# Workspace API

Source: https://langbot.app/docs/en/plugin/dev/apis/workspace

Read and manage Agents, Pipelines, bots, models, knowledge bases and more from a plugin.

The Workspace API lets a plugin work with the Workspace it is installed in: list and edit Agents and Pipelines, look up bots, manage models and knowledge bases, read monitoring data, and so on. It exposes the same operations as LangBot's HTTP API, MCP server and Workspace assistant, so a plugin can automate anything a member could do through those interfaces, within the limits the member grants.

Every operation has a stable ID, such as `pipeline.list` or `knowledge.base.retrieve`. A plugin can only call operations it [declares in its manifest](https://langbot.app/docs/en/plugin/dev/permissions.md#declare-permissions) and a member has granted to its installation.

## Calling an operation

From any component, use `self.plugin.workspace`. Each operation has a typed method named after its ID:

```python
from langbot_plugin.api.definition.components.tool.tool import Tool


class WorkspaceSummary(Tool):
    async def call(self, params, session, query_id):
        result = await self.plugin.workspace.pipeline.list()
        if not result["ok"]:
            return f"Could not list pipelines: {result['error']['message']}"

        names = [pipeline["name"] for pipeline in result["result"]]
        return "Pipelines: " + ", ".join(names)
```

Methods take keyword arguments that match the operation's input schema, and editors show their types and documentation. A few names are adjusted to be valid Python: a segment that is a Python keyword gets a trailing underscore (for example `import_`), and other invalid characters become underscores. The arguments are still sent under their original names.

If you prefer to choose the operation at runtime, call it by ID. Both forms behave identically:

```python
result = await self.plugin.workspace.call("knowledge.base.retrieve", kb_uuid=kb_uuid, query="refund policy")
```

`await self.plugin.workspace.list()` returns the operations granted to the installation, with their input schemas, grouped into `domains`. It is useful for building a dynamic tool list or checking a grant before offering a feature.

### Inside a Runner

A Runner receives a run-bound proxy as `ctx.api.workspace`. It offers the same methods and is authorized by the same installation grants; the difference is that LangBot records each call against the current run.

The Agent or Pipeline that started the run may restrict which workspace operations the model should see. That selection is delivered in `ctx.resources.workspace_operations`. A Runner that exposes workspace operations to a model as tools should offer only those, and offer none when the list is empty. LangBot's built-in LocalAgent does exactly this.

## Results and errors

Workspace calls never raise for business errors. They always return a dictionary:

```python
# Success
{"ok": True, "result": ..., "operation": {"id": "pipeline.list", ...}}

# Failure
{"ok": False, "error": {"code": "permission_denied", "message": "...", "details": {...}}}
```

Check `ok` before reading `result`. Common error codes:

| Code                | Meaning                                                                                                                                |
| ------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
| `permission_denied` | The operation is not granted to this installation, or the installation is disabled. `details.denied_operations` lists the missing IDs. |
| `invalid_input`     | The arguments do not match the operation's input schema.                                                                               |
| `not_found`         | The referenced resource does not exist in this Workspace.                                                                              |
| `application_error` | The operation ran and failed; `message` explains why.                                                                                  |

A denied operation is an expected outcome, because members may grant only part of what a plugin declares. Handle it by explaining what is missing rather than failing the whole command or run.

## Choosing operations to declare

Operations carry a risk level that the member sees when confirming:

- **Read** operations only return data, such as `pipeline.list` or `stats.basic`.
- **Write** operations change Workspace configuration, such as `pipeline.update` or `knowledge.file.store`.
- **High-risk** operations delete resources, reach outside LangBot, or consume significant resources, such as `bot.delete` or `pipeline.chat.broadcast`. The confirmation dialog highlights them.

The member who grants an operation must hold its permission themselves (the last column below). Ask only for what your plugin needs; a request for many high-risk operations is likely to be declined or trimmed.

Wildcards such as `knowledge.*` request every operation under a prefix. Not every prefix can be used this way; see [Wildcards](https://langbot.app/docs/en/plugin/dev/permissions.md#wildcards).

## Operation reference

This reference covers every operation a plugin can request in the current LangBot version, grouped by domain. Methods are shown on `workspace`, which is `self.plugin.workspace` in components and `ctx.api.workspace` in a Runner. The SDK's typed methods are generated from this catalog, so every operation listed here is available as a method.

