runId)) if (params.includeHistory) url.searchParams.set('include_history', 'true') if (params.includeResolvedValues) url.searchParams.set('include_resolved_values', 'true') @@ -65,7 +67,7 @@ export const getRunTool: ToolConfig ({ Accept: 'application/json', - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, }), }, diff --git a/apps/sim/tools/databricks/get_run_output.ts b/apps/sim/tools/databricks/get_run_output.ts index 39a51c1d295..6e64753638f 100644 --- a/apps/sim/tools/databricks/get_run_output.ts +++ b/apps/sim/tools/databricks/get_run_output.ts @@ -2,7 +2,8 @@ import type { DatabricksGetRunOutputParams, DatabricksGetRunOutputResponse, } from '@/tools/databricks/types' -import { databricksUrl } from '@/tools/databricks/utils' +import { databricksHost, databricksToken, databricksUrl } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const getRunOutputTool: ToolConfig< @@ -14,6 +15,7 @@ export const getRunOutputTool: ToolConfig< description: 'Get the output of a completed Databricks job run, including notebook results, error messages, and logs. For multi-task jobs, use the task run ID (not the parent run ID).', version: '1.0.0', + oauth: DATABRICKS_CREDENTIAL_OAUTH, params: { host: { @@ -39,13 +41,13 @@ export const getRunOutputTool: ToolConfig< request: { url: (params) => databricksUrl( - params.host, + databricksHost(params), `/api/2.2/jobs/runs/get-output?run_id=${encodeURIComponent(String(params.runId))}` ), method: 'GET', headers: (params) => ({ Accept: 'application/json', - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, }), }, diff --git a/apps/sim/tools/databricks/get_statement.ts b/apps/sim/tools/databricks/get_statement.ts index 13e2fa497e9..5d5d9ae9291 100644 --- a/apps/sim/tools/databricks/get_statement.ts +++ b/apps/sim/tools/databricks/get_statement.ts @@ -4,10 +4,13 @@ import type { } from '@/tools/databricks/types' import { GENIE_QUERY_RESULT_OUTPUTS } from '@/tools/databricks/types' import { + databricksHost, + databricksToken, databricksUrl, mapStatementResult, optionalDatabricksString, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' import { safeUrlPathSegment } from '@/tools/url-path' @@ -20,6 +23,7 @@ export const getStatementTool: ToolConfig< description: 'Poll a SQL statement by its ID to retrieve status and results. Use this after Execute SQL when a query runs longer than the wait timeout.', version: '1.0.0', + oauth: DATABRICKS_CREDENTIAL_OAUTH, params: { host: { @@ -52,7 +56,7 @@ export const getStatementTool: ToolConfig< url: (params) => { const url = new URL( databricksUrl( - params.host, + databricksHost(params), `/api/2.0/sql/statements/${safeUrlPathSegment(params.statementId, 'statementId')}` ) ) @@ -63,7 +67,7 @@ export const getStatementTool: ToolConfig< method: 'GET', headers: (params) => ({ Accept: 'application/json', - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, }), }, diff --git a/apps/sim/tools/databricks/get_statement_chunk.ts b/apps/sim/tools/databricks/get_statement_chunk.ts index 7d35c35e245..e0776831b59 100644 --- a/apps/sim/tools/databricks/get_statement_chunk.ts +++ b/apps/sim/tools/databricks/get_statement_chunk.ts @@ -5,10 +5,13 @@ import type { import { STATEMENT_RESULT_OUTPUT_PROPERTIES } from '@/tools/databricks/types' import { DATABRICKS_AUTH_PARAMS, + databricksHost, + databricksToken, databricksUrl, optionalDatabricksString, readDatabricksError, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' import { safeUrlPathSegment } from '@/tools/url-path' @@ -21,6 +24,7 @@ export const getStatementChunkTool: ToolConfig< description: 'Retrieve one chunk of an INLINE SQL result using nextChunkIndex from Execute SQL or Get Statement.', version: '1.0.0', + oauth: DATABRICKS_CREDENTIAL_OAUTH, params: { ...DATABRICKS_AUTH_PARAMS, statementId: { @@ -44,7 +48,7 @@ export const getStatementChunkTool: ToolConfig< }, request: { url: (params) => { - const origin = databricksUrl(params.host, '') + const origin = databricksUrl(databricksHost(params), '') if (!Number.isInteger(params.chunkIndex) || params.chunkIndex < 0) throw new Error('chunkIndex must be a nonnegative integer') const url = new URL( @@ -55,7 +59,10 @@ export const getStatementChunkTool: ToolConfig< return url.toString() }, method: 'GET', - headers: (params) => ({ Authorization: `Bearer ${params.apiKey}`, Accept: 'application/json' }), + headers: (params) => ({ + Authorization: `Bearer ${databricksToken(params)}`, + Accept: 'application/json', + }), }, transformResponse: async (response) => { if (!response.ok) diff --git a/apps/sim/tools/databricks/get_warehouse.ts b/apps/sim/tools/databricks/get_warehouse.ts index 33d8a305bce..111e8edeb38 100644 --- a/apps/sim/tools/databricks/get_warehouse.ts +++ b/apps/sim/tools/databricks/get_warehouse.ts @@ -5,10 +5,13 @@ import type { import { WAREHOUSE_OUTPUT_PROPERTIES } from '@/tools/databricks/types' import { DATABRICKS_AUTH_PARAMS, + databricksHost, + databricksToken, databricksUrl, mapWarehouse, readDatabricksError, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' import { safeUrlPathSegment } from '@/tools/url-path' @@ -20,6 +23,7 @@ export const getWarehouseTool: ToolConfig< name: 'Databricks Get Warehouse', description: 'Get the configuration, state, and scaling settings of a SQL warehouse.', version: '1.0.0', + oauth: DATABRICKS_CREDENTIAL_OAUTH, params: { ...DATABRICKS_AUTH_PARAMS, warehouseId: { @@ -32,11 +36,14 @@ export const getWarehouseTool: ToolConfig< request: { url: (params) => databricksUrl( - params.host, + databricksHost(params), `/api/2.0/sql/warehouses/${safeUrlPathSegment(params.warehouseId, 'warehouseId')}` ), method: 'GET', - headers: (params) => ({ Authorization: `Bearer ${params.apiKey}`, Accept: 'application/json' }), + headers: (params) => ({ + Authorization: `Bearer ${databricksToken(params)}`, + Accept: 'application/json', + }), }, transformResponse: async (response) => { if (!response.ok) diff --git a/apps/sim/tools/databricks/list_clusters.ts b/apps/sim/tools/databricks/list_clusters.ts index 386865b9218..567e79c7110 100644 --- a/apps/sim/tools/databricks/list_clusters.ts +++ b/apps/sim/tools/databricks/list_clusters.ts @@ -2,7 +2,8 @@ import type { DatabricksListClustersParams, DatabricksListClustersResponse, } from '@/tools/databricks/types' -import { databricksUrl } from '@/tools/databricks/utils' +import { databricksHost, databricksToken, databricksUrl } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const listClustersTool: ToolConfig< @@ -14,6 +15,7 @@ export const listClustersTool: ToolConfig< description: 'List a page of clusters in a Databricks workspace including their state, configuration, and resource details.', version: '1.0.0', + oauth: DATABRICKS_CREDENTIAL_OAUTH, params: { pageSize: { @@ -44,7 +46,7 @@ export const listClustersTool: ToolConfig< request: { url: (params) => { - const url = new URL(databricksUrl(params.host, '/api/2.1/clusters/list')) + const url = new URL(databricksUrl(databricksHost(params), '/api/2.1/clusters/list')) url.searchParams.set('page_size', String(params.pageSize ?? 20)) if (params.pageToken) url.searchParams.set('page_token', params.pageToken) return url.toString() @@ -52,7 +54,7 @@ export const listClustersTool: ToolConfig< method: 'GET', headers: (params) => ({ Accept: 'application/json', - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, }), }, diff --git a/apps/sim/tools/databricks/list_jobs.ts b/apps/sim/tools/databricks/list_jobs.ts index 3c9fe7d9da1..c8da71321a4 100644 --- a/apps/sim/tools/databricks/list_jobs.ts +++ b/apps/sim/tools/databricks/list_jobs.ts @@ -1,6 +1,7 @@ import type { DatabricksListJobsParams, DatabricksListJobsResponse } from '@/tools/databricks/types' import { JOB_CLUSTERS_OUTPUT, JOB_TASK_OUTPUT } from '@/tools/databricks/types' -import { databricksUrl } from '@/tools/databricks/utils' +import { databricksHost, databricksToken, databricksUrl } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const listJobsTool: ToolConfig = { @@ -8,6 +9,7 @@ export const listJobsTool: ToolConfig { const url = new URL( databricksUrl( - params.host, + databricksHost(params), `/api/${params.offset != null && !params.pageToken ? '2.1' : '2.2'}/jobs/list` ) ) @@ -72,7 +74,7 @@ export const listJobsTool: ToolConfig ({ Accept: 'application/json', - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, }), }, diff --git a/apps/sim/tools/databricks/list_runs.ts b/apps/sim/tools/databricks/list_runs.ts index 49a9c126bdd..74a250c44ce 100644 --- a/apps/sim/tools/databricks/list_runs.ts +++ b/apps/sim/tools/databricks/list_runs.ts @@ -1,6 +1,7 @@ import type { DatabricksListRunsParams, DatabricksListRunsResponse } from '@/tools/databricks/types' import { JOB_CLUSTERS_OUTPUT, JOB_TASK_OUTPUT, RUN_STATUS_OUTPUT } from '@/tools/databricks/types' -import { databricksUrl } from '@/tools/databricks/utils' +import { databricksHost, databricksToken, databricksUrl } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const listRunsTool: ToolConfig = { @@ -9,6 +10,7 @@ export const listRunsTool: ToolConfig { const url = new URL( databricksUrl( - params.host, + databricksHost(params), `/api/${params.offset != null && !params.pageToken ? '2.1' : '2.2'}/jobs/runs/list` ) ) @@ -111,7 +113,7 @@ export const listRunsTool: ToolConfig ({ Accept: 'application/json', - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, }), }, diff --git a/apps/sim/tools/databricks/list_warehouses.ts b/apps/sim/tools/databricks/list_warehouses.ts index 0da33ed4e3f..302055eaab0 100644 --- a/apps/sim/tools/databricks/list_warehouses.ts +++ b/apps/sim/tools/databricks/list_warehouses.ts @@ -3,7 +3,13 @@ import type { DatabricksListWarehousesResponse, } from '@/tools/databricks/types' import { WAREHOUSE_OUTPUT_PROPERTIES } from '@/tools/databricks/types' -import { databricksUrl, mapWarehouse } from '@/tools/databricks/utils' +import { + databricksHost, + databricksToken, + databricksUrl, + mapWarehouse, +} from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const listWarehousesTool: ToolConfig< @@ -15,6 +21,7 @@ export const listWarehousesTool: ToolConfig< description: 'List a page of SQL warehouses in a Databricks workspace including their size, state, and type. Use this to discover the warehouse ID needed for Execute SQL.', version: '1.0.0', + oauth: DATABRICKS_CREDENTIAL_OAUTH, params: { pageSize: { @@ -45,7 +52,7 @@ export const listWarehousesTool: ToolConfig< request: { url: (params) => { - const url = new URL(databricksUrl(params.host, '/api/2.0/sql/warehouses')) + const url = new URL(databricksUrl(databricksHost(params), '/api/2.0/sql/warehouses')) url.searchParams.set('page_size', String(params.pageSize ?? 20)) if (params.pageToken) url.searchParams.set('page_token', params.pageToken) return url.toString() @@ -53,7 +60,7 @@ export const listWarehousesTool: ToolConfig< method: 'GET', headers: (params) => ({ Accept: 'application/json', - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, }), }, diff --git a/apps/sim/tools/databricks/repair_run.ts b/apps/sim/tools/databricks/repair_run.ts index b82e639ea74..f7ff87bbfe0 100644 --- a/apps/sim/tools/databricks/repair_run.ts +++ b/apps/sim/tools/databricks/repair_run.ts @@ -5,11 +5,14 @@ import type { } from '@/tools/databricks/types' import { DATABRICKS_AUTH_PARAMS, + databricksHost, + databricksToken, databricksUrl, optionalDatabricksString, parseDatabricksJson, readDatabricksError, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const repairRunTool: ToolConfig = { @@ -17,6 +20,7 @@ export const repairRunTool: ToolConfig databricksUrl(params.host, `/api/2.2/jobs/runs/repair`), + url: (params) => databricksUrl(databricksHost(params), `/api/2.2/jobs/runs/repair`), method: 'POST', headers: (params) => ({ - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, 'Content-Type': 'application/json', }), body: (params) => { diff --git a/apps/sim/tools/databricks/reset_job.ts b/apps/sim/tools/databricks/reset_job.ts index 949009d4546..89b41f1689d 100644 --- a/apps/sim/tools/databricks/reset_job.ts +++ b/apps/sim/tools/databricks/reset_job.ts @@ -2,10 +2,13 @@ import { filterUndefined } from '@sim/utils/object' import type { DatabricksResetJobParams, DatabricksSuccessResponse } from '@/tools/databricks/types' import { DATABRICKS_AUTH_PARAMS, + databricksHost, + databricksToken, databricksUrl, parseDatabricksJson, readDatabricksError, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const resetJobTool: ToolConfig = { @@ -13,6 +16,7 @@ export const resetJobTool: ToolConfig databricksUrl(params.host, `/api/2.2/jobs/reset`), + url: (params) => databricksUrl(databricksHost(params), `/api/2.2/jobs/reset`), method: 'POST', headers: (params) => ({ - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, 'Content-Type': 'application/json', }), body: (params) => { diff --git a/apps/sim/tools/databricks/resize_cluster.ts b/apps/sim/tools/databricks/resize_cluster.ts index 4531fe26656..d37b3a82ac1 100644 --- a/apps/sim/tools/databricks/resize_cluster.ts +++ b/apps/sim/tools/databricks/resize_cluster.ts @@ -5,10 +5,13 @@ import type { } from '@/tools/databricks/types' import { DATABRICKS_AUTH_PARAMS, + databricksHost, + databricksToken, databricksUrl, parseDatabricksJson, readDatabricksError, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const resizeClusterTool: ToolConfig< @@ -19,6 +22,7 @@ export const resizeClusterTool: ToolConfig< name: 'Databricks Resize Cluster', description: 'Change the fixed worker count or autoscaling range of a running cluster.', version: '1.0.0', + oauth: DATABRICKS_CREDENTIAL_OAUTH, params: { ...DATABRICKS_AUTH_PARAMS, clusterId: { @@ -41,10 +45,10 @@ export const resizeClusterTool: ToolConfig< }, }, request: { - url: (params) => databricksUrl(params.host, `/api/2.1/clusters/resize`), + url: (params) => databricksUrl(databricksHost(params), `/api/2.1/clusters/resize`), method: 'POST', headers: (params) => ({ - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, 'Content-Type': 'application/json', }), body: (params) => { diff --git a/apps/sim/tools/databricks/restart_cluster.ts b/apps/sim/tools/databricks/restart_cluster.ts index 2eeaede0026..466da0b4bf7 100644 --- a/apps/sim/tools/databricks/restart_cluster.ts +++ b/apps/sim/tools/databricks/restart_cluster.ts @@ -5,10 +5,13 @@ import type { } from '@/tools/databricks/types' import { DATABRICKS_AUTH_PARAMS, + databricksHost, + databricksToken, databricksUrl, optionalDatabricksString, readDatabricksError, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const restartClusterTool: ToolConfig< @@ -19,6 +22,7 @@ export const restartClusterTool: ToolConfig< name: 'Databricks Restart Cluster', description: 'Restart a running compute cluster.', version: '1.0.0', + oauth: DATABRICKS_CREDENTIAL_OAUTH, params: { ...DATABRICKS_AUTH_PARAMS, clusterId: { @@ -35,10 +39,10 @@ export const restartClusterTool: ToolConfig< }, }, request: { - url: (params) => databricksUrl(params.host, `/api/2.1/clusters/restart`), + url: (params) => databricksUrl(databricksHost(params), `/api/2.1/clusters/restart`), method: 'POST', headers: (params) => ({ - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, 'Content-Type': 'application/json', }), body: (params) => { diff --git a/apps/sim/tools/databricks/run_job.ts b/apps/sim/tools/databricks/run_job.ts index 40733990518..8f31675c375 100644 --- a/apps/sim/tools/databricks/run_job.ts +++ b/apps/sim/tools/databricks/run_job.ts @@ -1,9 +1,12 @@ import type { DatabricksRunJobParams, DatabricksRunJobResponse } from '@/tools/databricks/types' import { + databricksHost, + databricksToken, databricksUrl, optionalDatabricksString, parseDatabricksJson, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const runJobTool: ToolConfig = { @@ -12,6 +15,7 @@ export const runJobTool: ToolConfig databricksUrl(params.host, '/api/2.2/jobs/run-now'), + url: (params) => databricksUrl(databricksHost(params), '/api/2.2/jobs/run-now'), method: 'POST', headers: (params) => ({ 'Content-Type': 'application/json', - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, }), body: (params) => { const body: Record = { diff --git a/apps/sim/tools/databricks/start_cluster.ts b/apps/sim/tools/databricks/start_cluster.ts index d8ca1349ef2..b936fc222cc 100644 --- a/apps/sim/tools/databricks/start_cluster.ts +++ b/apps/sim/tools/databricks/start_cluster.ts @@ -5,9 +5,12 @@ import type { } from '@/tools/databricks/types' import { DATABRICKS_AUTH_PARAMS, + databricksHost, + databricksToken, databricksUrl, readDatabricksError, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const startClusterTool: ToolConfig = @@ -16,6 +19,7 @@ export const startClusterTool: ToolConfig databricksUrl(params.host, `/api/2.1/clusters/start`), + url: (params) => databricksUrl(databricksHost(params), `/api/2.1/clusters/start`), method: 'POST', headers: (params) => ({ - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, 'Content-Type': 'application/json', }), body: (params) => { diff --git a/apps/sim/tools/databricks/start_warehouse.ts b/apps/sim/tools/databricks/start_warehouse.ts index 64365074859..8e4ce40545b 100644 --- a/apps/sim/tools/databricks/start_warehouse.ts +++ b/apps/sim/tools/databricks/start_warehouse.ts @@ -4,9 +4,12 @@ import type { } from '@/tools/databricks/types' import { DATABRICKS_AUTH_PARAMS, + databricksHost, + databricksToken, databricksUrl, readDatabricksError, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' import { safeUrlPathSegment } from '@/tools/url-path' @@ -18,6 +21,7 @@ export const startWarehouseTool: ToolConfig< name: 'Databricks Start Warehouse', description: 'Start a stopped SQL warehouse.', version: '1.0.0', + oauth: DATABRICKS_CREDENTIAL_OAUTH, params: { ...DATABRICKS_AUTH_PARAMS, warehouseId: { @@ -30,12 +34,12 @@ export const startWarehouseTool: ToolConfig< request: { url: (params) => databricksUrl( - params.host, + databricksHost(params), `/api/2.0/sql/warehouses/${safeUrlPathSegment(params.warehouseId, 'warehouseId')}/start` ), method: 'POST', headers: (params) => ({ - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, 'Content-Type': 'application/json', }), body: () => ({}), diff --git a/apps/sim/tools/databricks/stop_warehouse.ts b/apps/sim/tools/databricks/stop_warehouse.ts index e81ffd58aae..3d8fcc6bbf8 100644 --- a/apps/sim/tools/databricks/stop_warehouse.ts +++ b/apps/sim/tools/databricks/stop_warehouse.ts @@ -4,9 +4,12 @@ import type { } from '@/tools/databricks/types' import { DATABRICKS_AUTH_PARAMS, + databricksHost, + databricksToken, databricksUrl, readDatabricksError, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' import { safeUrlPathSegment } from '@/tools/url-path' @@ -18,6 +21,7 @@ export const stopWarehouseTool: ToolConfig< name: 'Databricks Stop Warehouse', description: 'Stop a running SQL warehouse.', version: '1.0.0', + oauth: DATABRICKS_CREDENTIAL_OAUTH, params: { ...DATABRICKS_AUTH_PARAMS, warehouseId: { @@ -30,12 +34,12 @@ export const stopWarehouseTool: ToolConfig< request: { url: (params) => databricksUrl( - params.host, + databricksHost(params), `/api/2.0/sql/warehouses/${safeUrlPathSegment(params.warehouseId, 'warehouseId')}/stop` ), method: 'POST', headers: (params) => ({ - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, 'Content-Type': 'application/json', }), body: () => ({}), diff --git a/apps/sim/tools/databricks/submit_run.ts b/apps/sim/tools/databricks/submit_run.ts index 7709ffb1350..4373a6b4599 100644 --- a/apps/sim/tools/databricks/submit_run.ts +++ b/apps/sim/tools/databricks/submit_run.ts @@ -5,11 +5,14 @@ import type { } from '@/tools/databricks/types' import { DATABRICKS_AUTH_PARAMS, + databricksHost, + databricksToken, databricksUrl, optionalDatabricksString, parseDatabricksJson, readDatabricksError, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const submitRunTool: ToolConfig = { @@ -17,6 +20,7 @@ export const submitRunTool: ToolConfig databricksUrl(params.host, `/api/2.2/jobs/runs/submit`), + url: (params) => databricksUrl(databricksHost(params), `/api/2.2/jobs/runs/submit`), method: 'POST', headers: (params) => ({ - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, 'Content-Type': 'application/json', }), body: (params) => { diff --git a/apps/sim/tools/databricks/terminate_cluster.ts b/apps/sim/tools/databricks/terminate_cluster.ts index 48ef5e33c60..c52d1e4d14d 100644 --- a/apps/sim/tools/databricks/terminate_cluster.ts +++ b/apps/sim/tools/databricks/terminate_cluster.ts @@ -5,9 +5,12 @@ import type { } from '@/tools/databricks/types' import { DATABRICKS_AUTH_PARAMS, + databricksHost, + databricksToken, databricksUrl, readDatabricksError, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const terminateClusterTool: ToolConfig< @@ -18,6 +21,7 @@ export const terminateClusterTool: ToolConfig< name: 'Databricks Terminate Cluster', description: 'Terminate a compute cluster while retaining its configuration for a later restart.', version: '1.0.0', + oauth: DATABRICKS_CREDENTIAL_OAUTH, params: { ...DATABRICKS_AUTH_PARAMS, clusterId: { @@ -28,10 +32,10 @@ export const terminateClusterTool: ToolConfig< }, }, request: { - url: (params) => databricksUrl(params.host, `/api/2.1/clusters/delete`), + url: (params) => databricksUrl(databricksHost(params), `/api/2.1/clusters/delete`), method: 'POST', headers: (params) => ({ - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, 'Content-Type': 'application/json', }), body: (params) => { diff --git a/apps/sim/tools/databricks/types.ts b/apps/sim/tools/databricks/types.ts index 5a47432ea23..6dac094b8af 100644 --- a/apps/sim/tools/databricks/types.ts +++ b/apps/sim/tools/databricks/types.ts @@ -4,6 +4,10 @@ import type { OutputProperty, ToolFileData, ToolResponse } from '@/tools/types' interface DatabricksBaseParams { apiKey: string host: string + /** Token a saved Databricks connection resolved to; set by the executor, never by users. */ + accessToken?: string + /** Workspace host bound to that saved connection. */ + domain?: string } /** Execute SQL Statement */ diff --git a/apps/sim/tools/databricks/update_job.ts b/apps/sim/tools/databricks/update_job.ts index e1c7bcd2d18..e4d1553b51b 100644 --- a/apps/sim/tools/databricks/update_job.ts +++ b/apps/sim/tools/databricks/update_job.ts @@ -2,10 +2,13 @@ import { filterUndefined } from '@sim/utils/object' import type { DatabricksSuccessResponse, DatabricksUpdateJobParams } from '@/tools/databricks/types' import { DATABRICKS_AUTH_PARAMS, + databricksHost, + databricksToken, databricksUrl, parseDatabricksJson, readDatabricksError, } from '@/tools/databricks/utils' +import { DATABRICKS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { ToolConfig } from '@/tools/types' export const updateJobTool: ToolConfig = { @@ -14,6 +17,7 @@ export const updateJobTool: ToolConfig databricksUrl(params.host, `/api/2.2/jobs/update`), + url: (params) => databricksUrl(databricksHost(params), `/api/2.2/jobs/update`), method: 'POST', headers: (params) => ({ - Authorization: `Bearer ${params.apiKey}`, + Authorization: `Bearer ${databricksToken(params)}`, 'Content-Type': 'application/json', }), body: (params) => { diff --git a/apps/sim/tools/databricks/utils.ts b/apps/sim/tools/databricks/utils.ts index f5f8c1141e6..7dcddb334ae 100644 --- a/apps/sim/tools/databricks/utils.ts +++ b/apps/sim/tools/databricks/utils.ts @@ -93,6 +93,26 @@ export const GENIE_MESSAGE_PARAMS = { }, } as const satisfies ToolConfig['params'] +/** + * Bearer token for a Databricks call: the token a saved Databricks connection + * resolved to (`accessToken`), otherwise the inline personal access token. + */ +export function databricksToken(params: { accessToken?: string; apiKey?: string }): string { + return params.accessToken || params.apiKey || '' +} + +/** + * Workspace host for a Databricks call: the host bound to a saved connection + * (`domain`, set only alongside its `accessToken`), otherwise the inline host. + */ +export function databricksHost(params: { + accessToken?: string + domain?: string + host?: string +}): string { + return (params.accessToken && params.domain) || params.host || '' +} + /** * Builds an absolute Databricks REST URL, refusing any host outside the Databricks workspace * domains so the access token is only ever sent to Databricks. The host may carry a scheme or diff --git a/apps/sim/tools/dynamodb/delete.ts b/apps/sim/tools/dynamodb/delete.ts index 954bdae2902..d4eb9635f74 100644 --- a/apps/sim/tools/dynamodb/delete.ts +++ b/apps/sim/tools/dynamodb/delete.ts @@ -1,4 +1,5 @@ import type { DynamoDBDeleteParams, DynamoDBDeleteResponse } from '@/tools/dynamodb/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const deleteTool: InternalToolConfig = { @@ -6,6 +7,7 @@ export const deleteTool: InternalToolConfig = { @@ -6,6 +7,7 @@ export const getTool: InternalToolConfig name: 'DynamoDB Get', description: 'Get an item from a DynamoDB table by primary key', version: '1.0.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { region: { diff --git a/apps/sim/tools/dynamodb/introspect.ts b/apps/sim/tools/dynamodb/introspect.ts index 1771da519e2..3f102777cfc 100644 --- a/apps/sim/tools/dynamodb/introspect.ts +++ b/apps/sim/tools/dynamodb/introspect.ts @@ -1,4 +1,5 @@ import type { DynamoDBIntrospectParams, DynamoDBIntrospectResponse } from '@/tools/dynamodb/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const introspectTool: InternalToolConfig< @@ -10,6 +11,7 @@ export const introspectTool: InternalToolConfig< description: 'Introspect DynamoDB to list tables or get detailed schema information for a specific table', version: '1.0.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { region: { diff --git a/apps/sim/tools/dynamodb/put.ts b/apps/sim/tools/dynamodb/put.ts index 8e49aeecae4..c3a099527fe 100644 --- a/apps/sim/tools/dynamodb/put.ts +++ b/apps/sim/tools/dynamodb/put.ts @@ -1,4 +1,5 @@ import type { DynamoDBPutParams, DynamoDBPutResponse } from '@/tools/dynamodb/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const putTool: InternalToolConfig = { @@ -6,6 +7,7 @@ export const putTool: InternalToolConfig name: 'DynamoDB Put', description: 'Put an item into a DynamoDB table', version: '1.0.0', + oauth: AWS_CREDENTIAL_OAUTH, params: { region: { diff --git a/apps/sim/tools/dynamodb/query.ts b/apps/sim/tools/dynamodb/query.ts index e283a897744..d7c70462afd 100644 --- a/apps/sim/tools/dynamodb/query.ts +++ b/apps/sim/tools/dynamodb/query.ts @@ -1,4 +1,5 @@ import type { DynamoDBQueryParams, DynamoDBQueryResponse } from '@/tools/dynamodb/types' +import { AWS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials' import type { InternalToolConfig } from '@/tools/types' export const queryTool: InternalToolConfig = { @@ -6,6 +7,7 @@ export const queryTool: InternalToolConfig = { @@ -6,6 +7,7 @@ export const scanTool: InternalToolConfig = { @@ -6,6 +7,7 @@ export const updateTool: InternalToolConfig = { @@ -11,6 +12,7 @@ export const createTagsTool: InternalToolConfig = { @@ -7,6 +8,7 @@ export const deleteTagsTool: InternalToolConfig = @@ -8,6 +9,7 @@ export const deleteVolumeTool: InternalToolConfig = @@ -13,6 +14,7 @@ export const describeVpcsTool: InternalToolConfig = JSON.parse( - '{"a2a_cancel_task":{"id":"a2a_cancel_task","name":"A2A Cancel Task","description":"Request cancellation of an in-progress A2A task.","version":"1.0.0","params":{"agentUrl":{"type":"string","required":true,"visibility":"user-only","description":"The A2A agent endpoint URL"},"taskId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The task ID to cancel"},"apiKey":{"type":"string","required":false,"visibility":"user-only","description":"API key for authentication (if required)"}},"hostedApiKey":"none"},"a2a_get_agent_card":{"id":"a2a_get_agent_card","name":"A2A Get Agent Card","description":"Fetch the Agent Card (discovery document) for an external A2A agent.","version":"1.0.0","params":{"agentUrl":{"type":"string","required":true,"visibility":"user-only","description":"The A2A agent endpoint URL"},"apiKey":{"type":"string","required":false,"visibility":"user-only","description":"API key for authentication (if required)"}},"hostedApiKey":"none"},"a2a_get_task":{"id":"a2a_get_task","name":"A2A Get Task","description":"Retrieve the current state and result of an A2A task.","version":"1.0.0","params":{"agentUrl":{"type":"string","required":true,"visibility":"user-only","description":"The A2A agent endpoint URL"},"taskId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The task ID to retrieve"},"historyLength":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of history messages to include"},"apiKey":{"type":"string","required":false,"visibility":"user-only","description":"API key for authentication (if required)"}},"hostedApiKey":"none"},"a2a_send_message":{"id":"a2a_send_message","name":"A2A Send Message","description":"Send a message to an external A2A agent and return its response.","version":"1.0.0","params":{"agentUrl":{"type":"string","required":true,"visibility":"user-only","description":"The A2A agent endpoint URL"},"message":{"type":"string","required":true,"visibility":"user-or-llm","description":"The message text to send"},"data":{"type":"json","required":false,"visibility":"user-or-llm","description":"Optional structured JSON data to attach"},"files":{"type":"json","required":false,"visibility":"user-or-llm","description":"Optional files to attach"},"taskId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Existing task ID to continue"},"contextId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Conversation context ID to continue"},"apiKey":{"type":"string","required":false,"visibility":"user-only","description":"API key for authentication (if required)"}},"hostedApiKey":"none"},"affinity_batch_update_entity_fields":{"id":"affinity_batch_update_entity_fields","name":"Affinity Batch Update Entity Fields","description":"Write up to 100 non-list field values on one company or person in a single request.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"entityType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Which entity to write the fields on: companies or persons"},"entityId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of that company or person"},"updates":{"type":"json","required":true,"visibility":"user-or-llm","description":"Up to 100 field updates as [{\\"id\\":\\"\\",\\"value\\":{\\"type\\":\\"…\\",\\"data\\":…}}], using the same value shapes as a single field update"}},"hostedApiKey":"none"},"affinity_batch_update_list_entry_fields":{"id":"affinity_batch_update_list_entry_fields","name":"Affinity Batch Update List Entry Fields","description":"Write up to 100 field values on one list row in a single request. Requires the \\"Export data from Lists\\" permission.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID"},"listEntryId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list entry ID"},"updates":{"type":"json","required":true,"visibility":"user-or-llm","description":"Up to 100 field updates as [{\\"id\\":\\"\\",\\"value\\":{\\"type\\":\\"…\\",\\"data\\":…}}], using the same value shapes as a single field update"}},"hostedApiKey":"none"},"affinity_create_list":{"id":"affinity_create_list","name":"Affinity Create List","description":"Create a list. Its type fixes which entities it can hold, and the API key holder becomes its creator and owner.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"name":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the new list"},"type":{"type":"string","required":true,"visibility":"user-or-llm","description":"Entity kind the list holds: company, opportunity, or person"},"isPublic":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Whether everyone in the organization can see the list"}},"hostedApiKey":"none"},"affinity_create_list_field_dropdown_option":{"id":"affinity_create_list_field_dropdown_option","name":"Affinity Create List Field Dropdown Option","description":"Add a selectable option to a dropdown field on a list. A ranked or status option also needs a rank and a color.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID"},"fieldId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The dropdown field ID on that list"},"type":{"type":"string","required":true,"visibility":"user-or-llm","description":"Kind of option to create, matching the field. dropdown takes only a label; ranked-dropdown also requires rank and color; status-dropdown additionally requires a status category. Sending a field the kind does not accept is rejected"},"text":{"type":"string","required":true,"visibility":"user-or-llm","description":"The option label"},"rank":{"type":"number","required":false,"visibility":"user-or-llm","description":"Sort order. Required on a ranked-dropdown or status-dropdown option"},"color":{"type":"string","required":false,"visibility":"user-or-llm","description":"Option color: white, gray, blue, green, purple, orange, or red. Required on a ranked-dropdown or status-dropdown option"},"statusCategory":{"type":"string","required":false,"visibility":"user-or-llm","description":"Pipeline meaning of the option: open, won, lost, or on-hold. Status-dropdown options only"},"winRate":{"type":"number","required":false,"visibility":"user-or-llm","description":"Expected win rate of the status. Status-dropdown options only"}},"hostedApiKey":"none"},"affinity_create_merge":{"id":"affinity_create_merge","name":"Affinity Create Merge","description":"Fold a duplicate company or person into the record you are keeping. The merge runs asynchronously — poll the returned task to see it finish. Requires the \\"Manage duplicates\\" permission and an admin role.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"entityType":{"type":"string","required":true,"visibility":"user-or-llm","description":"What to merge: companies or persons"},"primaryId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the record to keep"},"duplicateId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the duplicate record to fold in"}},"hostedApiKey":"none"},"affinity_create_note":{"id":"affinity_create_note","name":"Affinity Create Note","description":"Write a note — attached to companies, persons, and opportunities, anchored to a meeting, call, or chat message, or posted as a reply to an existing note.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"type":{"type":"string","required":true,"visibility":"user-or-llm","description":"Note shape: entities to attach it to records, interaction to anchor it to a meeting, call, or chat message, or user-reply to reply to a note"},"html":{"type":"string","required":true,"visibility":"user-or-llm","description":"The note body as HTML"},"companyIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Companies to attach the note to, e.g. [1, 2]. Not used on a reply"},"personIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Persons to attach the note to, e.g. [1, 2]. Not used on a reply"},"opportunityIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Opportunities to attach the note to, e.g. [1, 2]. Not used on a reply"},"interactionId":{"type":"string","required":false,"visibility":"user-or-llm","description":"The interaction to anchor the note to. Required for an interaction note"},"interactionType":{"type":"string","required":false,"visibility":"user-or-llm","description":"Kind of the anchoring interaction: meeting, call, or chat-message. Required for an interaction note"},"parentId":{"type":"string","required":false,"visibility":"user-or-llm","description":"The note being replied to. Required for a user-reply note"},"creatorId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Attribute the note to another internal person. Defaults to the API key holder"},"createdAt":{"type":"string","required":false,"visibility":"user-or-llm","description":"Backdate the note to this ISO 8601 timestamp"}},"hostedApiKey":"none"},"affinity_create_reminder":{"id":"affinity_create_reminder","name":"Affinity Create Reminder","description":"Create a reminder on one company, person, or opportunity. A recurring reminder resets whenever the chosen signal happens instead of firing once.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"type":{"type":"string","required":true,"visibility":"user-or-llm","description":"one-time to fire once, or recurring to reset on a signal"},"entityType":{"type":"string","required":true,"visibility":"user-or-llm","description":"What the reminder is about: company, person, or opportunity"},"entityId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of that company, person, or opportunity"},"dueDate":{"type":"string","required":false,"visibility":"user-or-llm","description":"When the reminder is due, as an ISO 8601 timestamp. Required for a one-time reminder; on a recurring one Affinity computes it from the period when omitted"},"content":{"type":"string","required":false,"visibility":"user-or-llm","description":"What the reminder says"},"ownerId":{"type":"string","required":true,"visibility":"user-or-llm","description":"User the reminder is assigned to. Must be an internal user. The API key holder is recorded as the creator, which is a separate field"},"resetTrigger":{"type":"string","required":false,"visibility":"user-or-llm","description":"What restarts a recurring reminder: interaction, email, or event. Required when the type is recurring"},"periodDays":{"type":"number","required":false,"visibility":"user-or-llm","description":"Days between firings of a recurring reminder. Required when the type is recurring"}},"hostedApiKey":"none"},"affinity_delete_list_field_dropdown_option":{"id":"affinity_delete_list_field_dropdown_option","name":"Affinity Delete List Field Dropdown Option","description":"Permanently delete a dropdown option on a list field. Every list entry currently set to it is cleared, and those values cannot be recovered.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID"},"fieldId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The dropdown field ID on that list"},"dropdownOptionId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The dropdown option ID to delete"}},"hostedApiKey":"none"},"affinity_delete_note":{"id":"affinity_delete_note","name":"Affinity Delete Note","description":"Delete a note you created. Deleting a root note also deletes its replies; deleting a reply removes only that reply.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"noteId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The note ID to delete"}},"hostedApiKey":"none"},"affinity_get_company":{"id":"affinity_get_company","name":"Affinity Get Company","description":"Look up one company by ID. Field data is returned only for the Field IDs or Field Types asked for.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"companyId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The company ID"},"fieldIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field IDs to return values for, e.g. [\\"affinity-data-location\\"]. Mutually exclusive with Field Types"},"fieldTypes":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field categories to return values for: enriched, global, or relationship-intelligence. Mutually exclusive with Field IDs"}},"hostedApiKey":"none"},"affinity_get_current_user":{"id":"affinity_get_current_user","name":"Affinity Get Current User","description":"Verify an Affinity API key and return the tenant, the user behind the key, and the scopes the grant carries.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"}},"hostedApiKey":"none"},"affinity_get_entity_field_value":{"id":"affinity_get_entity_field_value","name":"Affinity Get Entity Field Value","description":"Read one non-list field value from a company or person.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"entityType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Which entity to read the field from: companies or persons"},"entityId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of that company or person"},"fieldId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The field ID to read"}},"hostedApiKey":"none"},"affinity_get_list":{"id":"affinity_get_list","name":"Affinity Get List","description":"Read one list — its name, type, owner, and privacy setting.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID"}},"hostedApiKey":"none"},"affinity_get_list_entry":{"id":"affinity_get_list_entry","name":"Affinity Get List Entry","description":"Read one row of a list with its entity. Field data is returned only for the Field IDs or Field Types asked for.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID"},"listEntryId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list entry ID"},"fieldIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field IDs to return values for, e.g. [\\"affinity-data-location\\"]. Mutually exclusive with Field Types"},"fieldTypes":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field categories to return values for: enriched, global, list, or relationship-intelligence. Mutually exclusive with Field IDs"}},"hostedApiKey":"none"},"affinity_get_list_entry_field":{"id":"affinity_get_list_entry_field","name":"Affinity Get List Entry Field","description":"Read one field value on a list row.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID"},"listEntryId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list entry ID"},"fieldId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The field ID to read"}},"hostedApiKey":"none"},"affinity_get_list_field_dropdown_option":{"id":"affinity_get_list_field_dropdown_option","name":"Affinity Get List Field Dropdown Option","description":"Read one dropdown option on a list field.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID"},"fieldId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The dropdown field ID on that list"},"dropdownOptionId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The dropdown option ID"}},"hostedApiKey":"none"},"affinity_get_merge":{"id":"affinity_get_merge","name":"Affinity Get Merge","description":"Read the status of one company or person merge, including why it failed if it did.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"entityType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Which merge to read: companies or persons"},"mergeId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The merge ID"}},"hostedApiKey":"none"},"affinity_get_merge_task":{"id":"affinity_get_merge_task","name":"Affinity Get Merge Task","description":"Read one merge task and how its merges are progressing. Poll this after starting a merge.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"entityType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Which merge task to read: companies or persons"},"taskId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The merge task ID"}},"hostedApiKey":"none"},"affinity_get_note":{"id":"affinity_get_note","name":"Affinity Get Note","description":"Read one note with its body, author, mentions, and attached records.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"noteId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The note ID"},"includes":{"type":"json","required":false,"visibility":"user-or-llm","description":"Extra properties to return, e.g. [\\"repliesCount\\",\\"personsPreview\\",\\"companiesPreview\\",\\"opportunitiesPreview\\"]. Those four fields are omitted unless requested here"}},"hostedApiKey":"none"},"affinity_get_opportunity":{"id":"affinity_get_opportunity","name":"Affinity Get Opportunity","description":"Read one opportunity and the list it belongs to. Its field data lives on the list entry.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"opportunityId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The opportunity ID"}},"hostedApiKey":"none"},"affinity_get_person":{"id":"affinity_get_person","name":"Affinity Get Person","description":"Look up one person by ID. Field data is returned only for the Field IDs or Field Types asked for.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"personId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The person ID"},"fieldIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field IDs to return values for, e.g. [\\"affinity-data-location\\"]. Mutually exclusive with Field Types"},"fieldTypes":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field categories to return values for: enriched, global, or relationship-intelligence. Mutually exclusive with Field IDs"}},"hostedApiKey":"none"},"affinity_get_saved_view":{"id":"affinity_get_saved_view","name":"Affinity Get Saved View","description":"Read one saved view — its name, kind, and creation date.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID"},"viewId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The saved view ID"}},"hostedApiKey":"none"},"affinity_get_transcript":{"id":"affinity_get_transcript","name":"Affinity Get Transcript","description":"Read one transcript with its first 100 fragments. Page the fragments endpoint for a longer meeting.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"transcriptId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The transcript ID"}},"hostedApiKey":"none"},"affinity_get_user":{"id":"affinity_get_user","name":"Affinity Get User","description":"Read one internal user. A user and their person record share the same numeric ID, so a person ID works here.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"userId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The user ID, which is also their person ID"}},"hostedApiKey":"none"},"affinity_list_calls":{"id":"affinity_list_calls","name":"Affinity List Calls","description":"Page through logged calls and their participants. Only calls the API key holder can see are returned.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"filter":{"type":"string","required":false,"visibility":"user-or-llm","description":"Affinity Filtering Language expression, e.g. \\"createdAt>=2026-01-01\\""},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_chat_messages":{"id":"affinity_list_chat_messages","name":"Affinity List Chat Messages","description":"Page through logged chat messages and their participants. Only messages the API key holder can see are returned.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"filter":{"type":"string","required":false,"visibility":"user-or-llm","description":"Affinity Filtering Language expression, e.g. \\"createdAt>=2026-01-01\\""},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_companies":{"id":"affinity_list_companies","name":"Affinity List Companies","description":"Page through companies. Companies come back without field data unless Field IDs or Field Types asks for it.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"ids":{"type":"json","required":false,"visibility":"user-or-llm","description":"Restrict the page to these company IDs, e.g. [1, 2, 3]"},"fieldIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field IDs to return values for, e.g. [\\"affinity-data-location\\"]. Mutually exclusive with Field Types"},"fieldTypes":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field categories to return values for: enriched, global, or relationship-intelligence. Mutually exclusive with Field IDs"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_coworker_connections":{"id":"affinity_list_coworker_connections","name":"Affinity List Coworker Connections","description":"Find warm paths into a company through shared work history: who in your Affinity data once worked alongside the people you want to reach. Grouped by target, strongest first.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"filter":{"type":"string","required":true,"visibility":"user-or-llm","description":"Required scope. The only supported filter is target.currentCompany.id, e.g. \\"target.currentCompany.id=123\\""},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of targets to return per page, 1-50. Defaults to 20"},"totalCount":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Include the total size of the collection. Costs an extra query"}},"hostedApiKey":"none"},"affinity_list_emails":{"id":"affinity_list_emails","name":"Affinity List Emails","description":"Page through email metadata — subject, participants, and timestamps. Affinity never exposes email bodies through the API.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"filter":{"type":"string","required":false,"visibility":"user-or-llm","description":"Affinity Filtering Language expression, e.g. \\"createdAt>=2026-01-01\\""},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_entity_field_values":{"id":"affinity_list_entity_field_values","name":"Affinity List Entity Field Values","description":"Page through a company\'s or person\'s non-list field values. List fields are not returned here — read those through the list entry.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"entityType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Which entity to read field values from: companies or persons"},"entityId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of that company or person"},"ids":{"type":"json","required":false,"visibility":"user-or-llm","description":"Restrict to these field IDs. Mutually exclusive with Field Types"},"types":{"type":"json","required":false,"visibility":"user-or-llm","description":"Restrict to these field categories: enriched, global, relationship-intelligence. Mutually exclusive with Field IDs"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 20"}},"hostedApiKey":"none"},"affinity_list_entity_list_entries":{"id":"affinity_list_entity_list_entries","name":"Affinity List Entity List Entries","description":"Page through a company\'s or person\'s rows across every list, each carrying that list\'s field values and when the entity was added.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"entityType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Which entity to look up the rows of: companies or persons"},"entityId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of that company or person"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_entity_lists":{"id":"affinity_list_entity_lists","name":"Affinity List Entity Lists","description":"List every list a company or person appears on that the caller can view.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"entityType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Which entity to look up the lists of: companies or persons"},"entityId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of that company or person"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_entity_notes":{"id":"affinity_list_entity_notes","name":"Affinity List Entity Notes","description":"List the notes relevant to one company, person, or opportunity — directly attached notes plus notes reaching it through its people and meetings.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"entityType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Which entity the notes hang off: companies, persons, or opportunities"},"entityId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of that company, person, or opportunity"},"filter":{"type":"string","required":false,"visibility":"user-or-llm","description":"Affinity Filtering Language expression, e.g. \\"createdAt>=2026-01-01\\""},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"},"totalCount":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Include the total size of the collection. Costs an extra query"}},"hostedApiKey":"none"},"affinity_list_entity_relationships":{"id":"affinity_list_entity_relationships","name":"Affinity List Entity Relationships","description":"List who knows a company or person, scored 0.0 to 1.0 by how much the two actually interact. Strongest first by default.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"entityType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Which entity to look up relationships for: companies or persons"},"entityId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of that company or person"},"filter":{"type":"string","required":false,"visibility":"user-or-llm","description":"Affinity Filtering Language expression. This endpoint filters on interactionScore only, e.g. \\"interactionScore>=0.5\\""},"orderBy":{"type":"json","required":false,"visibility":"user-or-llm","description":"Sort order: [\\"interactionScore\\"] for weakest first, [\\"-interactionScore\\"] for strongest first (the default)"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"},"totalCount":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Include the total size of the collection. Costs an extra query"}},"hostedApiKey":"none"},"affinity_list_field_dropdown_options":{"id":"affinity_list_field_dropdown_options","name":"Affinity List Field Dropdown Options","description":"List the selectable options on a dropdown or ranked-dropdown company or person field. Writing such a field needs the option ID, not its text.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"entityType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Which field family the field belongs to: companies or persons"},"fieldId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The dropdown or ranked-dropdown field ID"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_field_metadata":{"id":"affinity_list_field_metadata","name":"Affinity List Field Metadata","description":"List the non-list company or person fields, with the value type, filter operators, and sort support of each. Start here to find the Field IDs the read and write tools take.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"entityType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Which fields to describe: companies or persons"},"includes":{"type":"json","required":false,"visibility":"user-or-llm","description":"Extra properties to return: [\\"filterability\\",\\"sortability\\"]. Both are omitted unless requested here"},"filter":{"type":"string","required":false,"visibility":"user-or-llm","description":"Affinity Filtering Language expression. This endpoint filters on name only, e.g. \\"name=~Status\\""},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_field_value_changes":{"id":"affinity_list_field_value_changes","name":"Affinity List Field Value Changes","description":"Page through field value changes across the whole workspace. Built for delta sync: follow nextCursor to the end of a run, then resume from the last cursor next time.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"filter":{"type":"string","required":false,"visibility":"user-or-llm","description":"Affinity Filtering Language expression over field.id, listEntry.id, changer.id, changedAt, or actionType. Resume a sync with e.g. \\"changedAt>2026-06-01T12:00:00Z\\""},"orderBy":{"type":"json","required":false,"visibility":"user-or-llm","description":"Sort order: [\\"changedAt\\"] for oldest first (the default), [\\"-changedAt\\"] for newest first"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_investor_executive_connections":{"id":"affinity_list_investor_executive_connections","name":"Affinity List Investor Executive Connections","description":"Find warm paths into a company through investment history: which investors in your Affinity data backed a company the people you want to reach once led. Grouped by target, strongest first.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"filter":{"type":"string","required":true,"visibility":"user-or-llm","description":"Required scope. The only supported filter is target.currentCompany.id, e.g. \\"target.currentCompany.id=123\\""},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of targets to return per page, 1-50. Defaults to 20"},"totalCount":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Include the total size of the collection. Costs an extra query"}},"hostedApiKey":"none"},"affinity_list_list_entries":{"id":"affinity_list_list_entries","name":"Affinity List List Entries","description":"Page through the rows of a list. Rows come back without field data unless Field IDs or Field Types asks for it.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID"},"fieldIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field IDs to return values for, e.g. [\\"affinity-data-location\\"]. Mutually exclusive with Field Types"},"fieldTypes":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field categories to return values for: enriched, global, list, or relationship-intelligence. Mutually exclusive with Field IDs"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_list_entry_field_value_changes":{"id":"affinity_list_list_entry_field_value_changes","name":"Affinity List List Entry Field Value Changes","description":"Page through the history of one list row — who changed which field, when, and to what.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID"},"listEntryId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list entry ID"},"filter":{"type":"string","required":false,"visibility":"user-or-llm","description":"Affinity Filtering Language expression over field.id, changer.id, changedAt, or actionType, e.g. \\"field.id=field-1234\\""},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_list_entry_fields":{"id":"affinity_list_list_entry_fields","name":"Affinity List List Entry Fields","description":"Page through every field value on one list row, including the list-specific columns. All fields are returned unless narrowed.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID"},"listEntryId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list entry ID"},"ids":{"type":"json","required":false,"visibility":"user-or-llm","description":"Restrict to these field IDs. Mutually exclusive with Field Types"},"types":{"type":"json","required":false,"visibility":"user-or-llm","description":"Restrict to these field categories: enriched, global, list, relationship-intelligence. Mutually exclusive with Field IDs"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 20"}},"hostedApiKey":"none"},"affinity_list_list_field_dropdown_options":{"id":"affinity_list_list_field_dropdown_options","name":"Affinity List List Field Dropdown Options","description":"List the selectable options on a dropdown, ranked-dropdown, or status-dropdown field of a list.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID"},"fieldId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The dropdown field ID on that list"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_list_fields":{"id":"affinity_list_list_fields","name":"Affinity List List Fields","description":"List the fields available on one list, including its list-specific columns. Use these Field IDs when reading or writing list entries.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID"},"includes":{"type":"json","required":false,"visibility":"user-or-llm","description":"Extra properties to return: [\\"filterability\\",\\"sortability\\"]. Both are omitted unless requested here"},"filter":{"type":"string","required":false,"visibility":"user-or-llm","description":"Affinity Filtering Language expression. This endpoint filters on name only, e.g. \\"name=~Stage\\""},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_lists":{"id":"affinity_list_lists","name":"Affinity List Lists","description":"Page through the lists in the organization that the caller can view.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"term":{"type":"string","required":false,"visibility":"user-or-llm","description":"Case-insensitive substring match on the list name"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_meetings":{"id":"affinity_list_meetings","name":"Affinity List Meetings","description":"Page through past and upcoming meetings with their organizer and attendees.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"filter":{"type":"string","required":false,"visibility":"user-or-llm","description":"Affinity Filtering Language expression, e.g. \\"createdAt>=2026-01-01\\""},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_merge_tasks":{"id":"affinity_list_merge_tasks","name":"Affinity List Merge Tasks","description":"Page through merge tasks, each summarizing how many of its merges are in progress, succeeded, or failed.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"entityType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Which merge tasks to list: companies or persons"},"filter":{"type":"string","required":false,"visibility":"user-or-llm","description":"Affinity Filtering Language expression. This endpoint filters on status only, e.g. \\"status=in-progress\\""},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_merges":{"id":"affinity_list_merges","name":"Affinity List Merges","description":"Page through the company or person merges the organization has run, with the status and the records involved in each.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"entityType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Which merges to list: companies or persons"},"filter":{"type":"string","required":false,"visibility":"user-or-llm","description":"Affinity Filtering Language expression over status or taskId, e.g. \\"status=failed\\""},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_note_attached_companies":{"id":"affinity_list_note_attached_companies","name":"Affinity List Note Attached Companies","description":"List the companies directly attached to one note.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"noteId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The note ID"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"},"totalCount":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Include the total size of the collection. Costs an extra query"}},"hostedApiKey":"none"},"affinity_list_note_attached_opportunities":{"id":"affinity_list_note_attached_opportunities","name":"Affinity List Note Attached Opportunities","description":"List the opportunities directly attached to one note.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"noteId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The note ID"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"},"totalCount":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Include the total size of the collection. Costs an extra query"}},"hostedApiKey":"none"},"affinity_list_note_attached_persons":{"id":"affinity_list_note_attached_persons","name":"Affinity List Note Attached Persons","description":"List the persons directly attached to one note.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"noteId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The note ID"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"},"totalCount":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Include the total size of the collection. Costs an extra query"}},"hostedApiKey":"none"},"affinity_list_note_replies":{"id":"affinity_list_note_replies","name":"Affinity List Note Replies","description":"Page through the replies on one note, including AI Notetaker replies.