### Adapter (`adapter`)

| Operation                                                             | ID and method                             | Risk | Granting member needs |
| --------------------------------------------------------------------- | ----------------------------------------- | ---- | --------------------- |
| Get Adapter Get configuration schema and requirements for an adapter. | `adapter.get` `workspace.adapter.get()`   | Read | `resource.view`       |
| List Adapters List available chat platform adapters in the workspace. | `adapter.list` `workspace.adapter.list()` | Read | `resource.view`       |

### Agent (`agent`)

| Operation                                                                  | ID and method                                       | Risk      | Granting member needs |
| -------------------------------------------------------------------------- | --------------------------------------------------- | --------- | --------------------- |
| Create Agent Create a new autonomous AI agent in the workspace.            | `agent.create` `workspace.agent.create()`           | Write     | `resource.manage`     |
| Debug Agent Execute a test turn on an agent for debugging purposes.        | `agent.debug` `workspace.agent.debug()`             | Write     | `runtime.operate`     |
| Delete Agent Delete an autonomous AI agent from the workspace.             | `agent.delete` `workspace.agent.delete()`           | High risk | `resource.manage`     |
| Get Agent Get full configuration and parameters for an AI agent.           | `agent.get` `workspace.agent.get()`                 | Read      | `resource.view`       |
| List Agents List all autonomous AI agents configured in the workspace.     | `agent.list` `workspace.agent.list()`               | Read      | `resource.view`       |
| Agent Metadata Get supported agent capabilities, model types, and schemas. | `agent.metadata` `workspace.agent.metadata()`       | Read      | `resource.view`       |
| Get Run Events Fetch step-by-step trace events for an agent execution run. | `agent.runs.events` `workspace.agent.runs.events()` | Read      | `resource.view`       |
| List Agent Runs List historical execution runs for an agent or processor.  | `agent.runs.list` `workspace.agent.runs.list()`     | Read      | `resource.view`       |
| Update Agent Update configuration, model, or prompts of an agent.          | `agent.update` `workspace.agent.update()`           | Write     | `resource.manage`     |

### Bot (`bot`)

| Operation                                                                      | ID and method                                                     | Risk      | Granting member needs |
| ------------------------------------------------------------------------------ | ----------------------------------------------------------------- | --------- | --------------------- |
| List Bot Admins List platform users configured as administrators for a bot.    | `bot.admins.list` `workspace.bot.admins.list()`                   | Read      | `resource.view`       |
| Create Bot Create a new chat bot connected to an IM adapter.                   | `bot.create` `workspace.bot.create()`                             | Write     | `resource.manage`     |
| Delete Bot Delete a chat bot and remove its adapter connection.                | `bot.delete` `workspace.bot.delete()`                             | High risk | `resource.manage`     |
| Get Bot Get detailed configuration and status for a specific bot.              | `bot.get` `workspace.bot.get()`                                   | Read      | `resource.view`       |
| Apply Group Filter Apply group filtering rules to enable or disable pipelines. | `bot.group_filter.apply` `workspace.bot.group_filter.apply()`     | Write     | `resource.manage`     |
| Preview Group Filter Preview chat group filtering rules for a bot.             | `bot.group_filter.preview` `workspace.bot.group_filter.preview()` | Read      | `resource.manage`     |
| List Bots List all configured chat bots in the workspace.                      | `bot.list` `workspace.bot.list()`                                 | Read      | `resource.view`       |
| Bot Logs Fetch runtime connection logs and events for a bot.                   | `bot.logs` `workspace.bot.logs()`                                 | Read      | `resource.view`       |
| Send Bot Message Send an outbound message to a chat user or group via a bot.   | `bot.message.send` `workspace.bot.message.send()`                 | High risk | `runtime.operate`     |
| Test Bot Message Test bot messaging capability by sending a test message.      | `bot.message.test` `workspace.bot.message.test()`                 | Write     | `resource.manage`     |
| Preview Routes Preview message routing decisions for a simulated event.        | `bot.routes.preview` `workspace.bot.routes.preview()`             | Read      | `resource.manage`     |
| Routing Status Get active message routing bindings and rules for a bot.        | `bot.routes.status` `workspace.bot.routes.status()`               | Read      | `resource.view`       |
| Bot Runtime Status Inspect live connection state and health of a bot.          | `bot.runtime.get` `workspace.bot.runtime.get()`                   | Read      | `resource.view`       |
| Update Bot Update settings or pipeline bindings for an existing bot.           | `bot.update` `workspace.bot.update()`                             | Write     | `resource.manage`     |