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"noteId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The note ID whose replies to read"},"filter":{"type":"string","required":false,"visibility":"user-or-llm","description":"Affinity Filtering Language expression, e.g. \\"createdAt>=2026-01-01\\""},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"},"totalCount":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Include the total size of the collection. Costs an extra query"}},"hostedApiKey":"none"},"affinity_list_notes":{"id":"affinity_list_notes","name":"Affinity List Notes","description":"Page through every note the caller can see. Replies are excluded.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"includes":{"type":"json","required":false,"visibility":"user-or-llm","description":"Extra properties to return, e.g. [\\"repliesCount\\",\\"personsPreview\\",\\"companiesPreview\\",\\"opportunitiesPreview\\"]. Those four fields are omitted unless requested here"},"filter":{"type":"string","required":false,"visibility":"user-or-llm","description":"Affinity Filtering Language expression, e.g. \\"createdAt>=2026-01-01\\""},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"},"totalCount":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Include the total size of the collection. Costs an extra query"}},"hostedApiKey":"none"},"affinity_list_opportunities":{"id":"affinity_list_opportunities","name":"Affinity List Opportunities","description":"Page through opportunities. Field data lives on the list entry, not here — read it through the list or saved view the opportunity belongs to.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"ids":{"type":"json","required":false,"visibility":"user-or-llm","description":"Restrict the page to these opportunity IDs, e.g. [1, 2, 3]"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_persons":{"id":"affinity_list_persons","name":"Affinity List Persons","description":"Page through persons. Persons come back without field data unless Field IDs or Field Types asks for it.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"ids":{"type":"json","required":false,"visibility":"user-or-llm","description":"Restrict the page to these person IDs, e.g. [1, 2, 3]"},"fieldIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field IDs to return values for, e.g. [\\"affinity-data-location\\"]. Mutually exclusive with Field Types"},"fieldTypes":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field categories to return values for: enriched, global, or relationship-intelligence. Mutually exclusive with Field IDs"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_reminders":{"id":"affinity_list_reminders","name":"Affinity List Reminders","description":"Page through the reminders the caller can see. Filter by status to surface what is overdue.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"filter":{"type":"string","required":false,"visibility":"user-or-llm","description":"Affinity Filtering Language expression, e.g. \\"createdAt>=2026-01-01\\""},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"},"totalCount":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Include the total size of the collection. Costs an extra query"}},"hostedApiKey":"none"},"affinity_list_saved_view_entries":{"id":"affinity_list_saved_view_entries","name":"Affinity List Saved View Entries","description":"Page through the rows of a saved view. The view\'s own filters and columns decide which rows and which field data come back.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID"},"viewId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The saved view ID"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_saved_views":{"id":"affinity_list_saved_views","name":"Affinity List Saved Views","description":"List the saved views on a list that the caller can view.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_transcript_fragments":{"id":"affinity_list_transcript_fragments","name":"Affinity List Transcript Fragments","description":"Page through everything said in a meeting, segment by segment with the speaker.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"transcriptId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The transcript ID"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"},"totalCount":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Include the total size of the collection. Costs an extra query"}},"hostedApiKey":"none"},"affinity_list_transcripts":{"id":"affinity_list_transcripts","name":"Affinity List Transcripts","description":"Page through meeting transcript metadata. Read one transcript to get what was actually said.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"filter":{"type":"string","required":false,"visibility":"user-or-llm","description":"Affinity Filtering Language expression, e.g. \\"createdAt>=2026-01-01\\""},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"},"totalCount":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Include the total size of the collection. Costs an extra query"}},"hostedApiKey":"none"},"affinity_list_users":{"id":"affinity_list_users","name":"Affinity List Users","description":"Page through the internal users in the organization. Email addresses and roles are returned only to callers with the \\"Manage Users\\" permission.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"term":{"type":"string","required":false,"visibility":"user-or-llm","description":"Case-insensitive match across first name, last name, and primary email"},"filter":{"type":"string","required":false,"visibility":"user-or-llm","description":"Affinity Filtering Language expression over id or status, e.g. \\"status=active\\""},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_search_companies":{"id":"affinity_search_companies","name":"Affinity Search Companies","description":"Search companies by filters, sorts, and a free-text term. Requires the \\"Export All Organizations directory\\" permission.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"filters":{"type":"json","required":false,"visibility":"user-or-llm","description":"Filter group as {operator: \\"and\\"|\\"or\\", filters: [...]}, at most 50 leaves. Each leaf is {valueType, fieldId, operator, value}, and a leaf may itself be a nested group"},"searchTerm":{"type":"string","required":false,"visibility":"user-or-llm","description":"Free-text term matched against the searchable fields. At least 3 characters"},"searchFieldIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field IDs the search term is matched against. Defaults to the searchable fields"},"sorts":{"type":"json","required":false,"visibility":"user-or-llm","description":"Sort order as [{fieldId, direction: \\"asc\\"|\\"desc\\", attributeId?}], up to 5, applied in order"},"fieldIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field IDs to return values for, e.g. [\\"affinity-data-location\\"]. Mutually exclusive with Field Types"},"fieldTypes":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field categories to return values for: enriched, global, or relationship-intelligence. Mutually exclusive with Field IDs"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"},"totalCount":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Include the total size of the collection. Costs an extra query"}},"hostedApiKey":"none"},"affinity_search_files":{"id":"affinity_search_files","name":"Affinity Search Files","description":"Search files by keyword, ordered by relevance. Narrow to specific files or to one company, or leave both unset to search the whole account.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"prompt":{"type":"string","required":true,"visibility":"user-or-llm","description":"What to search for. Between 3 and 500 characters"},"ids":{"type":"json","required":false,"visibility":"user-or-llm","description":"Restrict the search to these file IDs. Cannot be combined with Company ID"},"companyId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Restrict the search to one company\'s files. Cannot be combined with file IDs"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of files to return, 1-100. Defaults to 20"}},"hostedApiKey":"none"},"affinity_search_list_entries":{"id":"affinity_search_list_entries","name":"Affinity Search List Entries","description":"Search the rows of one list by filters, sorts, and a free-text term. Requires the \\"Export data from Lists\\" permission.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID to search"},"filters":{"type":"json","required":false,"visibility":"user-or-llm","description":"Filter group as {operator: \\"and\\"|\\"or\\", filters: [...]}, at most 50 leaves. Each leaf is {valueType, fieldId, operator, value}, and a leaf may itself be a nested group"},"searchTerm":{"type":"string","required":false,"visibility":"user-or-llm","description":"Free-text term matched against the searchable fields. At least 3 characters"},"searchFieldIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field IDs the search term is matched against. Defaults to the searchable fields"},"sorts":{"type":"json","required":false,"visibility":"user-or-llm","description":"Sort order as [{fieldId, direction: \\"asc\\"|\\"desc\\", attributeId?}], up to 5, applied in order"},"fieldIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field IDs to return values for, e.g. [\\"affinity-data-location\\"]. Mutually exclusive with Field Types"},"fieldTypes":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field categories to return values for: enriched, global, list, or relationship-intelligence. Mutually exclusive with Field IDs"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"},"totalCount":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Include the total size of the collection. Costs an extra query"}},"hostedApiKey":"none"},"affinity_search_notes":{"id":"affinity_search_notes","name":"Affinity Search Notes","description":"Search notes by keyword, ordered by relevance. Narrow to specific notes or to one company, or leave both unset to search the whole account.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"prompt":{"type":"string","required":true,"visibility":"user-or-llm","description":"What to search for. Between 3 and 500 characters"},"ids":{"type":"json","required":false,"visibility":"user-or-llm","description":"Restrict the search to these note IDs. Cannot be combined with Company ID"},"companyId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Restrict the search to one company\'s notes. Cannot be combined with note IDs"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of notes to return, 1-100. Defaults to 20"}},"hostedApiKey":"none"},"affinity_search_persons":{"id":"affinity_search_persons","name":"Affinity Search Persons","description":"Search persons by filters, sorts, and a free-text term. Requires the \\"Export All People directory\\" permission.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"filters":{"type":"json","required":false,"visibility":"user-or-llm","description":"Filter group as {operator: \\"and\\"|\\"or\\", filters: [...]}, at most 50 leaves. Each leaf is {valueType, fieldId, operator, value}, and a leaf may itself be a nested group"},"searchTerm":{"type":"string","required":false,"visibility":"user-or-llm","description":"Free-text term matched against the searchable fields. At least 3 characters"},"searchFieldIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field IDs the search term is matched against. Defaults to the searchable fields"},"sorts":{"type":"json","required":false,"visibility":"user-or-llm","description":"Sort order as [{fieldId, direction: \\"asc\\"|\\"desc\\", attributeId?}], up to 5, applied in order"},"fieldIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field IDs to return values for, e.g. [\\"affinity-data-location\\"]. Mutually exclusive with Field Types"},"fieldTypes":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field categories to return values for: enriched, global, or relationship-intelligence. Mutually exclusive with Field IDs"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"},"totalCount":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Include the total size of the collection. Costs an extra query"}},"hostedApiKey":"none"},"affinity_semantic_search":{"id":"affinity_semantic_search","name":"Affinity Semantic Search","description":"Find companies from a description in plain language — industry, technology, stage, or business model. Currently searches companies only.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"prompt":{"type":"string","required":true,"visibility":"user-or-llm","description":"What to look for, in plain language, e.g. \\"climate tech companies in our pipeline\\". Up to 500 characters"},"listIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Restrict the search to companies on these lists, e.g. [1, 2]"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of companies to return, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_update_entity_field_value":{"id":"affinity_update_entity_field_value","name":"Affinity Update Entity Field Value","description":"Write one non-list field value on a company or person. The value type must match how the field is defined.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"entityType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Which entity to write the field on: companies or persons"},"entityId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of that company or person"},"fieldId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The field ID to write"},"value":{"type":"json","required":true,"visibility":"user-or-llm","description":"The new value as {type, data}, where type matches the field\'s value type. Examples: {\\"type\\":\\"text\\",\\"data\\":\\"Series B\\"}, {\\"type\\":\\"number\\",\\"data\\":42}, {\\"type\\":\\"dropdown\\",\\"data\\":{\\"dropdownOptionId\\":7}}, {\\"type\\":\\"person\\",\\"data\\":{\\"id\\":123}}, {\\"type\\":\\"person-multi\\",\\"data\\":[{\\"id\\":123}]}. Pass data as null to clear the field"}},"hostedApiKey":"none"},"affinity_update_list_entry_field":{"id":"affinity_update_list_entry_field","name":"Affinity Update List Entry Field","description":"Write one field value on a list row. Requires the \\"Export data from Lists\\" permission.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID"},"listEntryId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list entry ID"},"fieldId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The field ID to write"},"value":{"type":"json","required":true,"visibility":"user-or-llm","description":"The new value as {type, data}, where type matches the field\'s value type. Examples: {\\"type\\":\\"text\\",\\"data\\":\\"Series B\\"}, {\\"type\\":\\"number\\",\\"data\\":42}, {\\"type\\":\\"dropdown\\",\\"data\\":{\\"dropdownOptionId\\":7}}, {\\"type\\":\\"person\\",\\"data\\":{\\"id\\":123}}, {\\"type\\":\\"person-multi\\",\\"data\\":[{\\"id\\":123}]}. Pass data as null to clear the field"}},"hostedApiKey":"none"},"affinity_update_list_field_dropdown_option":{"id":"affinity_update_list_field_dropdown_option","name":"Affinity Update List Field Dropdown Option","description":"Change a dropdown option on a list field. Every field is optional — supply only what should change, and only fields the option\'s kind actually has.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID"},"fieldId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The dropdown field ID on that list"},"dropdownOptionId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The dropdown option ID to update"},"text":{"type":"string","required":false,"visibility":"user-or-llm","description":"Replacement option label. Supply at least one field to change"},"rank":{"type":"number","required":false,"visibility":"user-or-llm","description":"Sort order. Required on a ranked-dropdown or status-dropdown option"},"color":{"type":"string","required":false,"visibility":"user-or-llm","description":"Option color: white, gray, blue, green, purple, orange, or red. Required on a ranked-dropdown or status-dropdown option"},"statusCategory":{"type":"string","required":false,"visibility":"user-or-llm","description":"Pipeline meaning of the option: open, won, lost, or on-hold. Status-dropdown options only"},"winRate":{"type":"number","required":false,"visibility":"user-or-llm","description":"Expected win rate of the status. Status-dropdown options only"}},"hostedApiKey":"none"},"affinity_update_note":{"id":"affinity_update_note","name":"Affinity Update Note","description":"Rewrite a note\'s body or replace which records it is attached to. Each list of IDs replaces that association wholesale, an empty list clears it, and omitting one leaves it untouched. A note\'s type cannot be changed.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"noteId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The note ID to update"},"html":{"type":"string","required":false,"visibility":"user-or-llm","description":"Replacement note body as HTML"},"companyIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Replacement set of attached companies, e.g. [1, 2]. Send [] to detach every company; omit to leave them unchanged"},"personIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Replacement set of attached persons, e.g. [1, 2]. Send [] to detach every person; omit to leave them unchanged"},"opportunityIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Replacement set of attached opportunities, e.g. [1, 2]. Send [] to detach every opportunity; omit to leave them unchanged"}},"hostedApiKey":"none"},"agentmail_create_draft":{"id":"agentmail_create_draft","name":"Create Draft","description":"Create a new email draft in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox to create the draft in"},"to":{"type":"string","required":false,"visibility":"user-or-llm","description":"Recipient email addresses (comma-separated)"},"subject":{"type":"string","required":false,"visibility":"user-or-llm","description":"Draft subject line"},"text":{"type":"string","required":false,"visibility":"user-or-llm","description":"Plain text draft body"},"html":{"type":"string","required":false,"visibility":"user-or-llm","description":"HTML draft body"},"cc":{"type":"string","required":false,"visibility":"user-or-llm","description":"CC recipient email addresses (comma-separated)"},"bcc":{"type":"string","required":false,"visibility":"user-or-llm","description":"BCC recipient email addresses (comma-separated)"},"inReplyTo":{"type":"string","required":false,"visibility":"user-or-llm","description":"ID of message being replied to"},"sendAt":{"type":"string","required":false,"visibility":"user-or-llm","description":"ISO 8601 timestamp to schedule sending"}},"hostedApiKey":"none"},"agentmail_create_inbox":{"id":"agentmail_create_inbox","name":"Create Inbox","description":"Create a new email inbox with AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"username":{"type":"string","required":false,"visibility":"user-or-llm","description":"Username for the inbox email address"},"domain":{"type":"string","required":false,"visibility":"user-or-llm","description":"Domain for the inbox email address"},"displayName":{"type":"string","required":false,"visibility":"user-or-llm","description":"Display name for the inbox"}},"hostedApiKey":"none"},"agentmail_delete_draft":{"id":"agentmail_delete_draft","name":"Delete Draft","description":"Delete an email draft in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox containing the draft"},"draftId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the draft to delete"}},"hostedApiKey":"none"},"agentmail_delete_inbox":{"id":"agentmail_delete_inbox","name":"Delete Inbox","description":"Delete an email inbox in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox to delete"}},"hostedApiKey":"none"},"agentmail_delete_thread":{"id":"agentmail_delete_thread","name":"Delete Thread","description":"Delete an email thread in AgentMail (moves to trash, or permanently deletes if already in trash)","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox containing the thread"},"threadId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the thread to delete"},"permanent":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Force permanent deletion instead of moving to trash"}},"hostedApiKey":"none"},"agentmail_forward_message":{"id":"agentmail_forward_message","name":"Forward Message","description":"Forward an email message to new recipients in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox containing the message"},"messageId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the message to forward"},"to":{"type":"string","required":true,"visibility":"user-or-llm","description":"Recipient email addresses (comma-separated)"},"subject":{"type":"string","required":false,"visibility":"user-or-llm","description":"Override subject line"},"text":{"type":"string","required":false,"visibility":"user-or-llm","description":"Additional plain text to prepend"},"html":{"type":"string","required":false,"visibility":"user-or-llm","description":"Additional HTML to prepend"},"cc":{"type":"string","required":false,"visibility":"user-or-llm","description":"CC recipient email addresses (comma-separated)"},"bcc":{"type":"string","required":false,"visibility":"user-or-llm","description":"BCC recipient email addresses (comma-separated)"}},"hostedApiKey":"none"},"agentmail_get_draft":{"id":"agentmail_get_draft","name":"Get Draft","description":"Get details of a specific email draft in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox the draft belongs to"},"draftId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the draft to retrieve"}},"hostedApiKey":"none"},"agentmail_get_inbox":{"id":"agentmail_get_inbox","name":"Get Inbox","description":"Get details of a specific email inbox in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox to retrieve"}},"hostedApiKey":"none"},"agentmail_get_message":{"id":"agentmail_get_message","name":"Get Message","description":"Get details of a specific email message in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox containing the message"},"messageId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the message to retrieve"}},"hostedApiKey":"none"},"agentmail_get_thread":{"id":"agentmail_get_thread","name":"Get Thread","description":"Get details of a specific email thread including messages in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox containing the thread"},"threadId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the thread to retrieve"}},"hostedApiKey":"none"},"agentmail_list_drafts":{"id":"agentmail_list_drafts","name":"List Drafts","description":"List email drafts in an inbox in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox to list drafts from"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of drafts to return"},"pageToken":{"type":"string","required":false,"visibility":"user-or-llm","description":"Pagination token for next page of results"}},"hostedApiKey":"none"},"agentmail_list_inboxes":{"id":"agentmail_list_inboxes","name":"List Inboxes","description":"List all email inboxes in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of inboxes to return"},"pageToken":{"type":"string","required":false,"visibility":"user-or-llm","description":"Pagination token for next page of results"}},"hostedApiKey":"none"},"agentmail_list_messages":{"id":"agentmail_list_messages","name":"List Messages","description":"List messages in an inbox in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox to list messages from"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of messages to return"},"pageToken":{"type":"string","required":false,"visibility":"user-or-llm","description":"Pagination token for next page of results"}},"hostedApiKey":"none"},"agentmail_list_threads":{"id":"agentmail_list_threads","name":"List Threads","description":"List email threads in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox to list threads from"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of threads to return"},"pageToken":{"type":"string","required":false,"visibility":"user-or-llm","description":"Pagination token for next page of results"},"labels":{"type":"string","required":false,"visibility":"user-or-llm","description":"Comma-separated labels to filter threads by"},"before":{"type":"string","required":false,"visibility":"user-or-llm","description":"Filter threads before this ISO 8601 timestamp"},"after":{"type":"string","required":false,"visibility":"user-or-llm","description":"Filter threads after this ISO 8601 timestamp"}},"hostedApiKey":"none"},"agentmail_reply_message":{"id":"agentmail_reply_message","name":"Reply to Message","description":"Reply to an existing email message in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox to reply from"},"messageId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the message to reply to"},"text":{"type":"string","required":false,"visibility":"user-or-llm","description":"Plain text reply body"},"html":{"type":"string","required":false,"visibility":"user-or-llm","description":"HTML reply body"},"to":{"type":"string","required":false,"visibility":"user-or-llm","description":"Override recipient email addresses (comma-separated)"},"cc":{"type":"string","required":false,"visibility":"user-or-llm","description":"CC email addresses (comma-separated)"},"bcc":{"type":"string","required":false,"visibility":"user-or-llm","description":"BCC email addresses (comma-separated)"},"replyAll":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Reply to all recipients of the original message"}},"hostedApiKey":"none"},"agentmail_send_draft":{"id":"agentmail_send_draft","name":"Send Draft","description":"Send an existing email draft in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox containing the draft"},"draftId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the draft to send"}},"hostedApiKey":"none"},"agentmail_send_message":{"id":"agentmail_send_message","name":"Send Message","description":"Send an email message from an AgentMail inbox","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox to send from"},"to":{"type":"string","required":true,"visibility":"user-or-llm","description":"Recipient email address (comma-separated for multiple)"},"subject":{"type":"string","required":true,"visibility":"user-or-llm","description":"Email subject line"},"text":{"type":"string","required":false,"visibility":"user-or-llm","description":"Plain text email body"},"html":{"type":"string","required":false,"visibility":"user-or-llm","description":"HTML email body"},"cc":{"type":"string","required":false,"visibility":"user-or-llm","description":"CC recipient email addresses (comma-separated)"},"bcc":{"type":"string","required":false,"visibility":"user-or-llm","description":"BCC recipient email addresses (comma-separated)"}},"hostedApiKey":"none"},"agentmail_update_draft":{"id":"agentmail_update_draft","name":"Update Draft","description":"Update an existing email draft in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox containing the draft"},"draftId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the draft to update"},"to":{"type":"string","required":false,"visibility":"user-or-llm","description":"Recipient email addresses (comma-separated)"},"subject":{"type":"string","required":false,"visibility":"user-or-llm","description":"Draft subject line"},"text":{"type":"string","required":false,"visibility":"user-or-llm","description":"Plain text draft body"},"html":{"type":"string","required":false,"visibility":"user-or-llm","description":"HTML draft body"},"cc":{"type":"string","required":false,"visibility":"user-or-llm","description":"CC recipient email addresses (comma-separated)"},"bcc":{"type":"string","required":false,"visibility":"user-or-llm","description":"BCC recipient email addresses (comma-separated)"},"sendAt":{"type":"string","required":false,"visibility":"user-or-llm","description":"ISO 8601 timestamp to schedule sending"}},"hostedApiKey":"none"},"agentmail_update_inbox":{"id":"agentmail_update_inbox","name":"Update Inbox","description":"Update the display name of an email inbox in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox to update"},"displayName":{"type":"string","required":true,"visibility":"user-or-llm","description":"New display name for the inbox"}},"hostedApiKey":"none"},"agentmail_update_message":{"id":"agentmail_update_message","name":"Update Message","description":"Add or remove labels on an email message in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox containing the message"},"messageId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the message to update"},"addLabels":{"type":"string","required":false,"visibility":"user-or-llm","description":"Comma-separated labels to add to the message"},"removeLabels":{"type":"string","required":false,"visibility":"user-or-llm","description":"Comma-separated labels to remove from the message"}},"hostedApiKey":"none"},"agentmail_update_thread":{"id":"agentmail_update_thread","name":"Update Thread Labels","description":"Add or remove labels on an email thread in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox containing the thread"},"threadId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the thread to update"},"addLabels":{"type":"string","required":false,"visibility":"user-or-llm","description":"Comma-separated labels to add to the thread"},"removeLabels":{"type":"string","required":false,"visibility":"user-or-llm","description":"Comma-separated labels to remove from the thread"}},"hostedApiKey":"none"},"agentphone_create_call":{"id":"agentphone_create_call","name":"Create Outbound Call","description":"Initiate an outbound voice call from an AgentPhone agent","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"agentId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Agent that will handle the call"},"toNumber":{"type":"string","required":true,"visibility":"user-or-llm","description":"Phone number to call in E.164 format (e.g. +14155551234)"},"fromNumberId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Phone number ID to use as caller ID. Must belong to the agent. If omitted, the agent\'s first assigned number is used."},"initialGreeting":{"type":"string","required":false,"visibility":"user-or-llm","description":"Optional greeting spoken when the recipient answers"},"voice":{"type":"string","required":false,"visibility":"user-or-llm","description":"Voice ID override for this call (defaults to the agent\'s configured voice)"},"systemPrompt":{"type":"string","required":false,"visibility":"user-or-llm","description":"When provided, uses a built-in LLM for the conversation instead of forwarding to your webhook"}},"hostedApiKey":"none"},"agentphone_create_contact":{"id":"agentphone_create_contact","name":"Create Contact","description":"Create a new contact in AgentPhone","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"phoneNumber":{"type":"string","required":true,"visibility":"user-or-llm","description":"Phone number in E.164 format (e.g. +14155551234)"},"name":{"type":"string","required":true,"visibility":"user-or-llm","description":"Contact\'s full name"},"email":{"type":"string","required":false,"visibility":"user-or-llm","description":"Contact\'s email address"},"notes":{"type":"string","required":false,"visibility":"user-or-llm","description":"Freeform notes stored on the contact"}},"hostedApiKey":"none"},"agentphone_create_number":{"id":"agentphone_create_number","name":"Create Phone Number","description":"Provision a new SMS- and voice-enabled phone number","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"country":{"type":"string","required":false,"visibility":"user-or-llm","description":"Two-letter country code (e.g. US, CA). Defaults to US."},"areaCode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Preferred area code (US/CA only, e.g. \\"415\\"). Best-effort — may be ignored if unavailable."},"agentId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Optionally attach the number to an agent immediately"}},"hostedApiKey":"none"},"agentphone_delete_contact":{"id":"agentphone_delete_contact","name":"Delete Contact","description":"Delete a contact by ID","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"contactId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Contact ID"}},"hostedApiKey":"none"},"agentphone_get_call":{"id":"agentphone_get_call","name":"Get Call","description":"Fetch a call and its full transcript","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"callId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the call to retrieve"}},"hostedApiKey":"none"},"agentphone_get_call_transcript":{"id":"agentphone_get_call_transcript","name":"Get Call Transcript","description":"Get the full ordered transcript for a call","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"callId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the call to retrieve the transcript for"}},"hostedApiKey":"none"},"agentphone_get_contact":{"id":"agentphone_get_contact","name":"Get Contact","description":"Fetch a single contact by ID","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"contactId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Contact ID"}},"hostedApiKey":"none"},"agentphone_get_conversation":{"id":"agentphone_get_conversation","name":"Get Conversation","description":"Get a conversation along with its recent messages","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"conversationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Conversation ID"},"messageLimit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of recent messages to include (default 50, max 100)"}},"hostedApiKey":"none"},"agentphone_get_conversation_messages":{"id":"agentphone_get_conversation_messages","name":"Get Conversation Messages","description":"Get paginated messages for a conversation","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"conversationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Conversation ID"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of messages to return (default 50, max 200)"},"before":{"type":"string","required":false,"visibility":"user-or-llm","description":"Return messages received before this ISO 8601 timestamp"},"after":{"type":"string","required":false,"visibility":"user-or-llm","description":"Return messages received after this ISO 8601 timestamp"}},"hostedApiKey":"none"},"agentphone_get_number_messages":{"id":"agentphone_get_number_messages","name":"Get Phone Number Messages","description":"Fetch messages received on a specific phone number","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"numberId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the phone number"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of messages to return (default 50, max 200)"},"before":{"type":"string","required":false,"visibility":"user-or-llm","description":"Return messages received before this ISO 8601 timestamp"},"after":{"type":"string","required":false,"visibility":"user-or-llm","description":"Return messages received after this ISO 8601 timestamp"}},"hostedApiKey":"none"},"agentphone_get_usage":{"id":"agentphone_get_usage","name":"Get Usage","description":"Retrieve current usage statistics for the AgentPhone account","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"}},"hostedApiKey":"none"},"agentphone_get_usage_daily":{"id":"agentphone_get_usage_daily","name":"Get Daily Usage","description":"Get a daily breakdown of usage (messages, calls, webhooks) for the last N days","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"days":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of days to return (1-365, default 30)"}},"hostedApiKey":"none"},"agentphone_get_usage_monthly":{"id":"agentphone_get_usage_monthly","name":"Get Monthly Usage","description":"Get monthly usage aggregation (messages, calls, webhooks) for the last N months","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"months":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of months to return (1-24, default 6)"}},"hostedApiKey":"none"},"agentphone_list_calls":{"id":"agentphone_list_calls","name":"List Calls","description":"List voice calls for this AgentPhone account","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of results to return (default 20, max 100)"},"offset":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of results to skip (min 0)"},"status":{"type":"string","required":false,"visibility":"user-or-llm","description":"Filter by status (completed, in-progress, failed)"},"direction":{"type":"string","required":false,"visibility":"user-or-llm","description":"Filter by direction (inbound, outbound)"},"type":{"type":"string","required":false,"visibility":"user-or-llm","description":"Filter by call type (pstn, web)"},"search":{"type":"string","required":false,"visibility":"user-or-llm","description":"Search by phone number (matches fromNumber or toNumber)"}},"hostedApiKey":"none"},"agentphone_list_contacts":{"id":"agentphone_list_contacts","name":"List Contacts","description":"List contacts for this AgentPhone account","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"search":{"type":"string","required":false,"visibility":"user-or-llm","description":"Filter by name or phone number (case-insensitive contains)"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of results to return (default 50, max 200)"},"offset":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of results to skip (min 0)"}},"hostedApiKey":"none"},"agentphone_list_conversations":{"id":"agentphone_list_conversations","name":"List Conversations","description":"List conversations (message threads) for this AgentPhone account","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of results to return (default 20, max 100)"},"offset":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of results to skip (min 0)"}},"hostedApiKey":"none"},"agentphone_list_numbers":{"id":"agentphone_list_numbers","name":"List Phone Numbers","description":"List all phone numbers provisioned for this AgentPhone account","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of results to return (default 20, max 100)"},"offset":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of results to skip (min 0)"}},"hostedApiKey":"none"},"agentphone_react_to_message":{"id":"agentphone_react_to_message","name":"React to Message","description":"Send an iMessage tapback reaction to a message (iMessage only)","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"messageId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the message to react to"},"reaction":{"type":"string","required":true,"visibility":"user-or-llm","description":"Reaction type: love, like, dislike, laugh, emphasize, or question"}},"hostedApiKey":"none"},"agentphone_release_number":{"id":"agentphone_release_number","name":"Release Phone Number","description":"Release (delete) a phone number. This action is irreversible.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"numberId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the phone number to release"}},"hostedApiKey":"none"},"agentphone_send_message":{"id":"agentphone_send_message","name":"Send Message","description":"Send an outbound SMS or iMessage from an AgentPhone agent","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"agentId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Agent sending the message"},"toNumber":{"type":"string","required":true,"visibility":"user-or-llm","description":"Recipient phone number in E.164 format (e.g. +14155551234)"},"body":{"type":"string","required":true,"visibility":"user-or-llm","description":"Message text to send"},"mediaUrl":{"type":"string","required":false,"visibility":"user-or-llm","description":"Optional URL of an image, video, or file to attach"},"numberId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Phone number ID to send from. If omitted, the agent\'s first assigned number is used."}},"hostedApiKey":"none"},"agentphone_update_contact":{"id":"agentphone_update_contact","name":"Update Contact","description":"Update a contact\'s fields","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"contactId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Contact ID"},"phoneNumber":{"type":"string","required":false,"visibility":"user-or-llm","description":"New phone number in E.164 format"},"name":{"type":"string","required":false,"visibility":"user-or-llm","description":"New contact name"},"email":{"type":"string","required":false,"visibility":"user-or-llm","description":"New email address"},"notes":{"type":"string","required":false,"visibility":"user-or-llm","description":"New freeform notes"}},"hostedApiKey":"none"},"agentphone_update_conversation":{"id":"agentphone_update_conversation","name":"Update Conversation","description":"Update conversation metadata (stored state). Pass null to clear existing metadata.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"conversationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Conversation ID"},"metadata":{"type":"json","required":false,"visibility":"user-or-llm","description":"Custom key-value metadata to store on the conversation. Pass null to clear existing metadata."}},"hostedApiKey":"none"},"agiloft_async_status":{"id":"agiloft_async_status","name":"Agiloft Async Status","description":"Check whether an asynchronous Agiloft call, such as a run action button, has completed.","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"table":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table the asynchronous call was made against"},"callbackId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Callback ID returned by the asynchronous call, e.g. from Run Action Button"}},"hostedApiKey":"none"},"agiloft_attach_file":{"id":"agiloft_attach_file","name":"Agiloft Attach File","description":"Attach a file to a field in an Agiloft record.","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"table":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table name (e.g., \\"contracts\\")"},"recordId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the record to attach the file to"},"fieldName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the attachment field"},"file":{"type":"file","required":true,"visibility":"user-or-llm","description":"File to attach"},"fileName":{"type":"string","required":false,"visibility":"user-or-llm","description":"Name to assign to the file (defaults to original file name)"},"overwrite":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Replace the contents of the field instead of adding another file to it"}},"hostedApiKey":"none"},"agiloft_attachment_info":{"id":"agiloft_attachment_info","name":"Agiloft Attachment Info","description":"Get information about file attachments on a record field.","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"table":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table name (e.g., \\"contracts\\")"},"recordId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the record to check attachments on"},"fieldName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the attachment field to inspect"}},"hostedApiKey":"none"},"agiloft_create_record":{"id":"agiloft_create_record","name":"Agiloft Create Record","description":"Create a new record in an Agiloft table.","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"table":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table name (e.g., \\"contracts\\", \\"contacts.employees\\")"},"data":{"type":"string","required":true,"visibility":"user-or-llm","description":"Record field values as a JSON object (e.g., {\\"first_name\\": \\"John\\", \\"status\\": \\"Active\\"})"}},"hostedApiKey":"none"},"agiloft_delete_record":{"id":"agiloft_delete_record","name":"Agiloft Delete Record","description":"Delete a record from an Agiloft table.","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"table":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table name (e.g., \\"contracts\\", \\"contacts.employees\\")"},"recordId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the record to delete"},"substituteIds":{"type":"string","required":false,"visibility":"user-or-llm","description":"Comma-separated IDs of records that adopt the dependants of the deleted record. Read only when the delete rule is REPLACE_WITH_ANOTHER."},"deleteRule":{"type":"string","required":false,"visibility":"user-or-llm","description":"How to treat records that depend on this one: ERROR_IF_DEPENDANTS (default — fails rather than cascading), APPLY_DELETE_WHERE_POSSIBLE, DELETE_WHERE_POSSIBLE_OTHERWISE_UNLINK, APPLY_UNLINK, UNLINK_WHERE_POSSIBLE_OTHERWISE_DELETE, or REPLACE_WITH_ANOTHER"}},"hostedApiKey":"none"},"agiloft_get_choice_line_id":{"id":"agiloft_get_choice_line_id","name":"Agiloft Get Choice Line ID","description":"Resolve the internal numeric ID of a choice-list value, for use in EWSelect WHERE clauses against choice fields.","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"table":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table name (e.g., \\"case\\", \\"contracts\\")"},"fieldName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Choice field name (e.g., \\"priority\\", \\"status\\")"},"value":{"type":"string","required":true,"visibility":"user-or-llm","description":"Choice display value to resolve (e.g., \\"High\\", \\"Active\\")"}},"hostedApiKey":"none"},"agiloft_list_tables":{"id":"agiloft_list_tables","name":"Agiloft List Tables","description":"List the tables and fields in an Agiloft knowledge base, to discover the logical names other operations need.","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"table":{"type":"string","required":false,"visibility":"user-or-llm","description":"Logical name of a single table to describe (e.g., \\"contacts\\"). Leave empty to list every table in the knowledge base."},"includeLinkedInfo":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Include the source table and column behind each linked field"},"skipColumnsInfo":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Return table names only, omitting field details, for a much smaller response"}},"hostedApiKey":"none"},"agiloft_lock_record":{"id":"agiloft_lock_record","name":"Agiloft Lock Record","description":"Lock, unlock, or check the lock status of an Agiloft record.","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"table":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table name (e.g., \\"contracts\\")"},"recordId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the record to lock, unlock, or check"},"lockAction":{"type":"string","required":true,"visibility":"user-or-llm","description":"Action to perform: \\"lock\\", \\"unlock\\", or \\"check\\""},"force":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Unlock only: release a lock held by another user."}},"hostedApiKey":"none"},"agiloft_nlp_search":{"id":"agiloft_nlp_search","name":"Agiloft Natural Language Search","description":"Search Agiloft records by describing what you want in plain language, such as \\"active NDAs submitted last month\\".","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"nlpQuery":{"type":"string","required":true,"visibility":"user-or-llm","description":"The request in plain language, e.g. \\"Show me open, high-priority contracts\\". Structured field filters are not accepted — use Search Records for those."},"fields":{"type":"string","required":true,"visibility":"user-or-llm","description":"Comma-separated field names to return, e.g. \\"id, contract_title1, company_name\\""},"page":{"type":"string","required":false,"visibility":"user-or-llm","description":"Page number, starting from 0"},"limit":{"type":"string","required":false,"visibility":"user-or-llm","description":"Records per page"}},"hostedApiKey":"none"},"agiloft_read_record":{"id":"agiloft_read_record","name":"Agiloft Read Record","description":"Read a record by ID from an Agiloft table.","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"table":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table name (e.g., \\"contracts\\", \\"contacts.employees\\")"},"recordId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the record to read"},"fields":{"type":"string","required":false,"visibility":"user-or-llm","description":"Comma-separated list of field names to include in the response"}},"hostedApiKey":"none"},"agiloft_remove_attachment":{"id":"agiloft_remove_attachment","name":"Agiloft Remove Attachment","description":"Remove an attached file from a field in an Agiloft record.","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"table":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table name (e.g., \\"contracts\\")"},"recordId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the record containing the attachment"},"fieldName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the attachment field"},"position":{"type":"string","required":true,"visibility":"user-or-llm","description":"Position index of the file to remove (starting from 0)"}},"hostedApiKey":"none"},"agiloft_retrieve_attachment":{"id":"agiloft_retrieve_attachment","name":"Agiloft Retrieve Attachment","description":"Download an attached file from an Agiloft record field.","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"table":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table name (e.g., \\"contracts\\")"},"recordId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the record containing the attachment"},"fieldName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the attachment field"},"position":{"type":"string","required":true,"visibility":"user-or-llm","description":"Position index of the file in the field (starting from 0)"}},"hostedApiKey":"none"},"agiloft_run_action_button":{"id":"agiloft_run_action_button","name":"Agiloft Run Action Button","description":"Run an action button on an Agiloft record, such as an approval or send-for-signature step.","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"table":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table name (e.g., \\"contracts\\", \\"case\\")"},"recordId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the record to run the action button on"},"actionButtonField":{"type":"string","required":true,"visibility":"user-or-llm","description":"Logical name of the field holding the action button (e.g., \\"ab_field\\")"}},"hostedApiKey":"none"},"agiloft_saved_search":{"id":"agiloft_saved_search","name":"Agiloft Saved Search","description":"List the saved searches defined for an Agiloft table.","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"table":{"type":"string","required":true,"visibility":"user-or-llm","description":"Logical table name to list saved searches for (e.g., \\"contract\\")"}},"hostedApiKey":"none"},"agiloft_search_records":{"id":"agiloft_search_records","name":"Agiloft Search Records","description":"Search for records in an Agiloft table using a query.","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"table":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table name to search in (e.g., \\"contracts\\", \\"contacts.employees\\")"},"query":{"type":"string","required":false,"visibility":"user-or-llm","description":"Ad hoc EWSearch query. Combine conditions with && (and) or || (or) and quote every value — e.g. \\"summary~=\'test\'&&priority=\'High\'\\". Required unless a saved search is given."},"search":{"type":"string","required":false,"visibility":"user-or-llm","description":"Label of a saved search defined on the table (e.g., \\"C: Status is Closed\\"). Can be combined with a query to narrow it further."},"fields":{"type":"string","required":false,"visibility":"user-or-llm","description":"Comma-separated list of field names to include in the results"},"page":{"type":"string","required":false,"visibility":"user-or-llm","description":"Page number for paginated results (starting from 0)"},"limit":{"type":"string","required":false,"visibility":"user-or-llm","description":"Maximum number of records to return per page. Agiloft treats 0 as \\"all records\\", so leave it unset or use a positive value to keep result sizes bounded."}},"hostedApiKey":"none"},"agiloft_select_records":{"id":"agiloft_select_records","name":"Agiloft Select Records","description":"Select record IDs matching a SQL WHERE clause from an Agiloft table.","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"table":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table name (e.g., \\"contracts\\", \\"contacts.employees\\")"},"where":{"type":"string","required":true,"visibility":"user-or-llm","description":"SQL WHERE clause using database column names (e.g., \\"summary like \'%new%\'\\" or \\"assigned_person=\'John Doe\'\\"). EWSelect has no page size and returns every matching ID, so append a database limit such as \\"limit 0,200\\" to bound the result."}},"hostedApiKey":"none"},"agiloft_update_record":{"id":"agiloft_update_record","name":"Agiloft Update Record","description":"Update an existing record in an Agiloft table.","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"table":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table name (e.g., \\"contracts\\", \\"contacts.employees\\")"},"recordId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the record to update"},"data":{"type":"string","required":true,"visibility":"user-or-llm","description":"Updated field values as a JSON object (e.g., {\\"status\\": \\"Active\\", \\"priority\\": \\"High\\"})"}},"hostedApiKey":"none"},"agiloft_upsert_record":{"id":"agiloft_upsert_record","name":"Agiloft Upsert Record","description":"Create an Agiloft record, or update it when a record already matches the given fields.","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"table":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table name (e.g., \\"contracts\\", \\"contacts.employees\\")"},"match":{"type":"string","required":true,"visibility":"user-or-llm","description":"Field used to find an existing record (e.g., \\"ext_id\\"). Pick something that identifies a record uniquely — if more than one record matches, Agiloft writes nothing and returns a conflict."},"async":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Queue the write instead of waiting for it. Returns a callback ID instead of a record ID; pass that to Async Status to poll the result."},"data":{"type":"string","required":true,"visibility":"user-or-llm","description":"Field values as a JSON object. On create these populate the new record; on update only the supplied fields change."}},"hostedApiKey":"none"},"ahrefs_anchors":{"id":"ahrefs_anchors","name":"Ahrefs Anchors","description":"Get the anchor text distribution for a target domain or URL\'s backlinks, showing how many links and referring domains use each anchor text.","version":"1.0.0","params":{"target":{"type":"string","required":true,"visibility":"user-or-llm","description":"The target domain or URL to analyze. Example: \\"example.com\\" or \\"https://example.com/page\\""},"mode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Analysis mode: domain (entire domain), prefix (URL prefix), subdomains (include all subdomains, default), exact (exact URL match)"},"history":{"type":"string","required":false,"visibility":"user-or-llm","description":"Historical scope: \\"live\\" (currently live), \\"all_time\\" (default, includes lost backlinks), or \\"since:YYYY-MM-DD\\" (backlinks found since a date)"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of results to return. Example: 50 (default: 1000)"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_backlinks":{"id":"ahrefs_backlinks","name":"Ahrefs Backlinks","description":"Get a list of backlinks pointing to a target domain or URL. Returns details about each backlink including source URL, anchor text, and domain rating.","version":"1.0.0","params":{"target":{"type":"string","required":true,"visibility":"user-or-llm","description":"The target domain or URL to analyze. Example: \\"example.com\\" or \\"https://example.com/page\\""},"mode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Analysis mode: domain (entire domain), prefix (URL prefix), subdomains (include all subdomains, default), exact (exact URL match). Example: \\"domain\\""},"history":{"type":"string","required":false,"visibility":"user-or-llm","description":"Historical scope: \\"live\\" (currently live backlinks), \\"all_time\\" (default, includes lost backlinks), or \\"since:YYYY-MM-DD\\" (backlinks found since a date)."},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of results to return. Example: 50 (default: 1000)"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_backlinks_stats":{"id":"ahrefs_backlinks_stats","name":"Ahrefs Backlinks Stats","description":"Get backlink and referring domain totals for a target domain or URL, both currently live and across all time.","version":"1.0.0","params":{"target":{"type":"string","required":true,"visibility":"user-or-llm","description":"The target domain or URL to analyze. Example: \\"example.com\\" or \\"https://example.com/page\\""},"mode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Analysis mode: domain (entire domain), prefix (URL prefix), subdomains (include all subdomains, default), exact (exact URL match). Example: \\"domain\\""},"date":{"type":"string","required":false,"visibility":"user-only","description":"Date to report metrics on, in YYYY-MM-DD format (defaults to today)"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_batch_analysis":{"id":"ahrefs_batch_analysis","name":"Ahrefs Batch Analysis","description":"Get bulk SEO metrics (Domain Rating, backlinks, referring domains, organic traffic, and more) for multiple domains or URLs in a single request. Useful for comparing many competitors at once.","version":"1.0.0","params":{"targets":{"type":"string","required":true,"visibility":"user-or-llm","description":"Comma-separated list of domains or URLs to analyze. Example: \\"example.com,competitor.com\\""},"mode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Analysis mode applied to every target: domain (entire domain), prefix (URL prefix), subdomains (include all subdomains, default), exact (exact URL match)"},"protocol":{"type":"string","required":false,"visibility":"user-or-llm","description":"Protocol applied to every target: \\"both\\" (default), \\"http\\", or \\"https\\""},"country":{"type":"string","required":false,"visibility":"user-or-llm","description":"Country code for traffic data. Example: \\"us\\", \\"gb\\", \\"de\\" (default: \\"us\\")"},"volumeMode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Search volume calculation: \\"monthly\\" or \\"average\\" (default: \\"monthly\\")"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_broken_backlinks":{"id":"ahrefs_broken_backlinks","name":"Ahrefs Broken Backlinks","description":"Get a list of broken backlinks pointing to a target domain or URL. Useful for identifying link reclamation opportunities.","version":"1.0.0","params":{"target":{"type":"string","required":true,"visibility":"user-or-llm","description":"The target domain or URL to analyze. Example: \\"example.com\\" or \\"https://example.com/page\\""},"mode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Analysis mode: domain (entire domain), prefix (URL prefix), subdomains (include all subdomains, default), exact (exact URL match). Example: \\"domain\\""},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of results to return. Example: 50 (default: 1000)"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_domain_rating":{"id":"ahrefs_domain_rating","name":"Ahrefs Domain Rating","description":"Get the Domain Rating (DR) and Ahrefs Rank for a target domain. Domain Rating shows the strength of a website\'s backlink profile on a scale from 0 to 100.","version":"1.0.0","params":{"target":{"type":"string","required":true,"visibility":"user-or-llm","description":"The target domain to analyze (e.g., example.com)"},"date":{"type":"string","required":false,"visibility":"user-only","description":"Date for historical data in YYYY-MM-DD format (defaults to today)"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_domain_rating_history":{"id":"ahrefs_domain_rating_history","name":"Ahrefs Domain Rating History","description":"Get the historical Domain Rating (DR) trend for a target domain or URL over a date range, grouped daily, weekly, or monthly.","version":"1.0.0","params":{"target":{"type":"string","required":true,"visibility":"user-or-llm","description":"The target domain or URL to analyze. Example: \\"example.com\\""},"dateFrom":{"type":"string","required":true,"visibility":"user-only","description":"Start date of the historical period, in YYYY-MM-DD format"},"dateTo":{"type":"string","required":false,"visibility":"user-only","description":"End date of the historical period, in YYYY-MM-DD format (defaults to today)"},"historyGrouping":{"type":"string","required":false,"visibility":"user-or-llm","description":"Time interval for grouping data points: \\"daily\\", \\"weekly\\", or \\"monthly\\" (default: \\"monthly\\")"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_keyword_overview":{"id":"ahrefs_keyword_overview","name":"Ahrefs Keyword Overview","description":"Get detailed metrics for a keyword including search volume, keyword difficulty, CPC, clicks, and traffic potential.","version":"1.0.0","params":{"keyword":{"type":"string","required":true,"visibility":"user-or-llm","description":"The keyword to analyze"},"country":{"type":"string","required":false,"visibility":"user-or-llm","description":"Country code for keyword data. Example: \\"us\\", \\"gb\\", \\"de\\" (default: \\"us\\")"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_keywords_history":{"id":"ahrefs_keywords_history","name":"Ahrefs Keywords History","description":"Get the historical organic keyword ranking distribution for a target domain or URL over a date range: how many keywords rank in each position bucket at each point in time.","version":"1.0.0","params":{"target":{"type":"string","required":true,"visibility":"user-or-llm","description":"The target domain or URL to analyze. Example: \\"example.com\\""},"dateFrom":{"type":"string","required":true,"visibility":"user-only","description":"Start date of the historical period, in YYYY-MM-DD format"},"dateTo":{"type":"string","required":false,"visibility":"user-only","description":"End date of the historical period, in YYYY-MM-DD format (defaults to today)"},"historyGrouping":{"type":"string","required":false,"visibility":"user-or-llm","description":"Time interval for grouping data points: \\"daily\\", \\"weekly\\", or \\"monthly\\" (default: \\"monthly\\")"},"country":{"type":"string","required":false,"visibility":"user-or-llm","description":"Country code for search results. Example: \\"us\\", \\"gb\\", \\"de\\" (default: \\"us\\")"},"mode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Analysis mode: domain (entire domain), prefix (URL prefix), subdomains (include all subdomains, default), exact (exact URL