### Extension (`extension`)

| Operation                                                                         | ID and method                                 | Risk | Granting member needs |
| --------------------------------------------------------------------------------- | --------------------------------------------- | ---- | --------------------- |
| List All Extensions List all available plugins, MCP servers, and skills combined. | `extension.list` `workspace.extension.list()` | Read | `resource.view`       |

### Knowledge Base (`knowledge`)

| Operation                                                                               | ID and method                                                                       | Risk      | Granting member needs |
| --------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- | --------- | --------------------- |
| Create Knowledge Base Create a new knowledge base with storage and vector engine.       | `knowledge.base.create` `workspace.knowledge.base.create()`                         | Write     | `resource.manage`     |
| Delete Knowledge Base Permanently delete a knowledge base and indexed documents.        | `knowledge.base.delete` `workspace.knowledge.base.delete()`                         | High risk | `resource.manage`     |
| Get Knowledge Base Get configuration and indexing status of a knowledge base.           | `knowledge.base.get` `workspace.knowledge.base.get()`                               | Read      | `resource.view`       |
| List Knowledge Bases List all knowledge bases configured in the workspace.              | `knowledge.base.list` `workspace.knowledge.base.list()`                             | Read      | `resource.view`       |
| Retrieve Knowledge Chunks Search and retrieve relevant text chunks from knowledge base. | `knowledge.base.retrieve` `workspace.knowledge.base.retrieve()`                     | Read      | `resource.view`       |
| Update Knowledge Base Update configuration or description of a knowledge base.          | `knowledge.base.update` `workspace.knowledge.base.update()`                         | Write     | `resource.manage`     |
| Engine Creation Schema Get configuration schema required to create an engine.           | `knowledge.engine.creation_schema` `workspace.knowledge.engine.creation_schema()`   | Read      | `resource.view`       |
| List Knowledge Engines List available storage and vector retrieval engine types.        | `knowledge.engine.list` `workspace.knowledge.engine.list()`                         | Read      | `resource.view`       |
| Engine Retrieval Schema Get parameter schema for retrieving from an engine.             | `knowledge.engine.retrieval_schema` `workspace.knowledge.engine.retrieval_schema()` | Read      | `resource.view`       |
| Delete Knowledge File Delete an indexed document from a knowledge base.                 | `knowledge.file.delete` `workspace.knowledge.file.delete()`                         | High risk | `resource.manage`     |
| List Knowledge Files List all documents indexed within a knowledge base.                | `knowledge.file.list` `workspace.knowledge.file.list()`                             | Read      | `resource.view`       |
| Store Knowledge File Index and store a document into a knowledge base.                  | `knowledge.file.store` `workspace.knowledge.file.store()`                           | Write     | `resource.manage`     |
| List Document Parsers List supported document parser formats and capabilities.          | `knowledge.parser.list` `workspace.knowledge.parser.list()`                         | Read      | `resource.view`       |

### MCP (`mcp`)

| Operation                                                                               | ID and method                                                 | Risk      | Granting member needs |
| --------------------------------------------------------------------------------------- | ------------------------------------------------------------- | --------- | --------------------- |
| List MCP Resources List all resources exposed by connected MCP servers.                 | `mcp.resource.list` `workspace.mcp.resource.list()`           | Read      | `resource.view`       |
| Read MCP Resource Read contents of a specific resource from an MCP server.              | `mcp.resource.read` `workspace.mcp.resource.read()`           | Read      | `resource.view`       |
| List MCP Resource Templates List parameterized resource URI templates from MCP servers. | `mcp.resource.templates` `workspace.mcp.resource.templates()` | Read      | `resource.view`       |
| Delete MCP Server Disconnect and delete an MCP server from the workspace.               | `mcp.server.delete` `workspace.mcp.server.delete()`           | High risk | `resource.manage`     |
| Get MCP Server Get configuration and parameters of a specific MCP server.               | `mcp.server.get` `workspace.mcp.server.get()`                 | Read      | `resource.view`       |
| List MCP Servers List configured Model Context Protocol (MCP) servers.                  | `mcp.server.list` `workspace.mcp.server.list()`               | Read      | `resource.view`       |
| MCP Server Logs Retrieve communication and error logs for an MCP server.                | `mcp.server.logs` `workspace.mcp.server.logs()`               | Read      | `audit.view`          |
| MCP Server Runtime Inspect live health and session state of an MCP server.              | `mcp.server.runtime` `workspace.mcp.server.runtime()`         | Read      | `resource.view`       |
| Test MCP Server Connection Test connectivity and ping an MCP server configuration.      | `mcp.server.test` `workspace.mcp.server.test()`               | Write     | `resource.manage`     |