match)"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_metrics":{"id":"ahrefs_metrics","name":"Ahrefs Metrics","description":"Get a one-call organic and paid search overview for a target domain or URL: organic traffic, organic keywords, paid traffic, paid keywords, and estimated traffic cost.","version":"1.0.0","params":{"target":{"type":"string","required":true,"visibility":"user-or-llm","description":"The target domain or URL to analyze. Example: \\"example.com\\""},"country":{"type":"string","required":false,"visibility":"user-or-llm","description":"Country code for traffic data. Example: \\"us\\", \\"gb\\", \\"de\\""},"mode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Analysis mode: domain (entire domain), prefix (URL prefix), subdomains (include all subdomains, default), exact (exact URL match). Example: \\"domain\\""},"date":{"type":"string","required":false,"visibility":"user-only","description":"Date to report metrics on, in YYYY-MM-DD format (defaults to today)"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_metrics_history":{"id":"ahrefs_metrics_history","name":"Ahrefs Metrics History","description":"Get the historical organic and paid traffic trend for a target domain or URL over a date range: organic traffic/cost and paid traffic/cost at each point in time.","version":"1.0.0","params":{"target":{"type":"string","required":true,"visibility":"user-or-llm","description":"The target domain or URL to analyze. Example: \\"example.com\\""},"dateFrom":{"type":"string","required":true,"visibility":"user-only","description":"Start date of the historical period, in YYYY-MM-DD format"},"dateTo":{"type":"string","required":false,"visibility":"user-only","description":"End date of the historical period, in YYYY-MM-DD format (defaults to today)"},"volumeMode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Search volume calculation: \\"monthly\\" or \\"average\\" (default: \\"monthly\\")"},"historyGrouping":{"type":"string","required":false,"visibility":"user-or-llm","description":"Time interval for grouping data points: \\"daily\\", \\"weekly\\", or \\"monthly\\" (default: \\"monthly\\")"},"country":{"type":"string","required":false,"visibility":"user-or-llm","description":"Country code for traffic data. Example: \\"us\\", \\"gb\\", \\"de\\" (default: \\"us\\")"},"mode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Analysis mode: domain (entire domain), prefix (URL prefix), subdomains (include all subdomains, default), exact (exact URL match)"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_organic_competitors":{"id":"ahrefs_organic_competitors","name":"Ahrefs Organic Competitors","description":"Get domains that compete with a target domain or URL for the same organic keywords, ranked by keyword overlap.","version":"1.0.0","params":{"target":{"type":"string","required":true,"visibility":"user-or-llm","description":"The target domain or URL to analyze. Example: \\"example.com\\""},"country":{"type":"string","required":false,"visibility":"user-or-llm","description":"Country code for search results. Example: \\"us\\", \\"gb\\", \\"de\\" (default: \\"us\\")"},"mode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Analysis mode: domain (entire domain), prefix (URL prefix), subdomains (include all subdomains, default), exact (exact URL match). Example: \\"domain\\""},"date":{"type":"string","required":false,"visibility":"user-only","description":"Date to report metrics on, in YYYY-MM-DD format (defaults to today)"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of results to return. Example: 50 (default: 1000)"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_organic_keywords":{"id":"ahrefs_organic_keywords","name":"Ahrefs Organic Keywords","description":"Get organic keywords that a target domain or URL ranks for in Google search results. Returns keyword details including search volume, ranking position, and estimated traffic.","version":"1.0.0","params":{"target":{"type":"string","required":true,"visibility":"user-or-llm","description":"The target domain or URL to analyze. Example: \\"example.com\\" or \\"https://example.com/page\\""},"country":{"type":"string","required":false,"visibility":"user-or-llm","description":"Country code for search results. Example: \\"us\\", \\"gb\\", \\"de\\" (default: \\"us\\")"},"mode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Analysis mode: domain (entire domain), prefix (URL prefix), subdomains (include all subdomains, default), exact (exact URL match). Example: \\"domain\\""},"date":{"type":"string","required":false,"visibility":"user-only","description":"Date to report metrics on, in YYYY-MM-DD format (defaults to today)"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of results to return. Example: 50 (default: 1000)"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_paid_pages":{"id":"ahrefs_paid_pages","name":"Ahrefs Paid Pages","description":"Get a target domain\'s pages that receive paid search traffic, sorted by estimated paid traffic. Returns page URLs with their paid traffic, keyword counts, and estimated spend.","version":"1.0.0","params":{"target":{"type":"string","required":true,"visibility":"user-or-llm","description":"The target domain or URL to analyze. Example: \\"example.com\\""},"country":{"type":"string","required":false,"visibility":"user-or-llm","description":"Country code for traffic data. Example: \\"us\\", \\"gb\\", \\"de\\" (default: \\"us\\")"},"mode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Analysis mode: domain (entire domain), prefix (URL prefix), subdomains (include all subdomains, default), exact (exact URL match)"},"date":{"type":"string","required":false,"visibility":"user-only","description":"Date to report metrics on, in YYYY-MM-DD format (defaults to today)"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of results to return. Example: 50 (default: 1000)"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_rank_tracker_competitors_overview":{"id":"ahrefs_rank_tracker_competitors_overview","name":"Ahrefs Rank Tracker Competitors Overview","description":"Get competitor rankings for the keywords tracked in an Ahrefs Rank Tracker project: each tracked keyword\'s volume and difficulty alongside every competitor\'s position, traffic, and traffic value. This endpoint is free and does not consume API units.","version":"1.0.0","params":{"projectId":{"type":"number","required":true,"visibility":"user-or-llm","description":"The Rank Tracker project ID (found in the project URL in Ahrefs)"},"date":{"type":"string","required":true,"visibility":"user-only","description":"Date to report rankings for, in YYYY-MM-DD format"},"device":{"type":"string","required":true,"visibility":"user-or-llm","description":"Rankings device type: \\"desktop\\" or \\"mobile\\""},"dateCompared":{"type":"string","required":false,"visibility":"user-only","description":"Comparison date in YYYY-MM-DD format, to compute position/traffic deltas"},"volumeMode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Search volume calculation: \\"monthly\\" or \\"average\\" (default: \\"monthly\\")"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of results to return. Example: 50 (default: 1000)"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_rank_tracker_competitors_stats":{"id":"ahrefs_rank_tracker_competitors_stats","name":"Ahrefs Rank Tracker Competitors Stats","description":"Get aggregate competitor stats for an Ahrefs Rank Tracker project: each competitor\'s traffic, traffic value, average position, and share of voice across all tracked keywords. This endpoint is free and does not consume API units.","version":"1.0.0","params":{"projectId":{"type":"number","required":true,"visibility":"user-or-llm","description":"The Rank Tracker project ID (found in the project URL in Ahrefs)"},"date":{"type":"string","required":true,"visibility":"user-only","description":"Date to report metrics for, in YYYY-MM-DD format"},"device":{"type":"string","required":true,"visibility":"user-or-llm","description":"Rankings device type: \\"desktop\\" or \\"mobile\\""},"volumeMode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Search volume calculation: \\"monthly\\" or \\"average\\" (default: \\"monthly\\")"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_rank_tracker_overview":{"id":"ahrefs_rank_tracker_overview","name":"Ahrefs Rank Tracker Overview","description":"Get ranking overview metrics for the keywords tracked in an Ahrefs Rank Tracker project: position, search volume, keyword difficulty, and estimated traffic. This endpoint is free and does not consume API units.","version":"1.0.0","params":{"projectId":{"type":"number","required":true,"visibility":"user-or-llm","description":"The Rank Tracker project ID (found in the project URL in Ahrefs)"},"date":{"type":"string","required":true,"visibility":"user-only","description":"Date to report rankings for, in YYYY-MM-DD format"},"device":{"type":"string","required":true,"visibility":"user-or-llm","description":"Rankings device type: \\"desktop\\" or \\"mobile\\""},"dateCompared":{"type":"string","required":false,"visibility":"user-only","description":"Comparison date in YYYY-MM-DD format, to compute position/traffic deltas"},"volumeMode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Search volume calculation: \\"monthly\\" or \\"average\\" (default: \\"monthly\\")"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of results to return. Example: 50 (default: 1000)"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_rank_tracker_serp_overview":{"id":"ahrefs_rank_tracker_serp_overview","name":"Ahrefs Rank Tracker SERP Overview","description":"Get the full SERP (search engine results page) for a keyword tracked in an Ahrefs Rank Tracker project, including every ranking URL with its position, title, and authority metrics. This endpoint is free and does not consume API units.","version":"1.0.0","params":{"projectId":{"type":"number","required":true,"visibility":"user-or-llm","description":"The Rank Tracker project ID (found in the project URL in Ahrefs)"},"keyword":{"type":"string","required":true,"visibility":"user-or-llm","description":"The tracked keyword to retrieve SERP data for"},"country":{"type":"string","required":true,"visibility":"user-or-llm","description":"Country code for the tracked keyword. Example: \\"us\\", \\"gb\\", \\"de\\""},"device":{"type":"string","required":true,"visibility":"user-or-llm","description":"Rankings device type: \\"desktop\\" or \\"mobile\\""},"topPositions":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of top organic positions to return (defaults to all available)"},"date":{"type":"string","required":false,"visibility":"user-only","description":"Timestamp to return the last available SERP Overview at, in YYYY-MM-DDThh:mm:ss format"},"locationId":{"type":"number","required":false,"visibility":"user-or-llm","description":"Location ID of the tracked keyword, if tracked at a specific location"},"languageCode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Language code of the tracked keyword"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_refdomains_history":{"id":"ahrefs_refdomains_history","name":"Ahrefs Referring Domains History","description":"Get the historical referring domains trend for a target domain or URL over a date range, grouped daily, weekly, or monthly.","version":"1.0.0","params":{"target":{"type":"string","required":true,"visibility":"user-or-llm","description":"The target domain or URL to analyze. Example: \\"example.com\\""},"dateFrom":{"type":"string","required":true,"visibility":"user-only","description":"Start date of the historical period, in YYYY-MM-DD format"},"dateTo":{"type":"string","required":false,"visibility":"user-only","description":"End date of the historical period, in YYYY-MM-DD format (defaults to today)"},"historyGrouping":{"type":"string","required":false,"visibility":"user-or-llm","description":"Time interval for grouping data points: \\"daily\\", \\"weekly\\", or \\"monthly\\" (default: \\"monthly\\")"},"mode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Analysis mode: domain (entire domain), prefix (URL prefix), subdomains (include all subdomains, default), exact (exact URL match)"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_referring_domains":{"id":"ahrefs_referring_domains","name":"Ahrefs Referring Domains","description":"Get a list of domains that link to a target domain or URL. Returns unique referring domains with their domain rating, backlink counts, and discovery dates.","version":"1.0.0","params":{"target":{"type":"string","required":true,"visibility":"user-or-llm","description":"The target domain or URL to analyze. Example: \\"example.com\\" or \\"https://example.com/page\\""},"mode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Analysis mode: domain (entire domain), prefix (URL prefix), subdomains (include all subdomains, default), exact (exact URL match). Example: \\"domain\\""},"history":{"type":"string","required":false,"visibility":"user-or-llm","description":"Historical scope: \\"live\\" (currently live), \\"all_time\\" (default, includes lost domains), or \\"since:YYYY-MM-DD\\" (domains found since a date)."},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of results to return. Example: 50 (default: 1000)"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_related_terms":{"id":"ahrefs_related_terms","name":"Ahrefs Related Terms","description":"Get keyword ideas related to a seed keyword: terms the same top-ranking pages also rank for (\\"also rank for\\") or also discuss (\\"also talk about\\"), with volume, difficulty, and CPC.","version":"1.0.0","params":{"keyword":{"type":"string","required":true,"visibility":"user-or-llm","description":"The seed keyword to find related terms for"},"country":{"type":"string","required":false,"visibility":"user-or-llm","description":"Country code for keyword data. Example: \\"us\\", \\"gb\\", \\"de\\" (default: \\"us\\")"},"terms":{"type":"string","required":false,"visibility":"user-or-llm","description":"Type of related keywords to return: \\"also_rank_for\\", \\"also_talk_about\\", or \\"all\\" (default: \\"all\\")"},"viewFor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Whether to derive related terms from the top 10 or top 100 ranking pages (default: \\"top_10\\")"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of results to return. Example: 50 (default: 1000)"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_site_audit_page_explorer":{"id":"ahrefs_site_audit_page_explorer","name":"Ahrefs Site Audit Page Explorer","description":"Get crawled pages from an Ahrefs Site Audit project with health and SEO metrics: HTTP status, title, link counts, backlinks, indexability, and traffic. Optionally filter to pages affected by a specific issue.","version":"1.0.0","params":{"projectId":{"type":"number","required":true,"visibility":"user-or-llm","description":"The Site Audit project ID (found in the project URL in Ahrefs)"},"date":{"type":"string","required":false,"visibility":"user-only","description":"Crawl date in YYYY-MM-DDThh:mm:ss format (defaults to the most recent crawl)"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of results to return. Example: 50 (default: 1000)"},"offset":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of results to skip, for pagination"},"issueId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Only return pages affected by this issue ID"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_top_pages":{"id":"ahrefs_top_pages","name":"Ahrefs Top Pages","description":"Get the top pages of a target domain sorted by organic traffic. Returns page URLs with their traffic, keyword counts, and estimated traffic value.","version":"1.0.0","params":{"target":{"type":"string","required":true,"visibility":"user-or-llm","description":"The target domain to analyze. Example: \\"example.com\\""},"country":{"type":"string","required":false,"visibility":"user-or-llm","description":"Country code for traffic data. Example: \\"us\\", \\"gb\\", \\"de\\" (default: \\"us\\")"},"mode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Analysis mode: domain (entire domain), prefix (URL prefix), subdomains (include all subdomains, default), exact (exact URL match). Example: \\"domain\\""},"date":{"type":"string","required":false,"visibility":"user-only","description":"Date to report metrics on, in YYYY-MM-DD format (defaults to today)"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of results to return. Example: 50 (default: 1000)"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"airtable_create_records":{"id":"airtable_create_records","name":"Airtable Create Records","description":"Write new records to an Airtable table","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token"},"baseId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Airtable base ID (starts with \\"app\\", e.g., \\"appXXXXXXXXXXXXXX\\")"},"tableId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table ID (starts with \\"tbl\\") or table name"},"records":{"type":"json","required":true,"visibility":"user-or-llm","description":"Array of records to create, each with a `fields` object"},"typecast":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"When true, Airtable automatically converts string values to the field type"}},"oauth":{"required":true,"provider":"airtable"},"hostedApiKey":"none"},"airtable_delete_records":{"id":"airtable_delete_records","name":"Airtable Delete Records","description":"Delete one or more records from an Airtable table by ID","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token"},"baseId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Airtable base ID (starts with \\"app\\", e.g., \\"appXXXXXXXXXXXXXX\\")"},"tableId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table ID (starts with \\"tbl\\") or table name"},"recordIds":{"type":"json","required":true,"visibility":"user-or-llm","description":"Array of record IDs to delete (each starts with \\"rec\\", e.g., [\\"recXXXXXXXXXXXXXX\\"]). Pass a single-element array to delete one record."}},"oauth":{"required":true,"provider":"airtable"},"hostedApiKey":"none"},"airtable_get_base_schema":{"id":"airtable_get_base_schema","name":"Airtable Get Base Schema","description":"Get the schema of all tables, fields, and views in an Airtable base","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token"},"baseId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Airtable base ID (starts with \\"app\\", e.g., \\"appXXXXXXXXXXXXXX\\")"}},"oauth":{"required":true,"provider":"airtable"},"hostedApiKey":"none"},"airtable_get_record":{"id":"airtable_get_record","name":"Airtable Get Record","description":"Retrieve a single record from an Airtable table by its ID","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token"},"baseId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Airtable base ID (starts with \\"app\\", e.g., \\"appXXXXXXXXXXXXXX\\")"},"tableId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table ID (starts with \\"tbl\\") or table name"},"recordId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Record ID to retrieve (starts with \\"rec\\", e.g., \\"recXXXXXXXXXXXXXX\\")"}},"oauth":{"required":true,"provider":"airtable"},"hostedApiKey":"none"},"airtable_list_bases":{"id":"airtable_list_bases","name":"Airtable List Bases","description":"List all bases the authenticated user has access to","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token"},"offset":{"type":"string","required":false,"visibility":"user-or-llm","description":"Pagination offset for retrieving additional bases"}},"oauth":{"required":true,"provider":"airtable"},"hostedApiKey":"none"},"airtable_list_records":{"id":"airtable_list_records","name":"Airtable List Records","description":"Read records from an Airtable table","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token"},"baseId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Airtable base ID (starts with \\"app\\", e.g., \\"appXXXXXXXXXXXXXX\\")"},"tableId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table ID (starts with \\"tbl\\") or table name"},"maxRecords":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of records to return (default: all records)"},"filterFormula":{"type":"string","required":false,"visibility":"user-or-llm","description":"Formula to filter records (e.g., \\"({Field Name} = \'Value\')\\")"}},"oauth":{"required":true,"provider":"airtable"},"hostedApiKey":"none"},"airtable_list_tables":{"id":"airtable_list_tables","name":"Airtable List Tables","description":"List all tables and their schema in an Airtable base","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token"},"baseId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Airtable base ID (starts with \\"app\\", e.g., \\"appXXXXXXXXXXXXXX\\")"}},"oauth":{"required":true,"provider":"airtable"},"hostedApiKey":"none"},"airtable_update_multiple_records":{"id":"airtable_update_multiple_records","name":"Airtable Update Multiple Records","description":"Update multiple existing records in an Airtable table","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token"},"baseId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Airtable base ID (starts with \\"app\\", e.g., \\"appXXXXXXXXXXXXXX\\")"},"tableId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table ID (starts with \\"tbl\\") or table name"},"records":{"type":"json","required":true,"visibility":"user-or-llm","description":"Array of records to update, each with an `id` and a `fields` object"},"typecast":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"When true, Airtable automatically converts string values to the field type"}},"oauth":{"required":true,"provider":"airtable"},"hostedApiKey":"none"},"airtable_update_record":{"id":"airtable_update_record","name":"Airtable Update Record","description":"Update an existing record in an Airtable table by ID","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token"},"baseId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Airtable base ID (starts with \\"app\\", e.g., \\"appXXXXXXXXXXXXXX\\")"},"tableId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table ID (starts with \\"tbl\\") or table name"},"recordId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Record ID to update (starts with \\"rec\\", e.g., \\"recXXXXXXXXXXXXXX\\")"},"fields":{"type":"json","required":true,"visibility":"user-or-llm","description":"An object containing the field names and their new values"},"typecast":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"When true, Airtable automatically converts string values to the field type"}},"oauth":{"required":true,"provider":"airtable"},"hostedApiKey":"none"},"airtable_upsert_records":{"id":"airtable_upsert_records","name":"Airtable Upsert Records","description":"Update existing records or create new ones in an Airtable table, matching on the specified merge fields","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token"},"baseId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Airtable base ID (starts with \\"app\\", e.g., \\"appXXXXXXXXXXXXXX\\")"},"tableId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table ID (starts with \\"tbl\\") or table name"},"records":{"type":"json","required":true,"visibility":"user-or-llm","description":"Array of records to upsert, each with a `fields` object"},"fieldsToMergeOn":{"type":"json","required":true,"visibility":"user-or-llm","description":"Array of field names used to match existing records (max 3). A record is updated when all merge fields match, otherwise it is created. Example: [\\"Name\\"]"},"typecast":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"When true, Airtable automatically converts string values to the field type"}},"oauth":{"required":true,"provider":"airtable"},"hostedApiKey":"none"},"algolia_add_record":{"id":"algolia_add_record","name":"Algolia Add Record","description":"Add or replace a record in an Algolia index","version":"1.0","params":{"applicationId":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Application ID"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Admin API Key"},"indexName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the Algolia index"},"objectID":{"type":"string","required":false,"visibility":"user-or-llm","description":"Object ID for the record (auto-generated if not provided)"},"record":{"type":"json","required":true,"visibility":"user-or-llm","description":"JSON object representing the record to add"}},"hostedApiKey":"none"},"algolia_batch_operations":{"id":"algolia_batch_operations","name":"Algolia Batch Operations","description":"Perform batch add, update, partial update, or delete operations on records in an Algolia index","version":"1.0","params":{"applicationId":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Application ID"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Admin API Key"},"indexName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the Algolia index"},"requests":{"type":"json","required":true,"visibility":"user-or-llm","description":"Array of batch operations. Each item has \\"action\\" (addObject, updateObject, partialUpdateObject, partialUpdateObjectNoCreate, deleteObject, delete, clear) and \\"body\\" (the record data; must include objectID for update/delete; use an empty object {} for the index-level delete/clear actions)"}},"hostedApiKey":"none"},"algolia_browse_records":{"id":"algolia_browse_records","name":"Algolia Browse Records","description":"Browse and iterate over all records in an Algolia index using cursor pagination","version":"1.0","params":{"applicationId":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Application ID"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Algolia API Key (must have browse ACL)"},"indexName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the Algolia index to browse"},"query":{"type":"string","required":false,"visibility":"user-or-llm","description":"Search query to filter browsed records"},"filters":{"type":"string","required":false,"visibility":"user-or-llm","description":"Filter string to narrow down results"},"attributesToRetrieve":{"type":"string","required":false,"visibility":"user-or-llm","description":"Comma-separated list of attributes to retrieve"},"hitsPerPage":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of hits per page (default: 1000, max: 1000)"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous browse response for pagination"},"aroundLatLng":{"type":"string","required":false,"visibility":"user-or-llm","description":"Coordinates for geo-search (e.g., \\"40.71,-74.01\\")"},"aroundRadius":{"type":"string","required":false,"visibility":"user-or-llm","description":"Maximum radius in meters for geo-search, or \\"all\\" for unlimited"},"insideBoundingBox":{"type":"json","required":false,"visibility":"user-or-llm","description":"Bounding box coordinates as [[lat1, lng1, lat2, lng2]] for geo-search"},"insidePolygon":{"type":"json","required":false,"visibility":"user-or-llm","description":"Polygon coordinates as [[lat1, lng1, lat2, lng2, lat3, lng3, ...]] for geo-search"}},"hostedApiKey":"none"},"algolia_clear_records":{"id":"algolia_clear_records","name":"Algolia Clear Records","description":"Clear all records from an Algolia index while keeping settings, synonyms, and rules","version":"1.0","params":{"applicationId":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Application ID"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Admin API Key (must have deleteIndex ACL)"},"indexName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the Algolia index to clear"}},"hostedApiKey":"none"},"algolia_copy_move_index":{"id":"algolia_copy_move_index","name":"Algolia Copy/Move Index","description":"Copy or move an Algolia index to a new destination","version":"1.0","params":{"applicationId":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Application ID"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Admin API Key"},"indexName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the source index"},"operation":{"type":"string","required":true,"visibility":"user-or-llm","description":"Operation to perform: \\"copy\\" or \\"move\\""},"destination":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the destination index"},"scope":{"type":"json","required":false,"visibility":"user-or-llm","description":"Array of scopes to copy (only for \\"copy\\" operation): [\\"settings\\", \\"synonyms\\", \\"rules\\"]. Omit to copy everything including records."}},"hostedApiKey":"none"},"algolia_delete_by_filter":{"id":"algolia_delete_by_filter","name":"Algolia Delete By Filter","description":"Delete all records matching a filter from an Algolia index","version":"1.0","params":{"applicationId":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Application ID"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Admin API Key (must have deleteIndex ACL)"},"indexName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the Algolia index"},"filters":{"type":"string","required":false,"visibility":"user-or-llm","description":"Filter expression to match records for deletion (e.g., \\"category:outdated\\")"},"facetFilters":{"type":"json","required":false,"visibility":"user-or-llm","description":"Array of facet filters (e.g., [\\"brand:Acme\\"])"},"numericFilters":{"type":"json","required":false,"visibility":"user-or-llm","description":"Array of numeric filters (e.g., [\\"price > 100\\"])"},"tagFilters":{"type":"json","required":false,"visibility":"user-or-llm","description":"Array of tag filters using the _tags attribute (e.g., [\\"published\\"])"},"aroundLatLng":{"type":"string","required":false,"visibility":"user-or-llm","description":"Coordinates for geo-search filter (e.g., \\"40.71,-74.01\\")"},"aroundRadius":{"type":"string","required":false,"visibility":"user-or-llm","description":"Maximum radius in meters for geo-search, or \\"all\\" for unlimited"},"insideBoundingBox":{"type":"json","required":false,"visibility":"user-or-llm","description":"Bounding box coordinates as [[lat1, lng1, lat2, lng2]] for geo-search filter"},"insidePolygon":{"type":"json","required":false,"visibility":"user-or-llm","description":"Polygon coordinates as [[lat1, lng1, lat2, lng2, lat3, lng3, ...]] for geo-search filter"}},"hostedApiKey":"none"},"algolia_delete_index":{"id":"algolia_delete_index","name":"Algolia Delete Index","description":"Delete an entire Algolia index and all its records","version":"1.0","params":{"applicationId":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Application ID"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Admin API Key (must have deleteIndex ACL)"},"indexName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the Algolia index to delete"}},"hostedApiKey":"none"},"algolia_delete_record":{"id":"algolia_delete_record","name":"Algolia Delete Record","description":"Delete a record by objectID from an Algolia index","version":"1.0","params":{"applicationId":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Application ID"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Admin API Key"},"indexName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the Algolia index"},"objectID":{"type":"string","required":true,"visibility":"user-or-llm","description":"The objectID of the record to delete"}},"hostedApiKey":"none"},"algolia_get_record":{"id":"algolia_get_record","name":"Algolia Get Record","description":"Get a record by objectID from an Algolia index","version":"1.0","params":{"applicationId":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Application ID"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Algolia API Key"},"indexName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the Algolia index"},"objectID":{"type":"string","required":true,"visibility":"user-or-llm","description":"The objectID of the record to retrieve"},"attributesToRetrieve":{"type":"string","required":false,"visibility":"user-or-llm","description":"Comma-separated list of attributes to retrieve"}},"hostedApiKey":"none"},"algolia_get_records":{"id":"algolia_get_records","name":"Algolia Get Records","description":"Retrieve multiple records by objectID from one or more Algolia indices","version":"1.0","params":{"applicationId":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Application ID"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Algolia API Key"},"indexName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Default index name for all requests"},"requests":{"type":"json","required":true,"visibility":"user-or-llm","description":"Array of objects specifying records to retrieve. Each must have \\"objectID\\" and optionally \\"indexName\\" and \\"attributesToRetrieve\\"."}},"hostedApiKey":"none"},"algolia_get_settings":{"id":"algolia_get_settings","name":"Algolia Get Settings","description":"Retrieve the settings of an Algolia index","version":"1.0","params":{"applicationId":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Application ID"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Algolia API Key"},"indexName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the Algolia index"}},"hostedApiKey":"none"},"algolia_get_task_status":{"id":"algolia_get_task_status","name":"Algolia Get Task Status","description":"Check whether an Algolia indexing task has finished publishing","version":"1.0","params":{"applicationId":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Application ID"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Algolia API Key"},"indexName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the Algolia index the task ran against"},"taskID":{"type":"number","required":true,"visibility":"user-or-llm","description":"The taskID returned by a previous write operation"}},"hostedApiKey":"none"},"algolia_list_indices":{"id":"algolia_list_indices","name":"Algolia List Indices","description":"List all indices in an Algolia application","version":"1.0","params":{"applicationId":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Application ID"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Algolia API Key"},"page":{"type":"number","required":false,"visibility":"user-or-llm","description":"Page number for paginating indices (default: not paginated)"},"hitsPerPage":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of indices per page (default: 100)"}},"hostedApiKey":"none"},"algolia_partial_update_record":{"id":"algolia_partial_update_record","name":"Algolia Partial Update Record","description":"Partially update a record in an Algolia index without replacing it entirely","version":"1.0","params":{"applicationId":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Application ID"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Admin API Key"},"indexName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the Algolia index"},"objectID":{"type":"string","required":true,"visibility":"user-or-llm","description":"The objectID of the record to update"},"attributes":{"type":"json","required":true,"visibility":"user-or-llm","description":"JSON object with attributes to update. Supports built-in operations like {\\"stock\\": {\\"_operation\\": \\"Decrement\\", \\"value\\": 1}}"},"createIfNotExists":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Whether to create the record if it does not exist (default: true)"}},"hostedApiKey":"none"},"algolia_search":{"id":"algolia_search","name":"Algolia Search","description":"Search an Algolia index","version":"1.0","params":{"applicationId":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Application ID"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Algolia API Key"},"indexName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the Algolia index to search"},"query":{"type":"string","required":true,"visibility":"user-or-llm","description":"Search query text"},"hitsPerPage":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of hits per page (default: 20)"},"page":{"type":"number","required":false,"visibility":"user-or-llm","description":"Page number to retrieve (default: 0)"},"filters":{"type":"string","required":false,"visibility":"user-or-llm","description":"Filter string (e.g., \\"category:electronics AND price < 100\\")"},"attributesToRetrieve":{"type":"string","required":false,"visibility":"user-or-llm","description":"Comma-separated list of attributes to retrieve"},"facets":{"type":"string","required":false,"visibility":"user-or-llm","description":"Comma-separated list of facet attribute names to retrieve counts for (use \\"*\\" for all)"},"getRankingInfo":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Whether to include detailed ranking information in each hit"},"aroundLatLng":{"type":"string","required":false,"visibility":"user-or-llm","description":"Coordinates for geo-search (e.g., \\"40.71,-74.01\\")"},"aroundRadius":{"type":"string","required":false,"visibility":"user-or-llm","description":"Maximum radius in meters for geo-search, or \\"all\\" for unlimited"},"insideBoundingBox":{"type":"json","required":false,"visibility":"user-or-llm","description":"Bounding box coordinates as [[lat1, lng1, lat2, lng2]] for geo-search"},"insidePolygon":{"type":"json","required":false,"visibility":"user-or-llm","description":"Polygon coordinates as [[lat1, lng1, lat2, lng2, lat3, lng3, ...]] for geo-search"}},"hostedApiKey":"none"},"algolia_update_settings":{"id":"algolia_update_settings","name":"Algolia Update Settings","description":"Update the settings of an Algolia index","version":"1.0","params":{"applicationId":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Application ID"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Admin API Key (must have editSettings ACL)"},"indexName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the Algolia index"},"settings":{"type":"json","required":true,"visibility":"user-or-llm","description":"JSON object with settings to update (e.g., {\\"searchableAttributes\\": [\\"name\\", \\"description\\"], \\"customRanking\\": [\\"desc(popularity)\\"]})"},"forwardToReplicas":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Whether to apply changes to replica indices (default: false)"}},"hostedApiKey":"none"},"amplitude_event_segmentation":{"id":"amplitude_event_segmentation","name":"Amplitude Event Segmentation","description":"Query event analytics data with segmentation. Get event counts, uniques, averages, and more.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude API Key"},"secretKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude Secret Key"},"eventType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Event type name to analyze"},"start":{"type":"string","required":true,"visibility":"user-or-llm","description":"Start date in YYYYMMDD format"},"end":{"type":"string","required":true,"visibility":"user-or-llm","description":"End date in YYYYMMDD format"},"metric":{"type":"string","required":false,"visibility":"user-or-llm","description":"Metric type: uniques, totals, pct_dau, average, histogram, sums, value_avg, or formula (default: uniques)"},"interval":{"type":"string","required":false,"visibility":"user-or-llm","description":"Time interval: 1 (daily), 7 (weekly), or 30 (monthly)"},"groupBy":{"type":"string","required":false,"visibility":"user-or-llm","description":"Property name to group by (prefix custom user properties with \\"gp:\\")"},"groupBy2":{"type":"string","required":false,"visibility":"user-or-llm","description":"Second property name to group by (prefix custom user properties with \\"gp:\\")"},"limit":{"type":"string","required":false,"visibility":"user-or-llm","description":"Maximum number of group-by values (max 1000)"},"filters":{"type":"string","required":false,"visibility":"user-or-llm","description":"JSON array of filter objects applied to the event, e.g. [{\\"subprop_type\\":\\"event\\",\\"subprop_key\\":\\"city\\",\\"subprop_op\\":\\"is\\",\\"subprop_value\\":[\\"San Francisco\\"]}]"},"formula":{"type":"string","required":false,"visibility":"user-or-llm","description":"Required when metric is \\"formula\\", e.g. \\"UNIQUES(A)/UNIQUES(B)\\""},"segment":{"type":"string","required":false,"visibility":"user-or-llm","description":"JSON segment definition(s) applied to the query"},"dataResidency":{"type":"string","required":false,"visibility":"user-or-llm","description":"Data residency region: \\"us\\" (default) or \\"eu\\""}},"hostedApiKey":"none"},"amplitude_funnels":{"id":"amplitude_funnels","name":"Amplitude Funnels","description":"Analyze conversion rates and drop-off between a sequence of events.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude API Key"},"secretKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude Secret Key"},"events":{"type":"string","required":true,"visibility":"user-or-llm","description":"JSON array of event objects, one per funnel step in order, e.g. [{\\"event_type\\":\\"signup\\"},{\\"event_type\\":\\"purchase\\"}]"},"start":{"type":"string","required":true,"visibility":"user-or-llm","description":"Start date in YYYYMMDD format"},"end":{"type":"string","required":true,"visibility":"user-or-llm","description":"End date in YYYYMMDD format"},"mode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Funnel ordering: \\"ordered\\", \\"unordered\\", or \\"sequential\\" (default: ordered)"},"userType":{"type":"string","required":false,"visibility":"user-or-llm","description":"User type: \\"new\\" or \\"active\\" (default: active)"},"interval":{"type":"string","required":false,"visibility":"user-or-llm","description":"Time interval: -300000 (real-time), -3600000 (hourly), 1 (daily), 7 (weekly), or 30 (monthly)"},"conversionWindowSeconds":{"type":"string","required":false,"visibility":"user-or-llm","description":"Conversion window in seconds (default: 2592000, i.e. 30 days)"},"groupBy":{"type":"string","required":false,"visibility":"user-or-llm","description":"Property to group by (limit: one; prefix custom properties with \\"gp:\\")"},"limit":{"type":"string","required":false,"visibility":"user-or-llm","description":"Maximum number of group-by values (default: 100, max: 1000)"},"segment":{"type":"string","required":false,"visibility":"user-or-llm","description":"JSON segment definition(s) applied to the query"},"dataResidency":{"type":"string","required":false,"visibility":"user-or-llm","description":"Data residency region: \\"us\\" (default) or \\"eu\\""}},"hostedApiKey":"none"},"amplitude_get_active_users":{"id":"amplitude_get_active_users","name":"Amplitude Get Active Users","description":"Get active or new user counts over a date range from the Dashboard REST API.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude API Key"},"secretKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude Secret Key"},"start":{"type":"string","required":true,"visibility":"user-or-llm","description":"Start date in YYYYMMDD format"},"end":{"type":"string","required":true,"visibility":"user-or-llm","description":"End date in YYYYMMDD format"},"metric":{"type":"string","required":false,"visibility":"user-or-llm","description":"Metric type: \\"active\\" or \\"new\\" (default: active)"},"interval":{"type":"string","required":false,"visibility":"user-or-llm","description":"Time interval: 1 (daily), 7 (weekly), or 30 (monthly)"},"groupBy":{"type":"string","required":false,"visibility":"user-or-llm","description":"Property name to group by"},"segment":{"type":"string","required":false,"visibility":"user-or-llm","description":"JSON segment definition(s) applied to the query"},"dataResidency":{"type":"string","required":false,"visibility":"user-or-llm","description":"Data residency region: \\"us\\" (default) or \\"eu\\""}},"hostedApiKey":"none"},"amplitude_get_revenue":{"id":"amplitude_get_revenue","name":"Amplitude Get Revenue","description":"Get revenue LTV data including ARPU, ARPPU, total revenue, and paying user counts.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude API Key"},"secretKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude Secret Key"},"start":{"type":"string","required":true,"visibility":"user-or-llm","description":"Start date in YYYYMMDD format"},"end":{"type":"string","required":true,"visibility":"user-or-llm","description":"End date in YYYYMMDD format"},"metric":{"type":"string","required":false,"visibility":"user-or-llm","description":"Metric: 0 (ARPU), 1 (ARPPU), 2 (Total Revenue), 3 (Paying Users)"},"interval":{"type":"string","required":false,"visibility":"user-or-llm","description":"Time interval: 1 (daily), 7 (weekly), or 30 (monthly)"},"groupBy":{"type":"string","required":false,"visibility":"user-or-llm","description":"Property name to group by (limit: one)"},"segment":{"type":"string","required":false,"visibility":"user-or-llm","description":"JSON segment definition(s) applied to the query"},"dataResidency":{"type":"string","required":false,"visibility":"user-or-llm","description":"Data residency region: \\"us\\" (default) or \\"eu\\""}},"hostedApiKey":"none"},"amplitude_group_identify":{"id":"amplitude_group_identify","name":"Amplitude Group Identify","description":"Set group-level properties in Amplitude. Supports $set, $setOnce, $add, $append, $unset operations.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude API Key"},"groupType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Group classification (e.g., \\"company\\", \\"org_id\\")"},"groupValue":{"type":"string","required":true,"visibility":"user-or-llm","description":"Specific group identifier (e.g., \\"Acme Corp\\")"},"groupProperties":{"type":"string","required":true,"visibility":"user-or-llm","description":"JSON object of group properties. Use operations like $set, $setOnce, $add, $append, $unset."},"dataResidency":{"type":"string","required":false,"visibility":"user-or-llm","description":"Data residency region: \\"us\\" (default) or \\"eu\\""}},"hostedApiKey":"none"},"amplitude_identify_user":{"id":"amplitude_identify_user","name":"Amplitude Identify User","description":"Set user properties in Amplitude using the Identify API. Supports $set, $setOnce, $add, $append, $unset operations.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude API Key"},"userId":{"type":"string","required":false,"visibility":"user-or-llm","description":"User ID (required if no device_id)"},"deviceId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Device ID (required if no user_id)"},"userProperties":{"type":"string","required":true,"visibility":"user-or-llm","description":"JSON object of user properties. Use operations like $set, $setOnce, $add, $append, $unset."},"dataResidency":{"type":"string","required":false,"visibility":"user-or-llm","description":"Data residency region: \\"us\\" (default) or \\"eu\\""}},"hostedApiKey":"none"},"amplitude_list_events":{"id":"amplitude_list_events","name":"Amplitude List Events","description":"List all event types in the Amplitude project with their weekly totals and unique counts.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude API Key"},"secretKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude Secret Key"},"dataResidency":{"type":"string","required":false,"visibility":"user-or-llm","description":"Data residency region: \\"us\\" (default) or \\"eu\\""}},"hostedApiKey":"none"},"amplitude_realtime_active_users":{"id":"amplitude_realtime_active_users","name":"Amplitude Real-time Active Users","description":"Get real-time active user counts at 5-minute granularity for the last 2 days.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude API Key"},"secretKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude Secret Key"},"dataResidency":{"type":"string","required":false,"visibility":"user-or-llm","description":"Data residency region: \\"us\\" (default) or \\"eu\\""}},"hostedApiKey":"none"},"amplitude_retention":{"id":"amplitude_retention","name":"Amplitude Retention","description":"Measure how many users return to perform an action after a starting action.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude API Key"},"secretKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude Secret Key"},"startEvent":{"type":"string","required":true,"visibility":"user-or-llm","description":"JSON starting event object, e.g. {\\"event_type\\":\\"_new\\"} or {\\"event_type\\":\\"_active\\"}"},"returnEvent":{"type":"string","required":true,"visibility":"user-or-llm","description":"JSON returning event object, e.g. {\\"event_type\\":\\"_all\\"} or {\\"event_type\\":\\"_active\\"}"},"start":{"type":"string","required":true,"visibility":"user-or-llm","description":"Start date in YYYYMMDD format"},"end":{"type":"string","required":true,"visibility":"user-or-llm","description":"End date in YYYYMMDD format"},"retentionMode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Retention type: \\"bracket\\", \\"rolling\\", or \\"n-day\\" (default: n-day)"},"retentionBrackets":{"type":"string","required":false,"visibility":"user-or-llm","description":"Required when Retention Mode is \\"bracket\\". Day ranges, e.g. [[0,4]]"},"interval":{"type":"string","required":false,"visibility":"user-or-llm","description":"Time interval: 1 (daily), 7 (weekly), or 30 (monthly)"},"groupBy":{"type":"string","required":false,"visibility":"user-or-llm","description":"Property to group by (limit: one; prefix custom properties with \\"gp:\\")"},"segment":{"type":"string","required":false,"visibility":"user-or-llm","description":"JSON segment definition(s) applied to the query"},"dataResidency":{"type":"string","required":false,"visibility":"user-or-llm","description":"Data residency region: \\"us\\" (default) or \\"eu\\""}},"hostedApiKey":"none"},"amplitude_send_event":{"id":"amplitude_send_event","name":"Amplitude Send Event","description":"Track an event in Amplitude using the HTTP V2 API.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude API Key"},"userId":{"type":"string","required":false,"visibility":"user-or-llm","description":"User ID (required if no device_id)"},"deviceId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Device ID (required if no user_id)"},"eventType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the event (e.g., \\"page_view\\", \\"purchase\\")"},"eventProperties":{"type":"string","required":false,"visibility":"user-or-llm","description":"JSON object of custom event properties"},"userProperties":{"type":"string","required":false,"visibility":"user-or-llm","description":"JSON object of user properties to set (supports $set, $setOnce, $add, $append, $unset)"},"time":{"type":"string","required":false,"visibility":"user-or-llm","description":"Event timestamp in milliseconds since epoch"},"sessionId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Session start time in milliseconds since epoch"},"insertId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Unique ID for deduplication (within 7-day window)"},"appVersion":{"type":"string","required":false,"visibility":"user-or-llm","description":"Application version string"},"platform":{"type":"string","required":false,"visibility":"user-or-llm","description":"Platform (e.g., \\"Web\\", \\"iOS\\", \\"Android\\")"},"country":{"type":"string","required":false,"visibility":"user-or-llm","description":"Two-letter country code"},"language":{"type":"string","required":false,"visibility":"user-or-llm","description":"Language code (e.g., \\"en\\")"},"ip":{"type":"string","required":false,"visibility":"user-or-llm","description":"IP address for geo-location"},"price":{"type":"string","required":false,"visibility":"user-or-llm","description":"Price of the item purchased"},"quantity":{"type":"string","required":false,"visibility":"user-or-llm","description":"Quantity of items purchased"},"revenue":{"type":"string","required":false,"visibility":"user-or-llm","description":"Revenue amount"},"productId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Product identifier"},"revenueType":{"type":"string","required":false,"visibility":"user-or-llm","description":"Revenue type (e.g., \\"purchase\\", \\"refund\\")"},"dataResidency":{"type":"string","required":false,"visibility":"user-or-llm","description":"Data residency region: \\"us\\" (default) or \\"eu\\""}},"hostedApiKey":"none"},"amplitude_user_activity":{"id":"amplitude_user_activity","name":"Amplitude User Activity","description":"Get the event stream for a specific user by their Amplitude ID.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude API Key"},"secretKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude Secret Key"},"amplitudeId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Amplitude internal user ID"},"offset":{"type":"string","required":false,"visibility":"user-or-llm","description":"Offset for pagination (default 0)"},"limit":{"type":"string","required":false,"visibility":"user-or-llm","description":"Maximum number of events to return (default 1000, max 1000)"},"direction":{"type":"string","required":false,"visibility":"user-or-llm","description":"Sort direction: \\"latest\\" or \\"earliest\\" (default: latest)"},"dataResidency":{"type":"string","required":false,"visibility":"user-or-llm","description":"Data residency region: \\"us\\" (default) or \\"eu\\""}},"hostedApiKey":"none"},"amplitude_user_profile":{"id":"amplitude_user_profile","name":"Amplitude User Profile","description":"Get a user profile including properties, cohort memberships, and computed properties. Not available for EU data-residency projects.","version":"1.0.0","params":{"secretKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude Secret Key"},"userId":{"type":"string","required":false,"visibility":"user-or-llm","description":"External user ID (required if no device_id)"},"deviceId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Device ID (required if no user_id)"},"getAmpProps":{"type":"string","required":false,"visibility":"user-or-llm","description":"Include Amplitude user properties (true/false, default: false)"},"getCohortIds":{"type":"string","required":false,"visibility":"user-or-llm","description":"Include cohort IDs the user belongs to (true/false, default: false)"},"getComputations":{"type":"string","required":false,"visibility":"user-or-llm","description":"Include computed user properties (true/false, default: false)"}},"hostedApiKey":"none"},"amplitude_user_search":{"id":"amplitude_user_search","name":"Amplitude User Search","description":"Search for a user by User ID, Device ID, or Amplitude ID using the Dashboard REST API.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude API Key"},"secretKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude Secret Key"},"user":{"type":"string","required":true,"visibility":"user-or-llm","description":"User ID, Device ID, or Amplitude ID to search for"},"dataResidency":{"type":"string","required":false,"visibility":"user-or-llm","description":"Data residency region: \\"us\\" (default) or \\"eu\\""}},"hostedApiKey":"none"},"apify_get_dataset_items":{"id":"apify_get_dataset_items","name":"APIFY Get Dataset Items","description":"Retrieve items stored in an APIFY dataset","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"APIFY API token from console.apify.com/account#/integrations"},"datasetId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Dataset ID to read items from. Example: \\"9RnD3Pql2vGZkc5H5\\""},"itemLimit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Max items to return (1-250000). Default: all items. Example: 500"},"offset":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to skip at the start. Default: 0"},"fields":{"type":"string","required":false,"visibility":"user-or-llm","description":"Comma-separated list of fields to include. Example: \\"title,url,price\\""}},"hostedApiKey":"none"},"apify_get_run":{"id":"apify_get_run","name":"APIFY Get Run","description":"Get the status and details of an APIFY actor run","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"APIFY API token from console.apify.com/account#/integrations"},"runId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Actor run ID to fetch. Example: \\"HG7ML7M8z78YcAPEB\\""}},"hostedApiKey":"none"},"apify_run_actor_async":{"id":"apify_run_actor_async","name":"APIFY Run Actor (Async)","description":"Start an APIFY Actor run and poll it within the same workflow step until completion or the polling deadline","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"APIFY API token from console.apify.com/account#/integrations"},"actorId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Actor ID or username/actor-name. Examples: \\"apify/web-scraper\\", \\"janedoe/my-actor\\", \\"moJRLRc85AitArpNN\\""},"input":{"type":"string","required":false,"visibility":"user-or-llm","description":"Actor input as JSON string. Example: { \\"startUrls\\": [ { \\"url\\": \\"https://example.com\\" } ], \\"maxPages\\": 10 }"},"waitForFinish":{"type":"number","required":false,"visibility":"user-or-llm","description":"Initial wait time in seconds (0-60) before polling starts. Example: 30"},"itemLimit":{"type":"number","required":false,"default":100,"visibility":"user-or-llm","description":"Max dataset items to fetch (1-250000). Default: 100. Example: 500"},"memory":{"type":"number","required":false,"visibility":"user-or-llm","description":"Memory in megabytes allocated for the actor run (128-32768). Example: 1024 for 1GB, 2048 for 2GB"},"timeout":{"type":"number","required":false,"visibility":"user-or-llm","description":"Timeout in seconds for the actor run. Example: 300 for 5 minutes, 3600 for 1 hour"},"build":{"type":"string","required":false,"visibility":"user-or-llm","description":"Actor build to run. Examples: \\"latest\\", \\"beta\\", \\"1.2.3\\", \\"build-tag-name\\""}},"hostedApiKey":"none"},"apify_run_actor_sync":{"id":"apify_run_actor_sync","name":"APIFY Run Actor (Sync)","description":"Run an APIFY actor synchronously and get results (max 5 minutes)","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"APIFY API token from console.apify.com/account#/integrations"},"actorId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Actor ID or username/actor-name. Examples: \\"apify/web-scraper\\", \\"janedoe/my-actor\\", \\"moJRLRc85AitArpNN\\""},"input":{"type":"string","required":false,"visibility":"user-or-llm","description":"Actor input as JSON string. Example: { \\"startUrls\\": [ { \\"url\\": \\"https://example.com\\" } ], \\"maxPages\\": 10 }"},"memory":{"type":"number","required":false,"visibility":"user-or-llm","description":"Memory in megabytes allocated for the actor run (128-32768). Example: 1024 for 1GB, 2048 for 2GB"},"timeout":{"type":"number","required":false,"visibility":"user-or-llm","description":"Timeout in seconds for the actor run. Example: 300 for 5 minutes, 3600 for 1 hour"},"build":{"type":"string","required":false,"visibility":"user-or-llm","description":"Actor build to run. Examples: \\"latest\\", \\"beta\\", \\"1.2.3\\", \\"build-tag-name\\""}},"hostedApiKey":"none"},"apify_run_task":{"id":"apify_run_task","name":"APIFY Run Task","description":"Run a saved APIFY actor task synchronously and get dataset items (max 5 minutes)","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"APIFY API token from console.apify.com/account#/integrations"},"taskId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Task ID or username/task-name. Examples: \\"janedoe/my-task\\", \\"moJRLRc85AitArpNN\\""},"input":{"type":"string","required":false,"visibility":"user-or-llm","description":"JSON string that overrides the task\'s saved input. Example: { \\"startUrls\\": [ { \\"url\\": \\"https://example.com\\" } ] }"},"itemLimit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Max dataset items to return (1-250000). Example: 500"},"memory":{"type":"number","required":false,"visibility":"user-or-llm","description":"Memory in megabytes allocated for the run (128-32768). Example: 1024 for 1GB"},"timeout":{"type":"number","required":false,"visibility":"user-or-llm","description":"Timeout in seconds for the run. Example: 300 for 5 minutes"},"build":{"type":"string","required":false,"visibility":"user-or-llm","description":"Actor build to run. Examples: \\"latest\\", \\"beta\\", \\"1.2.3\\""}},"hostedApiKey":"none"},"apollo_account_bulk_create":{"id":"apollo_account_bulk_create","name":"Apollo Bulk Create Accounts","description":"Create up to 100 accounts at once in your Apollo database. Set run_dedupe=true to deduplicate by domain, organization_id, and name. Master key required.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key (master key required)"},"accounts":{"type":"array","required":true,"visibility":"user-or-llm","description":"Array of accounts to create (max 100). Each account should include a name, and may optionally include domain, phone, phone_status_cd, raw_address, owner_id, linkedin_url, facebook_url, twitter_url, salesforce_id, and hubspot_id."},"append_label_names":{"type":"array","required":false,"visibility":"user-only","description":"Array of label names to add to ALL accounts in this request"},"run_dedupe":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"When true, performs aggressive deduplication by domain, organization_id, and name (defaults to false)"}},"hostedApiKey":"none"},"apollo_account_bulk_update":{"id":"apollo_account_bulk_update","name":"Apollo Bulk Update Accounts","description":"Update up to 1000 existing accounts at once in your Apollo database (higher limit than contacts!). Each account must include an id field. Master key required.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key (master key required)"},"account_ids":{"type":"array","required":false,"visibility":"user-or-llm","description":"Array of account IDs to update with the same values (max 1000). Use with name/owner_id for uniform updates. Use either this OR account_attributes."},"name":{"type":"string","required":false,"visibility":"user-or-llm","description":"When using account_ids, apply this name to all accounts"},"owner_id":{"type":"string","required":false,"visibility":"user-or-llm","description":"When using account_ids, apply this owner to all accounts"},"account_stage_id":{"type":"string","required":false,"visibility":"user-or-llm","description":"When using account_ids, apply this account stage to all accounts"},"account_attributes":{"type":"json","required":false,"visibility":"user-or-llm","description":"Array of account objects with individual updates (each must include id). Example: [{\\"id\\": \\"acc1\\", \\"name\\": \\"Acme\\", \\"owner_id\\": \\"u1\\", \\"account_stage_id\\": \\"s1\\", \\"typed_custom_fields\\": {\\"field_id\\": \\"value\\"}}]"},"async":{"type":"boolean","required":false,"visibility":"user-only","description":"When true, processes the update asynchronously. Only supported when using account_ids; returns 422 if used with account_attributes."