### Model (`model`)

| Operation                                                                               | ID and method                                                                     | Risk      | Granting member needs    |
| --------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------- | --------- | ------------------------ |
| Create Embedding Model Configure and add a new embedding model to the workspace.        | `model.embedding.create` `workspace.model.embedding.create()`                     | Write     | `provider_secret.manage` |
| Delete Embedding Model Delete an embedding model configuration from the workspace.      | `model.embedding.delete` `workspace.model.embedding.delete()`                     | High risk | `resource.manage`        |
| Get Embedding Model Get configuration and parameters of an embedding model.             | `model.embedding.get` `workspace.model.embedding.get()`                           | Read      | `resource.view`          |
| List Embedding Models List all text embedding models configured in the workspace.       | `model.embedding.list` `workspace.model.embedding.list()`                         | Read      | `resource.view`          |
| List Embeddings by Provider List embedding models configured under a specific provider. | `model.embedding.list_by_provider` `workspace.model.embedding.list_by_provider()` | Read      | `resource.view`          |
| Test Embedding Model Test vector generation and connectivity for embedding model.       | `model.embedding.test` `workspace.model.embedding.test()`                         | Write     | `provider_secret.manage` |
| Update Embedding Model Update configuration and parameters of an embedding model.       | `model.embedding.update` `workspace.model.embedding.update()`                     | Write     | `provider_secret.manage` |
| Create LLM Model Configure and add a new LLM model to the workspace.                    | `model.llm.create` `workspace.model.llm.create()`                                 | Write     | `provider_secret.manage` |
| Get Default LLM Model Get workspace default large language model configuration.         | `model.llm.default.get` `workspace.model.llm.default.get()`                       | Read      | `resource.manage`        |
| Delete LLM Model Delete an LLM model configuration from the workspace.                  | `model.llm.delete` `workspace.model.llm.delete()`                                 | High risk | `resource.manage`        |
| Get LLM Model Get configuration and parameters of a specific LLM model.                 | `model.llm.get` `workspace.model.llm.get()`                                       | Read      | `resource.view`          |
| List LLM Models List all configured large language models in the workspace.             | `model.llm.list` `workspace.model.llm.list()`                                     | Read      | `resource.view`          |
| List LLMs by Provider List LLM models configured under a specific model provider.       | `model.llm.list_by_provider` `workspace.model.llm.list_by_provider()`             | Read      | `resource.view`          |
| Get Starred LLM Model Get the starred favorite LLM model of the workspace.              | `model.llm.starred.get` `workspace.model.llm.starred.get()`                       | Read      | `resource.view`          |
| Set Starred LLM Model Designate a specific LLM model as the starred favorite.           | `model.llm.starred.set` `workspace.model.llm.starred.set()`                       | Write     | `provider_secret.manage` |
| Test LLM Model Test connectivity and response generation for an LLM model.              | `model.llm.test` `workspace.model.llm.test()`                                     | Write     | `provider_secret.manage` |
| Update LLM Model Update configuration and parameters of an LLM model.                   | `model.llm.update` `workspace.model.llm.update()`                                 | Write     | `provider_secret.manage` |
| Create Rerank Model Configure and add a new rerank model to the workspace.              | `model.rerank.create` `workspace.model.rerank.create()`                           | Write     | `provider_secret.manage` |
| Delete Rerank Model Delete a rerank model configuration from the workspace.             | `model.rerank.delete` `workspace.model.rerank.delete()`                           | High risk | `resource.manage`        |
| Get Rerank Model Get configuration and parameters of a rerank model.                    | `model.rerank.get` `workspace.model.rerank.get()`                                 | Read      | `resource.view`          |
| List Rerank Models List all document reranking models in the workspace.                 | `model.rerank.list` `workspace.model.rerank.list()`                               | Read      | `resource.view`          |
| List Reranks by Provider List rerank models configured under a specific provider.       | `model.rerank.list_by_provider` `workspace.model.rerank.list_by_provider()`       | Read      | `resource.view`          |
| Test Rerank Model Test connectivity and scoring capability of a rerank model.           | `model.rerank.test` `workspace.model.rerank.test()`                               | Write     | `provider_secret.manage` |
| Update Rerank Model Update configuration and parameters of a rerank model.              | `model.rerank.update` `workspace.model.rerank.update()`                           | Write     | `provider_secret.manage` |