}},"hostedApiKey":"none"},"apollo_account_create":{"id":"apollo_account_create","name":"Apollo Create Account","description":"Create a new account (company) in your Apollo database","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key (master key required)"},"name":{"type":"string","required":true,"visibility":"user-or-llm","description":"Company name (e.g., \\"Acme Corporation\\")"},"domain":{"type":"string","required":false,"visibility":"user-or-llm","description":"Company domain without www. prefix (e.g., \\"acme.com\\")"},"phone":{"type":"string","required":false,"visibility":"user-or-llm","description":"Primary phone number for the account"},"owner_id":{"type":"string","required":false,"visibility":"user-only","description":"Apollo user ID of the account owner"},"account_stage_id":{"type":"string","required":false,"visibility":"user-only","description":"Apollo ID for the account stage to assign this account to"},"raw_address":{"type":"string","required":false,"visibility":"user-or-llm","description":"Corporate location (e.g., \\"San Francisco, CA, USA\\")"},"typed_custom_fields":{"type":"json","required":false,"visibility":"user-only","description":"Custom field values as { custom_field_id: value } map"}},"hostedApiKey":"none"},"apollo_account_search":{"id":"apollo_account_search","name":"Apollo Search Accounts","description":"Search your team\'s accounts in Apollo. Display limit: 50,000 records (100 records per page, 500 pages max). Use filters to narrow results. Master key required.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key (master key required)"},"q_organization_name":{"type":"string","required":false,"visibility":"user-or-llm","description":"Filter accounts by organization name (partial-match search)"},"account_stage_ids":{"type":"array","required":false,"visibility":"user-only","description":"Filter by account stage IDs"},"account_label_ids":{"type":"array","required":false,"visibility":"user-only","description":"Filter by account label IDs"},"sort_by_field":{"type":"string","required":false,"visibility":"user-or-llm","description":"Sort field: \\"account_last_activity_date\\", \\"account_created_at\\", or \\"account_updated_at\\""},"sort_ascending":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Sort ascending when true. Defaults to descending."},"page":{"type":"number","required":false,"visibility":"user-or-llm","description":"Page number for pagination (e.g., 1, 2, 3)"},"per_page":{"type":"number","required":false,"visibility":"user-or-llm","description":"Results per page, max 100 (e.g., 25, 50, 100)"}},"hostedApiKey":"none"},"apollo_account_update":{"id":"apollo_account_update","name":"Apollo Update Account","description":"Update an existing account in your Apollo database","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key"},"account_id":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the account to update (e.g., \\"acc_abc123\\")"},"name":{"type":"string","required":false,"visibility":"user-or-llm","description":"Company name (e.g., \\"Acme Corporation\\")"},"domain":{"type":"string","required":false,"visibility":"user-or-llm","description":"Company domain (e.g., \\"acme.com\\")"},"phone":{"type":"string","required":false,"visibility":"user-or-llm","description":"Company phone number"},"owner_id":{"type":"string","required":false,"visibility":"user-only","description":"Apollo user ID of the account owner"},"account_stage_id":{"type":"string","required":false,"visibility":"user-only","description":"Apollo ID for the account stage to assign this account to"},"raw_address":{"type":"string","required":false,"visibility":"user-or-llm","description":"Corporate location (e.g., \\"San Francisco, CA, USA\\")"},"typed_custom_fields":{"type":"json","required":false,"visibility":"user-only","description":"Custom field values as { custom_field_id: value } map"}},"hostedApiKey":"none"},"apollo_contact_bulk_create":{"id":"apollo_contact_bulk_create","name":"Apollo Bulk Create Contacts","description":"Create up to 100 contacts at once in your Apollo database. Supports deduplication to prevent creating duplicate contacts. Master key required.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key (master key required)"},"contacts":{"type":"array","required":true,"visibility":"user-or-llm","description":"Array of contacts to create (max 100). Each contact may include first_name, last_name, email, title, organization_name, account_id, owner_id, contact_stage_id, linkedin_url, phone (single string) or phone_numbers (array of {raw_number, position}), contact_emails, typed_custom_fields, and CRM IDs (salesforce_contact_id, hubspot_id, team_id) for cross-system matching"},"append_label_names":{"type":"array","required":false,"visibility":"user-or-llm","description":"Label names to add to all contacts in this request (e.g., [\\"Hot Lead\\"])"},"run_dedupe":{"type":"boolean","required":false,"visibility":"user-only","description":"Enable deduplication to prevent creating duplicate contacts. When true, existing contacts are returned without modification"}},"hostedApiKey":"none"},"apollo_contact_bulk_update":{"id":"apollo_contact_bulk_update","name":"Apollo Bulk Update Contacts","description":"Update up to 100 existing contacts at once in your Apollo database. Each contact must include an id field. Master key required.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key (master key required)"},"contact_ids":{"type":"array","required":false,"visibility":"user-or-llm","description":"Array of contact IDs to update. Must be paired with an object-form contact_attributes specifying the fields to apply uniformly to all listed contacts."},"contact_attributes":{"type":"json","required":false,"visibility":"user-or-llm","description":"Required. Either an array of per-contact updates (each with id) — used standalone — or a single object of attributes to apply to all contact_ids. Supported fields: owner_id, email, organization_name, title, first_name, last_name, account_id, present_raw_address, linkedin_url, typed_custom_fields"},"async":{"type":"boolean","required":false,"visibility":"user-only","description":"Force asynchronous processing. Automatically enabled for >100 contacts"}},"hostedApiKey":"none"},"apollo_contact_create":{"id":"apollo_contact_create","name":"Apollo Create Contact","description":"Create a new contact in your Apollo database","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key"},"first_name":{"type":"string","required":true,"visibility":"user-or-llm","description":"First name of the contact"},"last_name":{"type":"string","required":true,"visibility":"user-or-llm","description":"Last name of the contact"},"email":{"type":"string","required":false,"visibility":"user-or-llm","description":"Email address of the contact"},"title":{"type":"string","required":false,"visibility":"user-or-llm","description":"Job title (e.g., \\"VP of Sales\\", \\"Software Engineer\\")"},"account_id":{"type":"string","required":false,"visibility":"user-or-llm","description":"Apollo account ID to associate with (e.g., \\"acc_abc123\\")"},"owner_id":{"type":"string","required":false,"visibility":"user-only","description":"User ID of the contact owner (accepted by Apollo but not officially documented for POST /contacts)"},"organization_name":{"type":"string","required":false,"visibility":"user-or-llm","description":"Name of the contact\'s employer (e.g., \\"Apollo\\")"},"website_url":{"type":"string","required":false,"visibility":"user-or-llm","description":"Corporate website URL (e.g., \\"https://www.apollo.io/\\")"},"label_names":{"type":"array","required":false,"visibility":"user-or-llm","description":"Lists/labels to add the contact to (e.g., [\\"Prospects\\"])"},"contact_stage_id":{"type":"string","required":false,"visibility":"user-or-llm","description":"Apollo ID for the contact stage"},"present_raw_address":{"type":"string","required":false,"visibility":"user-or-llm","description":"Personal location for the contact (e.g., \\"Atlanta, United States\\")"},"direct_phone":{"type":"string","required":false,"visibility":"user-or-llm","description":"Primary phone number"},"corporate_phone":{"type":"string","required":false,"visibility":"user-or-llm","description":"Work/office phone number"},"mobile_phone":{"type":"string","required":false,"visibility":"user-or-llm","description":"Mobile phone number"},"home_phone":{"type":"string","required":false,"visibility":"user-or-llm","description":"Home phone number"},"other_phone":{"type":"string","required":false,"visibility":"user-or-llm","description":"Alternative phone number"},"typed_custom_fields":{"type":"json","required":false,"visibility":"user-or-llm","description":"Custom field values keyed by custom field ID"},"run_dedupe":{"type":"boolean","required":false,"visibility":"user-only","description":"When true, Apollo deduplicates against existing contacts"}},"hostedApiKey":"none"},"apollo_contact_search":{"id":"apollo_contact_search","name":"Apollo Search Contacts","description":"Search your team\'s contacts in Apollo","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key"},"q_keywords":{"type":"string","required":false,"visibility":"user-or-llm","description":"Keywords to search for"},"contact_stage_ids":{"type":"array","required":false,"visibility":"user-only","description":"Filter by contact stage IDs"},"contact_label_ids":{"type":"array","required":false,"visibility":"user-only","description":"Filter by Apollo label IDs (lists)"},"sort_by_field":{"type":"string","required":false,"visibility":"user-only","description":"Sort field: contact_last_activity_date, contact_email_last_opened_at, contact_email_last_clicked_at, contact_created_at, or contact_updated_at"},"sort_ascending":{"type":"boolean","required":false,"visibility":"user-only","description":"When true, sort ascending. Must be used together with sort_by_field"},"page":{"type":"number","required":false,"visibility":"user-or-llm","description":"Page number for pagination (e.g., 1, 2, 3)"},"per_page":{"type":"number","required":false,"visibility":"user-or-llm","description":"Results per page, max 100 (e.g., 25, 50, 100)"}},"hostedApiKey":"none"},"apollo_contact_update":{"id":"apollo_contact_update","name":"Apollo Update Contact","description":"Update an existing contact in your Apollo database","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key"},"contact_id":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the contact to update (e.g., \\"con_abc123\\")"},"first_name":{"type":"string","required":false,"visibility":"user-or-llm","description":"First name of the contact"},"last_name":{"type":"string","required":false,"visibility":"user-or-llm","description":"Last name of the contact"},"email":{"type":"string","required":false,"visibility":"user-or-llm","description":"Email address"},"title":{"type":"string","required":false,"visibility":"user-or-llm","description":"Job title (e.g., \\"VP of Sales\\", \\"Software Engineer\\")"},"account_id":{"type":"string","required":false,"visibility":"user-or-llm","description":"Apollo account ID (e.g., \\"acc_abc123\\")"},"owner_id":{"type":"string","required":false,"visibility":"user-only","description":"User ID of the contact owner (accepted by Apollo but not officially documented for PATCH /contacts/{id})"},"organization_name":{"type":"string","required":false,"visibility":"user-or-llm","description":"Name of the contact\'s employer (e.g., \\"Apollo\\")"},"website_url":{"type":"string","required":false,"visibility":"user-or-llm","description":"Corporate website URL (e.g., \\"https://www.apollo.io/\\")"},"label_names":{"type":"array","required":false,"visibility":"user-or-llm","description":"Lists/labels to add the contact to (e.g., [\\"Prospects\\"])"},"contact_stage_id":{"type":"string","required":false,"visibility":"user-or-llm","description":"Apollo ID for the contact stage"},"present_raw_address":{"type":"string","required":false,"visibility":"user-or-llm","description":"Personal location for the contact (e.g., \\"Atlanta, United States\\")"},"direct_phone":{"type":"string","required":false,"visibility":"user-or-llm","description":"Primary phone number"},"corporate_phone":{"type":"string","required":false,"visibility":"user-or-llm","description":"Work/office phone number"},"mobile_phone":{"type":"string","required":false,"visibility":"user-or-llm","description":"Mobile phone number"},"home_phone":{"type":"string","required":false,"visibility":"user-or-llm","description":"Home phone number"},"other_phone":{"type":"string","required":false,"visibility":"user-or-llm","description":"Alternative phone number"},"typed_custom_fields":{"type":"json","required":false,"visibility":"user-or-llm","description":"Custom field values keyed by custom field ID"}},"hostedApiKey":"none"},"apollo_email_accounts":{"id":"apollo_email_accounts","name":"Apollo Get Email Accounts","description":"Get list of team\'s linked email accounts in Apollo","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key (master key required)"}},"hostedApiKey":"none"},"apollo_opportunity_create":{"id":"apollo_opportunity_create","name":"Apollo Create Opportunity","description":"Create a new deal for an account in your Apollo database (master key required)","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key (master key required)"},"name":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the opportunity/deal (e.g., \\"Enterprise License - Q1\\")"},"account_id":{"type":"string","required":false,"visibility":"user-or-llm","description":"ID of the account this opportunity belongs to (e.g., \\"acc_abc123\\")"},"amount":{"type":"string","required":false,"visibility":"user-or-llm","description":"Monetary value as a plain number string with no commas or currency symbols"},"opportunity_stage_id":{"type":"string","required":false,"visibility":"user-only","description":"ID of the opportunity stage"},"owner_id":{"type":"string","required":false,"visibility":"user-only","description":"User ID of the opportunity owner"},"closed_date":{"type":"string","required":false,"visibility":"user-or-llm","description":"Expected close date in YYYY-MM-DD format"},"typed_custom_fields":{"type":"json","required":false,"visibility":"user-only","description":"Custom field values as { custom_field_id: value } map"}},"hostedApiKey":"none"},"apollo_opportunity_get":{"id":"apollo_opportunity_get","name":"Apollo Get Opportunity","description":"Retrieve complete details of a specific deal/opportunity by ID","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key"},"opportunity_id":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the opportunity to retrieve (e.g., \\"opp_abc123\\")"}},"hostedApiKey":"none"},"apollo_opportunity_search":{"id":"apollo_opportunity_search","name":"Apollo Search Opportunities","description":"Search and list all deals/opportunities in your team\'s Apollo account","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key"},"sort_by_field":{"type":"string","required":false,"visibility":"user-or-llm","description":"Sort field: \\"amount\\", \\"is_closed\\", or \\"is_won\\""},"page":{"type":"number","required":false,"visibility":"user-or-llm","description":"Page number for pagination (e.g., 1, 2, 3)"},"per_page":{"type":"number","required":false,"visibility":"user-or-llm","description":"Results per page, max 100 (e.g., 25, 50, 100)"}},"hostedApiKey":"none"},"apollo_opportunity_update":{"id":"apollo_opportunity_update","name":"Apollo Update Opportunity","description":"Update an existing deal/opportunity in your Apollo database","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key"},"opportunity_id":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the opportunity to update (e.g., \\"opp_abc123\\")"},"name":{"type":"string","required":false,"visibility":"user-or-llm","description":"Name of the opportunity/deal (e.g., \\"Enterprise License - Q1\\")"},"amount":{"type":"string","required":false,"visibility":"user-or-llm","description":"Monetary value as a plain number string with no commas or currency symbols"},"opportunity_stage_id":{"type":"string","required":false,"visibility":"user-only","description":"ID of the opportunity stage"},"owner_id":{"type":"string","required":false,"visibility":"user-only","description":"User ID of the opportunity owner"},"closed_date":{"type":"string","required":false,"visibility":"user-or-llm","description":"Expected close date in YYYY-MM-DD format"},"typed_custom_fields":{"type":"json","required":false,"visibility":"user-only","description":"Custom field values as { custom_field_id: value } map"}},"hostedApiKey":"none"},"apollo_organization_bulk_enrich":{"id":"apollo_organization_bulk_enrich","name":"Apollo Bulk Organization Enrichment","description":"Enrich data for up to 10 organizations at once using Apollo","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key"},"domains":{"type":"array","required":true,"visibility":"user-or-llm","description":"Array of company domains to enrich (max 10, no www. or @, e.g., [\\"apollo.io\\", \\"stripe.com\\"])"}},"hostedApiKey":"none"},"apollo_organization_enrich":{"id":"apollo_organization_enrich","name":"Apollo Organization Enrichment","description":"Enrich data for a single organization using Apollo","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key"},"domain":{"type":"string","required":true,"visibility":"user-or-llm","description":"Company domain (e.g., \\"apollo.io\\", \\"acme.com\\")"}},"hostedApiKey":"none"},"apollo_organization_search":{"id":"apollo_organization_search","name":"Apollo Organization Search","description":"Search Apollo\'s database for companies using filters","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key"},"organization_locations":{"type":"array","required":false,"visibility":"user-or-llm","description":"Company HQ locations (cities, US states, or countries)"},"organization_not_locations":{"type":"array","required":false,"visibility":"user-or-llm","description":"Exclude companies whose HQ is in these locations"},"organization_num_employees_ranges":{"type":"array","required":false,"visibility":"user-or-llm","description":"Employee count ranges as \\"min,max\\" strings (e.g., [\\"1,10\\", \\"250,500\\", \\"10000,20000\\"])"},"q_organization_keyword_tags":{"type":"array","required":false,"visibility":"user-or-llm","description":"Industry or keyword tags"},"q_organization_name":{"type":"string","required":false,"visibility":"user-or-llm","description":"Organization name to search for (e.g., \\"Acme\\", \\"TechCorp\\")"},"organization_ids":{"type":"array","required":false,"visibility":"user-or-llm","description":"Apollo organization IDs to include (e.g., [\\"5e66b6381e05b4008c8331b8\\"])"},"q_organization_domains_list":{"type":"array","required":false,"visibility":"user-or-llm","description":"Domain names to filter by (no www. or @, up to 1,000)"},"page":{"type":"number","required":false,"visibility":"user-or-llm","description":"Page number for pagination (e.g., 1, 2, 3)"},"per_page":{"type":"number","required":false,"visibility":"user-or-llm","description":"Results per page, max 100 (e.g., 25, 50, 100)"}},"hostedApiKey":"none"},"apollo_people_bulk_enrich":{"id":"apollo_people_bulk_enrich","name":"Apollo Bulk People Enrichment","description":"Enrich data for up to 10 people at once using Apollo","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key"},"people":{"type":"array","required":true,"visibility":"user-or-llm","description":"Array of people to enrich (max 10)"},"reveal_personal_emails":{"type":"boolean","required":false,"visibility":"user-only","description":"Reveal personal email addresses (uses credits)"},"reveal_phone_number":{"type":"boolean","required":false,"visibility":"user-only","description":"Reveal phone numbers (uses credits, requires webhook_url)"},"webhook_url":{"type":"string","required":false,"visibility":"user-only","description":"Webhook URL for async phone number delivery (required when reveal_phone_number is true)"}},"hostedApiKey":"none"},"apollo_people_enrich":{"id":"apollo_people_enrich","name":"Apollo People Enrichment","description":"Enrich data for a single person using Apollo","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key"},"first_name":{"type":"string","required":false,"visibility":"user-or-llm","description":"First name of the person"},"last_name":{"type":"string","required":false,"visibility":"user-or-llm","description":"Last name of the person"},"name":{"type":"string","required":false,"visibility":"user-or-llm","description":"Full name of the person (alternative to first_name/last_name)"},"id":{"type":"string","required":false,"visibility":"user-or-llm","description":"Apollo ID for the person"},"hashed_email":{"type":"string","required":false,"visibility":"user-or-llm","description":"MD5 or SHA-256 hashed email"},"email":{"type":"string","required":false,"visibility":"user-or-llm","description":"Email address of the person"},"organization_name":{"type":"string","required":false,"visibility":"user-or-llm","description":"Company name where the person works"},"domain":{"type":"string","required":false,"visibility":"user-or-llm","description":"Company domain (e.g., \\"apollo.io\\", \\"acme.com\\")"},"linkedin_url":{"type":"string","required":false,"visibility":"user-or-llm","description":"LinkedIn profile URL"},"reveal_personal_emails":{"type":"boolean","required":false,"visibility":"user-only","description":"Reveal personal email addresses (uses credits)"},"reveal_phone_number":{"type":"boolean","required":false,"visibility":"user-only","description":"Reveal phone numbers (uses credits, requires webhook_url)"},"webhook_url":{"type":"string","required":false,"visibility":"user-only","description":"Webhook URL for async phone number delivery (required when reveal_phone_number is true)"}},"hostedApiKey":"none"},"apollo_people_search":{"id":"apollo_people_search","name":"Apollo People Search","description":"Search Apollo\'s database for people using demographic filters","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key"},"person_titles":{"type":"array","required":false,"visibility":"user-or-llm","description":"Job titles to search for (e.g., [\\"CEO\\", \\"VP of Sales\\"])"},"include_similar_titles":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Whether to return people with job titles similar to person_titles"},"person_locations":{"type":"array","required":false,"visibility":"user-or-llm","description":"Locations to search in (e.g., [\\"San Francisco, CA\\", \\"New York, NY\\"])"},"person_seniorities":{"type":"array","required":false,"visibility":"user-or-llm","description":"Seniority levels (one of: owner, founder, c_suite, partner, vp, head, director, manager, senior, entry, intern)"},"organization_ids":{"type":"array","required":false,"visibility":"user-or-llm","description":"Apollo organization IDs to filter by (e.g., [\\"5e66b6381e05b4008c8331b8\\"])"},"organization_names":{"type":"array","required":false,"visibility":"user-or-llm","description":"Company names to search within (legacy filter)"},"organization_locations":{"type":"array","required":false,"visibility":"user-or-llm","description":"Headquarters locations of the people\'s current employer (e.g., [\'texas\', \'tokyo\', \'spain\'])"},"q_organization_domains_list":{"type":"array","required":false,"visibility":"user-or-llm","description":"Employer domain names (e.g., [\\"apollo.io\\", \\"microsoft.com\\"]) — up to 1,000, no www. or @"},"organization_num_employees_ranges":{"type":"array","required":false,"visibility":"user-or-llm","description":"Employee count ranges for the person\'s current employer. Each entry is \\"min,max\\" (e.g., [\\"1,10\\", \\"250,500\\", \\"10000,20000\\"])"},"contact_email_status":{"type":"array","required":false,"visibility":"user-or-llm","description":"Email statuses to filter by: \\"verified\\", \\"unverified\\", \\"likely to engage\\", \\"unavailable\\""},"q_keywords":{"type":"string","required":false,"visibility":"user-or-llm","description":"Keywords to search for"},"page":{"type":"number","required":false,"visibility":"user-or-llm","description":"Page number for pagination, default 1 (e.g., 1, 2, 3)"},"per_page":{"type":"number","required":false,"visibility":"user-or-llm","description":"Results per page, default 25, max 100 (e.g., 25, 50, 100)"}},"hostedApiKey":"none"},"apollo_sequence_add_contacts":{"id":"apollo_sequence_add_contacts","name":"Apollo Add Contacts to Sequence","description":"Add contacts to an Apollo sequence","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key (master key required)"},"sequence_id":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the sequence to add contacts to (e.g., \\"seq_abc123\\")"},"contact_ids":{"type":"array","required":false,"visibility":"user-or-llm","description":"Array of contact IDs to add to the sequence (e.g., [\\"con_abc123\\", \\"con_def456\\"]). Either contact_ids or label_names must be provided."},"label_names":{"type":"array","required":false,"visibility":"user-or-llm","description":"Array of label names to identify contacts to add to the sequence. Either contact_ids or label_names must be provided."},"send_email_from_email_account_id":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the email account to send from. Use the Get Email Accounts operation to look this up."},"send_email_from_email_address":{"type":"string","required":false,"visibility":"user-only","description":"Specific email address to send from within the email account."},"sequence_no_email":{"type":"boolean","required":false,"visibility":"user-only","description":"Add contacts even if they have no email address"},"sequence_unverified_email":{"type":"boolean","required":false,"visibility":"user-only","description":"Add contacts with unverified email addresses"},"sequence_job_change":{"type":"boolean","required":false,"visibility":"user-only","description":"Add contacts who recently changed jobs"},"sequence_active_in_other_campaigns":{"type":"boolean","required":false,"visibility":"user-only","description":"Add contacts active in other campaigns"},"sequence_finished_in_other_campaigns":{"type":"boolean","required":false,"visibility":"user-only","description":"Add contacts who finished other campaigns"},"sequence_same_company_in_same_campaign":{"type":"boolean","required":false,"visibility":"user-only","description":"Add contacts even if others from the same company are in the sequence"},"contacts_without_ownership_permission":{"type":"boolean","required":false,"visibility":"user-only","description":"Add contacts without ownership permission"},"add_if_in_queue":{"type":"boolean","required":false,"visibility":"user-only","description":"Add contacts even if they are in the queue"},"contact_verification_skipped":{"type":"boolean","required":false,"visibility":"user-only","description":"Skip contact verification when adding"},"user_id":{"type":"string","required":false,"visibility":"user-only","description":"ID of the user performing the action"},"status":{"type":"string","required":false,"visibility":"user-only","description":"Initial status for added contacts: \\"active\\" or \\"paused\\""},"auto_unpause_at":{"type":"string","required":false,"visibility":"user-only","description":"ISO 8601 datetime to automatically unpause contacts"}},"hostedApiKey":"none"},"apollo_sequence_search":{"id":"apollo_sequence_search","name":"Apollo Search Sequences","description":"Search for sequences/campaigns in your team\'s Apollo account (master key required)","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key (master key required)"},"q_name":{"type":"string","required":false,"visibility":"user-or-llm","description":"Search sequences by name (e.g., \\"Outbound Q1\\", \\"Follow-up\\")"},"page":{"type":"number","required":false,"visibility":"user-or-llm","description":"Page number for pagination (e.g., 1, 2, 3)"},"per_page":{"type":"number","required":false,"visibility":"user-or-llm","description":"Results per page, max 100 (e.g., 25, 50, 100)"}},"hostedApiKey":"none"},"apollo_task_create":{"id":"apollo_task_create","name":"Apollo Create Task","description":"Create one or more tasks in Apollo (one task per contact_id, master key required)","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key (master key required)"},"user_id":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the Apollo user the task is assigned to"},"contact_ids":{"type":"array","required":true,"visibility":"user-or-llm","description":"Array of contact IDs. One task is created per contact."},"priority":{"type":"string","required":false,"visibility":"user-or-llm","description":"Task priority: \\"high\\", \\"medium\\", or \\"low\\" (defaults to \\"medium\\")"},"due_at":{"type":"string","required":true,"visibility":"user-or-llm","description":"Due date/time in ISO 8601 format (e.g., \\"2024-12-31T23:59:59Z\\")"},"type":{"type":"string","required":true,"visibility":"user-or-llm","description":"Task type: \\"call\\", \\"outreach_manual_email\\", \\"linkedin_step_connect\\", \\"linkedin_step_message\\", \\"linkedin_step_view_profile\\", \\"linkedin_step_interact_post\\", or \\"action_item\\""},"status":{"type":"string","required":true,"visibility":"user-or-llm","description":"Task status: \\"scheduled\\", \\"completed\\", or \\"skipped\\""},"note":{"type":"string","required":false,"visibility":"user-or-llm","description":"Free-form note providing context for the task"}},"hostedApiKey":"none"},"apollo_task_search":{"id":"apollo_task_search","name":"Apollo Search Tasks","description":"Search for tasks in Apollo","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key (master key required)"},"sort_by_field":{"type":"string","required":false,"visibility":"user-or-llm","description":"Sort field: \\"task_due_at\\" or \\"task_priority\\""},"open_factor_names":{"type":"array","required":false,"visibility":"user-or-llm","description":"Filter by status. Common values: [\\"task_types\\"] for open tasks, [\\"task_completed_at\\"] for completed tasks."},"page":{"type":"number","required":false,"visibility":"user-or-llm","description":"Page number for pagination (e.g., 1, 2, 3)"},"per_page":{"type":"number","required":false,"visibility":"user-or-llm","description":"Results per page, max 100 (e.g., 25, 50, 100)"}},"hostedApiKey":"none"},"appconfig_create_application":{"id":"appconfig_create_application","name":"AppConfig Create Application","description":"Create an application in AWS AppConfig","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"name":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the application to create"},"description":{"type":"string","required":false,"visibility":"user-or-llm","description":"Description of the application"}},"hostedApiKey":"none"},"appconfig_create_configuration_profile":{"id":"appconfig_create_configuration_profile","name":"AppConfig Create Configuration Profile","description":"Create a configuration profile in an AWS AppConfig application","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID to create the configuration profile in"},"name":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the configuration profile"},"locationUri":{"type":"string","required":true,"visibility":"user-or-llm","description":"Where the configuration is stored. Use \\"hosted\\" for AppConfig-hosted configurations, or an SSM/S3 URI"},"description":{"type":"string","required":false,"visibility":"user-or-llm","description":"Description of the configuration profile"},"retrievalRoleArn":{"type":"string","required":false,"visibility":"user-or-llm","description":"ARN of an IAM role to retrieve the configuration (required for non-hosted URIs)"},"type":{"type":"string","required":false,"visibility":"user-or-llm","description":"Profile type: AWS.Freeform (default) or AWS.AppConfig.FeatureFlags"}},"hostedApiKey":"none"},"appconfig_create_environment":{"id":"appconfig_create_environment","name":"AppConfig Create Environment","description":"Create an environment for an AWS AppConfig application","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID to create the environment in"},"name":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the environment to create"},"description":{"type":"string","required":false,"visibility":"user-or-llm","description":"Description of the environment"}},"hostedApiKey":"none"},"appconfig_create_hosted_configuration_version":{"id":"appconfig_create_hosted_configuration_version","name":"AppConfig Create Hosted Configuration Version","description":"Create a new hosted configuration version for an AppConfig configuration profile","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID that owns the configuration profile"},"configurationProfileId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The configuration profile ID to add the version to"},"content":{"type":"string","required":true,"visibility":"user-or-llm","description":"The configuration content (e.g., a JSON or YAML document)"},"contentType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Content type of the configuration (e.g., application/json, text/plain)"},"description":{"type":"string","required":false,"visibility":"user-or-llm","description":"Description of the configuration version"},"latestVersionNumber":{"type":"number","required":false,"visibility":"user-or-llm","description":"The version number of the latest version, used for optimistic concurrency"},"versionLabel":{"type":"string","required":false,"visibility":"user-or-llm","description":"A user-defined label for the configuration version"}},"hostedApiKey":"none"},"appconfig_delete_application":{"id":"appconfig_delete_application","name":"AppConfig Delete Application","description":"Delete an AWS AppConfig application","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID to delete"}},"hostedApiKey":"none"},"appconfig_delete_configuration_profile":{"id":"appconfig_delete_configuration_profile","name":"AppConfig Delete Configuration Profile","description":"Delete an AWS AppConfig configuration profile","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID that owns the configuration profile"},"configurationProfileId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The configuration profile ID to delete"}},"hostedApiKey":"none"},"appconfig_delete_environment":{"id":"appconfig_delete_environment","name":"AppConfig Delete Environment","description":"Delete an AWS AppConfig environment","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID that owns the environment"},"environmentId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The environment ID to delete"}},"hostedApiKey":"none"},"appconfig_delete_hosted_configuration_version":{"id":"appconfig_delete_hosted_configuration_version","name":"AppConfig Delete Hosted Configuration Version","description":"Delete a specific hosted configuration version from an AppConfig profile","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID that owns the configuration profile"},"configurationProfileId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The configuration profile ID that owns the version"},"versionNumber":{"type":"number","required":true,"visibility":"user-or-llm","description":"The version number to delete"}},"hostedApiKey":"none"},"appconfig_get_application":{"id":"appconfig_get_application","name":"AppConfig Get Application","description":"Get details about a single AWS AppConfig application","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID to retrieve"}},"hostedApiKey":"none"},"appconfig_get_configuration":{"id":"appconfig_get_configuration","name":"AppConfig Get Configuration","description":"Retrieve the latest deployed configuration for an AppConfig application, environment, and profile","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID or name to retrieve configuration for"},"environmentId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The environment ID or name to retrieve configuration for"},"configurationProfileId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The configuration profile ID or name to retrieve"}},"hostedApiKey":"none"},"appconfig_get_configuration_profile":{"id":"appconfig_get_configuration_profile","name":"AppConfig Get Configuration Profile","description":"Get details about a single AWS AppConfig configuration profile","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID that owns the configuration profile"},"configurationProfileId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The configuration profile ID to retrieve"}},"hostedApiKey":"none"},"appconfig_get_deployment":{"id":"appconfig_get_deployment","name":"AppConfig Get Deployment","description":"Get details about a specific AWS AppConfig deployment","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID of the deployment"},"environmentId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The environment ID of the deployment"},"deploymentNumber":{"type":"number","required":true,"visibility":"user-or-llm","description":"The sequence number of the deployment"}},"hostedApiKey":"none"},"appconfig_get_environment":{"id":"appconfig_get_environment","name":"AppConfig Get Environment","description":"Get details about a single AWS AppConfig environment","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID that owns the environment"},"environmentId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The environment ID to retrieve"}},"hostedApiKey":"none"},"appconfig_get_hosted_configuration_version":{"id":"appconfig_get_hosted_configuration_version","name":"AppConfig Get Hosted Configuration Version","description":"Retrieve a specific hosted configuration version from an AppConfig profile","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID that owns the configuration profile"},"configurationProfileId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The configuration profile ID to read the version from"},"versionNumber":{"type":"number","required":true,"visibility":"user-or-llm","description":"The version number to retrieve"}},"hostedApiKey":"none"},"appconfig_list_applications":{"id":"appconfig_list_applications","name":"AppConfig List Applications","description":"List applications in AWS AppConfig","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"maxResults":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of applications to return (1-50)"},"nextToken":{"type":"string","required":false,"visibility":"user-or-llm","description":"Pagination token from a previous response"}},"hostedApiKey":"none"},"appconfig_list_configuration_profiles":{"id":"appconfig_list_configuration_profiles","name":"AppConfig List Configuration Profiles","description":"List configuration profiles for an AWS AppConfig application","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID that owns the configuration profiles"},"maxResults":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of configuration profiles to return (1-50)"},"nextToken":{"type":"string","required":false,"visibility":"user-or-llm","description":"Pagination token from a previous response"}},"hostedApiKey":"none"},"appconfig_list_deployment_strategies":{"id":"appconfig_list_deployment_strategies","name":"AppConfig List Deployment Strategies","description":"List deployment strategies available in AWS AppConfig","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"maxResults":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of deployment strategies to return (1-50)"},"nextToken":{"type":"string","required":false,"visibility":"user-or-llm","description":"Pagination token from a previous response"}},"hostedApiKey":"none"},"appconfig_list_deployments":{"id":"appconfig_list_deployments","name":"AppConfig List Deployments","description":"List deployments for an AWS AppConfig environment","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID of the deployments"},"environmentId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The environment ID of the deployments"},"maxResults":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of deployments to return (1-50)"},"nextToken":{"type":"string","required":false,"visibility":"user-or-llm","description":"Pagination token from a previous response"}},"hostedApiKey":"none"},"appconfig_list_environments":{"id":"appconfig_list_environments","name":"AppConfig List Environments","description":"List environments for an AWS AppConfig application","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID that owns the environments"},"maxResults":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of environments to return (1-50)"},"nextToken":{"type":"string","required":false,"visibility":"user-or-llm","description":"Pagination token from a previous response"}},"hostedApiKey":"none"},"appconfig_list_hosted_configuration_versions":{"id":"appconfig_list_hosted_configuration_versions","name":"AppConfig List Hosted Configuration Versions","description":"List hosted configuration versions for an AWS AppConfig configuration profile","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID that owns the configuration profile"},"configurationProfileId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The configuration profile ID to list versions for"},"maxResults":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of versions to return (1-50)"},"nextToken":{"type":"string","required":false,"visibility":"user-or-llm","description":"Pagination token from a previous response"}},"hostedApiKey":"none"},"appconfig_start_deployment":{"id":"appconfig_start_deployment","name":"AppConfig Start Deployment","description":"Start deploying a configuration version to an AWS AppConfig environment","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID to deploy in"},"environmentId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The environment ID to deploy to"},"deploymentStrategyId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The deployment strategy ID to use"},"configurationProfileId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The configuration profile ID to deploy"},"configurationVersion":{"type":"string","required":true,"visibility":"user-or-llm","description":"The configuration version to deploy"},"description":{"type":"string","required":false,"visibility":"user-or-llm","description":"Description of the deployment"}},"hostedApiKey":"none"},"appconfig_stop_deployment":{"id":"appconfig_stop_deployment","name":"AppConfig Stop Deployment","description":"Stop an in-progress AWS AppConfig deployment","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID of the deployment"},"environmentId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The environment ID of the deployment"},"deploymentNumber":{"type":"number","required":true,"visibility":"user-or-llm","description":"The sequence number of the deployment to stop"}},"hostedApiKey":"none"},"appconfig_update_application":{"id":"appconfig_update_application","name":"AppConfig Update Application","description":"Update the name or description of an AWS AppConfig application","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID to update"},"name":{"type":"string","required":false,"visibility":"user-or-llm","description":"New name for the application"},"description":{"type":"string","required":false,"visibility":"user-or-llm","description":"New description for the application"}},"hostedApiKey":"none"},"appconfig_update_configuration_profile":{"id":"appconfig_update_configuration_profile","name":"AppConfig Update Configuration Profile","description":"Update the name, description, or retrieval role of an AppConfig configuration profile","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID that owns the configuration profile"},"configurationProfileId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The configuration profile ID to update"},"name":{"type":"string","required":false,"visibility":"user-or-llm","description":"New name for the configuration profile"},"description":{"type":"string","required":false,"visibility":"user-or-llm","description":"New description for the configuration profile"},"retrievalRoleArn":{"type":"string","required":false,"visibility":"user-or-llm","description":"New ARN of the IAM role used to retrieve the configuration"}},"hostedApiKey":"none"},"appconfig_update_environment":{"id":"appconfig_update_environment","name":"AppConfig Update Environment","description":"Update the name or description of an AWS AppConfig environment","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID that owns the environment"},"environmentId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The environment ID to update"},"name":{"type":"string","required":false,"visibility":"user-or-llm","description":"New name for the environment"},"description":{"type":"string","required":false,"visibility":"user-or-llm","description":"New description for the environment"}},"hostedApiKey":"none"},"arxiv_get_author_papers":{"id":"arxiv_get_author_papers","name":"ArXiv Get Author Papers","description":"Search for papers by a specific author on ArXiv.","version":"1.0.0","params":{"authorName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Author name to search for"},"maxResults":{"type":"number","required":false,"visibility":"user-only","description":"Maximum number of results to return (default: 10, max: 2000)"}},"hostedApiKey":"none"},"arxiv_get_paper":{"id":"arxiv_get_paper","name":"ArXiv Get Paper","description":"Get detailed information about a specific ArXiv paper by its ID.","version":"1.0.0","params":{"paperId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ArXiv paper ID (e.g., \\"1706.03762\\")"}},"hostedApiKey":"none"},"arxiv_search":{"id":"arxiv_search","name":"ArXiv Search","description":"Search for academic papers on ArXiv by keywords, authors, titles, or other fields.","version":"1.0.0","params":{"searchQuery":{"type":"string","required":true,"visibility":"user-or-llm","description":"The search query to execute"},"searchField":{"type":"string","required":false,"visibility":"user-only","description":"Field to search in: all, ti (title), au (author), abs (abstract), co (comment), jr (journal), cat (category), rn (report number)"},"maxResults":{"type":"number","required":false,"visibility":"user-only","description":"Maximum number of results to return (default: 10, max: 2000)"},"sortBy":{"type":"string","required":false,"visibility":"user-only","description":"Sort by: relevance, lastUpdatedDate, submittedDate (default: relevance)"},"sortOrder":{"type":"string","required":false,"visibility":"user-only","description":"Sort order: ascending, descending (default: descending)"}},"hostedApiKey":"none"},"asana_add_comment":{"id":"asana_add_comment","name":"Asana Add Comment","description":"Add a comment (story) to an Asana task","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token for Asana"},"taskGid":{"type":"string","required":true,"visibility":"user-or-llm","description":"Asana task GID (numeric string)"},"text":{"type":"string","required":true,"visibility":"user-or-llm","description":"The text content of the comment"}},"oauth":{"required":true,"provider":"asana"},"hostedApiKey":"none"},"asana_add_followers":{"id":"asana_add_followers","name":"Asana Add Followers","description":"Add one or more followers to an Asana task","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token for Asana"},"taskGid":{"type":"string","required":true,"visibility":"user-or-llm","description":"GID of the Asana task (numeric string)"},"followers":{"type":"array","required":true,"visibility":"user-or-llm","description":"Array of user GIDs to add as followers to the task"}},"oauth":{"required":true,"provider":"asana"},"hostedApiKey":"none"},"asana_create_project":{"id":"asana_create_project","name":"Asana Create Project","description":"Create a new project in an Asana workspace","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token for Asana"},"workspace":{"type":"string","required":true,"visibility":"user-or-llm","description":"Asana workspace GID (numeric string) where the project will be created"},"name":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the project"},"notes":{"type":"string","required":false,"visibility":"user-or-llm","description":"Notes or description for the project"}},"oauth":{"required":true,"provider":"asana"},"hostedApiKey":"none"},"asana_create_section":{"id":"asana_create_section","name":"Asana Create Section","description":"Create a new section in an Asana project","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token for Asana"},"projectGid":{"type":"string","required":true,"visibility":"user-or-llm","description":"GID of the Asana project (numeric string) to add the section to"},"name":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the section"}},"oauth":{"required":true,"provider":"asana"},"hostedApiKey":"none"},"asana_create_subtask":{"id":"asana_create_subtask","name":"Asana Create Subtask","description":"Create a subtask under an existing Asana task","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token for Asana"},"taskGid":{"type":"string","required":true,"visibility":"user-or-llm","description":"GID of the parent Asana task (numeric string)"},"name":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the subtask"},"notes":{"type":"string","required":false,"visibility":"user-or-llm","description":"Notes or description for the subtask"},"assignee":{"type":"string","required":false,"visibility":"user-or-llm","description":"User GID to assign the subtask to"},"due_on":{"type":"string","required":false,"visibility":"user-or-llm","description":"Due date in YYYY-MM-DD format"}},"oauth":{"required":true,"provider":"asana"},"hostedApiKey":"none"},"asana_create_task":{"id":"asana_create_task","name":"Asana Create Task","description":"Create a new task in Asana","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token for Asana"},"workspace":{"type":"string","required":true,"visibility":"user-or-llm","description":"Asana workspace GID (numeric string) where the task will be created"},"name":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the task"},"notes":{"type":"string","required":false,"visibility":"user-or-llm","description":"Notes or description for the task"},"assignee":{"type":"string","required":false,"visibility":"user-or-llm","description":"User GID to assign the task to"},"due_on":{"type":"string","required":false,"visibility":"user-or-llm","description":"Due date in YYYY-MM-DD format"}},"oauth":{"required":true,"provider":"asana"},"hostedApiKey":"none"},"asana_delete_task":{"id":"asana_delete_task","name":"Asana Delete Task","description":"Delete an Asana task by its GID (moves it to the trash)","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token for Asana"},"taskGid":{"type":"string","required":true,"visibility":"user-or-llm","description":"GID of the Asana task to delete (numeric string)"}},"oauth":{"required":true,"provider":"asana"},"hostedApiKey":"none"},"asana_get_project":{"id":"asana_get_project","name":"Asana Get Project","description":"Retrieve a single Asana project by its GID","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token for Asana"},"projectGid":{"type":"string","required":true,"visibility":"user-or-llm","description":"Asana project GID (numeric string) to retrieve"}},"oauth":{"required":true,"provider":"asana"},"hostedApiKey":"none"},"asana_get_projects":{"id":"asana_get_projects","name":"Asana Get Projects","description":"Retrieve all projects from an Asana workspace","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token for Asana"},"workspace":{"type":"string","required":true,"visibility":"user-or-llm","description":"Asana workspace GID (numeric string) to retrieve projects from"}},"oauth":{"required":true,"provider":"asana"},"hostedApiKey":"none"},"asana_get_task":{"id":"asana_get_task","name":"Asana Get Task","description":"Retrieve a single task by GID or get multiple tasks with filters","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token for Asana"},"taskGid":{"type":"string","required":false,"visibility":"user-or-llm","description":"The globally unique identifier (GID) of the task. If not provided, will get multiple tasks."},"workspace":{"type":"string","required":false,"visibility":"user-or-llm","description":"Asana workspace GID (numeric string) to filter tasks (required when not using taskGid)"},"project":{"type":"string","required":false,"visibility":"user-or-llm","description":"Asana project GID (numeric string) to filter tasks"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of tasks to return (default: 50)"}},"oauth":{"required":true,"provider":"asana"},"hostedApiKey":"none"},"asana_list_sections":{"id":"asana_list_sections","name":"Asana List Sections","description":"List all sections in an Asana project","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token for Asana"},"projectGid":{"type":"string","required":true,"visibility":"user-or-llm","description":"GID of the Asana project (numeric string) to list sections from"}},"oauth":{"required":true,"provider":"asana"},"hostedApiKey":"none"},"asana_list_workspaces":{"id":"asana_list_workspaces","name":"Asana List Workspaces","description":"List all Asana workspaces and organizations the authenticated user belongs to","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token for Asana"}},"oauth":{"required":true,"provider":"asana"},"hostedApiKey":"none"},"asana_search_tasks":{"id":"asana_search_tasks","name":"Asana Search Tasks","description":"Search for tasks in an Asana workspace","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token for Asana"},"workspace":{"type":"string","required":true,"visibility":"user-or-llm","description":"Asana workspace GID (numeric string) to search tasks in"},"text":{"type":"string","required":false,"visibility":"user-or-llm","description":"Text to search for in task names"},"assignee":{"type":"string","required":false,"visibility":"user-or-llm","description":"Filter tasks by assignee user GID"},"projects":{"type":"array","required":false,"visibility":"user-or-llm","description":"Array of Asana project GIDs (numeric strings) to filter tasks by"},"completed":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Filter by completion status"}},"oauth":{"required":true,"provider":"asana"},"hostedApiKey":"none"},"asana_update_task":{"id":"asana_update_task","name":"Asana Update Task","description":"Update an existing task in Asana","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token for Asana"},"taskGid":{"type":"string","required":true,"visibility":"user-or-llm","description":"Asana task GID (numeric string) of the task to update"},"name":{"type":"string","required":false,"visibility":"user-or-llm","description":"Updated name for the task"},"notes":{"type":"string","required":false,"visibility":"user-or-llm","description":"Updated notes or description for the task"},"assignee":{"type":"string","required":false,"visibility":"user-or-llm","description":"Updated assignee user GID"},"completed":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Mark task as completed or not completed"},"due_on":{"type":"string","required":false,"visibility":"user-or-llm","description":"Updated due date in YYYY-MM-DD format"}},"oauth":{"required":true,"provider":"asana"},"hostedApiKey":"none"},"ashby_add_candidate_tag":{"id":"ashby_add_candidate_tag","name":"Ashby Add Candidate Tag","description":"Adds a tag to a candidate in Ashby and returns the updated candidate.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ashby API Key"},"onBehalfOfUserId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Active Ashby user UUID to attribute this mutation to; the API key must permit on-behalf-of calls"},"candidateId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The UUID of the candidate to add the tag to"},"tagId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The UUID of the tag to add"}},"hostedApiKey":"none"},"ashby_anonymize_candidate":{"id":"ashby_anonymize_candidate","name":"Ashby Anonymize Candidate","description":"Remove personally identifiable information from an Ashby candidate while retaining the candidate record and its applications. This operation does not delete the candidate. Requires the candidatesWrite permission.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ashby API Key"},"onBehalfOfUserId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Active Ashby user UUID to attribute this mutation to; the API key must permit on-behalf-of calls"},"candidateId":{"type":"string","required":true,"visibility":"user-or-llm","description":"UUID of the candidate to anonymize"}},"hostedApiKey":"none"},"ashby_change_application_source":{"id":"ashby_change_application_source","name":"Ashby Change Application Source","description":"Changes the source attributed to an existing application, so programmatically created applications report correctly on the recruiting side. Requires the candidatesWrite permission.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ashby API Key"},"onBehalfOfUserId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Active Ashby user UUID to attribute this mutation to; the API key must permit on-behalf-of calls"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"UUID of the application whose source should change"},"sourceId":{"type":"string","required":false,"visibility":"user-or-llm","description":"UUID of the source to attribute the application to, as returned by List Sources. Omit only when unsetSource is true."},"unsetSource":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Set true to deliberately clear the application source. Required to unset, so that a missing or empty sourceId cannot wipe attribution by accident."}},"hostedApiKey":"none"},"ashby_change_application_stage":{"id":"ashby_change_application_stage","name":"Ashby Change Application Stage","description":"Moves an application to a different interview stage. Requires an archive reason when moving to an Archived stage.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ashby API Key"},"onBehalfOfUserId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Active Ashby user UUID to attribute this mutation to; the API key must permit on-behalf-of calls"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The UUID of the application to update the stage of"},"interviewStageId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The UUID of the interview stage to move the application to"},"archiveReasonId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Archive reason UUID. Required when moving to an Archived stage, ignored otherwise"},"archiveEmail":{"type":"json","required":false,"visibility":"user-or-llm","description":"Archive email configuration with communicationTemplateId and optional sendAt ISO 8601 timestamp. Pass null or omit to send no archive email."}},"hostedApiKey":"none"},"ashby_create_application":{"id":"ashby_create_application","name":"Ashby Create Application","description":"Creates a new application for a candidate on a job. Optionally specify interview plan, stage, source, and credited user.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ashby API Key"},"onBehalfOfUserId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Active Ashby user UUID to attribute this mutation to; the API key must permit on-behalf-of calls"},"candidateId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The UUID of the candidate to consider for the job"},"jobId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The UUID of the job to consider the candidate for"},"interviewPlanId":{"type":"string","required":false,"visibility":"user-or-llm","description":"UUID of the interview plan to use (defaults to the job default plan)"},"interviewStageId":{"type":"string","required":false,"visibility":"user-or-llm","description":"UUID of the interview stage to place the application in, or FirstPreInterviewScreen (defaults to the first Lead stage)"},"sourceId":{"type":"string","required":false,"visibility":"user-or-llm","description":"UUID of the source to set on the application"},"creditedToUserId":{"type":"string","required":false,"visibility":"user-or-llm","description":"UUID of the user the application is credited to"},"createdAt":{"type":"string","required":false,"visibility":"user-or-llm","description":"ISO 8601 timestamp to set as the application creation date (defaults to now)"},"applicationHistory":{"type":"json","required":false,"visibility":"user-or-llm","description":"Optional documented application history entries to create with the application"}},"hostedApiKey":"none"},"ashby_create_candidate":{"id":"ashby_create_candidate","name":"Ashby Create Candidate","description":"Creates a new candidate record in Ashby.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ashby API Key"},"onBehalfOfUserId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Active Ashby user UUID to attribute this mutation to; the API key must permit on-behalf-of calls"},"name":{"type":"string","required":true,"visibility":"user-or-llm","description":"The candidate full name"},"email":{"type":"string","required":false,"visibility":"user-or-llm","description":"Primary email address for the candidate"},"phoneNumber":{"type":"string","required":false,"visibility":"user-or-llm","description":"Primary phone number for the candidate"},"linkedInUrl":{"type":"string","required":false,"visibility":"user-or-llm","description":"LinkedIn profile URL"},"githubUrl":{"type":"string","required":false,"visibility":"user-or-llm","description":"GitHub profile URL"},"website":{"type":"string","required":false,"visibility":"user-or-llm","description":"Personal website URL"},"sourceId":{"type":"string","required":false,"visibility":"user-or-llm","description":"UUID of the source to attribute the candidate to"},"creditedToUserId":{"type":"string","required":false,"visibility":"user-or-llm","description":"UUID of the Ashby user to credit with sourcing this candidate"},"createdAt":{"type":"string","required":false,"visibility":"user-or-llm","description":"Backdated creation timestamp in ISO 8601 (e.g. 2024-01-01T00:00:00Z). Defaults to now."},"alternateEmailAddresses":{"type":"json","required":false,"visibility":"user-or-llm","description":"Array of additional email address strings to add to the candidate, e.g. [\\"a@x.com\\",\\"b@y.com\\"]"},"location":{"type":"json","required":false,"visibility":"user-or-llm","description":"Candidate location object with optional city, region, and country"}},"hostedApiKey":"none"},"ashby_create_note":{"id":"ashby_create_note","name":"Ashby Create Note","description":"Creates a note on a candidate in Ashby. Supports plain text and HTML content (bold, italic, underline, links, lists, code).","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ashby API Key"},"onBehalfOfUserId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Active Ashby user UUID to attribute this mutation to; the API key must permit on-behalf-of calls"},"candidateId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The UUID of the candidate to add the note to"},"note":{"type":"string","required":true,"visibility":"user-or-llm","description":"The note content. If noteType is text/html, supports: , , , ,