### Monitoring (`monitoring`)

| Operation                                                                                 | ID and method                                                           | Risk      | Granting member needs |
| ----------------------------------------------------------------------------------------- | ----------------------------------------------------------------------- | --------- | --------------------- |
| Embedding Call Metrics Query embedding generation metrics and latency statistics.         | `monitoring.embedding_calls` `workspace.monitoring.embedding_calls()`   | Read      | `resource.view`       |
| Error Logs Query runtime errors and failures across bots and pipelines.                   | `monitoring.errors` `workspace.monitoring.errors()`                     | Read      | `resource.view`       |
| Execution Details Get detailed traces and step execution events for a specific execution. | `monitoring.execution.detail` `workspace.monitoring.execution.detail()` | Read      | `resource.view`       |
| List Executions Query execution history records across bots, pipelines, and agents.       | `monitoring.executions` `workspace.monitoring.executions()`             | Read      | `resource.view`       |
| List User Feedback List user ratings and feedback records on bot responses.               | `monitoring.feedback.list` `workspace.monitoring.feedback.list()`       | Read      | `resource.view`       |
| Feedback Statistics Get aggregated positive and negative user feedback metrics.           | `monitoring.feedback.stats` `workspace.monitoring.feedback.stats()`     | Read      | `resource.view`       |
| In-Flight Executions Inspect currently active in-flight requests and pipeline runs.       | `monitoring.inflight` `workspace.monitoring.inflight()`                 | Read      | `resource.view`       |
| LLM Call Metrics Query model invocation counts, latencies, and token stats.               | `monitoring.llm_calls` `workspace.monitoring.llm_calls()`               | Read      | `resource.view`       |
| Message Details Retrieve full metadata and trace details for a single message.            | `monitoring.message.detail` `workspace.monitoring.message.detail()`     | Read      | `resource.view`       |
| Query Messages Query processed chat messages across bot sessions.                         | `monitoring.messages` `workspace.monitoring.messages()`                 | Read      | `resource.view`       |
| Monitoring Overview Get aggregated monitoring overview statistics for bots and pipelines. | `monitoring.overview` `workspace.monitoring.overview()`                 | Read      | `resource.view`       |
| Session Analysis Analyze session metrics, duration, and token usage for a session.        | `monitoring.session.analysis` `workspace.monitoring.session.analysis()` | Read      | `resource.view`       |
| Reset Session Reset a chat session and clear its context window.                          | `monitoring.session.reset` `workspace.monitoring.session.reset()`       | High risk | `resource.manage`     |
| List Sessions List active and historical chat sessions across bots.                       | `monitoring.sessions` `workspace.monitoring.sessions()`                 | Read      | `resource.view`       |
| Token Usage Statistics Query token consumption metrics aggregated by time buckets.        | `monitoring.tokens` `workspace.monitoring.tokens()`                     | Read      | `resource.view`       |
| Tool Call Metrics Query tool invocation history and execution performance.                | `monitoring.tool_calls` `workspace.monitoring.tool_calls()`             | Read      | `resource.view`       |

### Pipeline (`pipeline`)

| Operation                                                                              | ID and method                                                         | Risk      | Granting member needs |
| -------------------------------------------------------------------------------------- | --------------------------------------------------------------------- | --------- | --------------------- |
| Broadcast Chat Message Broadcast a message to all active pipeline chat clients.        | `pipeline.chat.broadcast` `workspace.pipeline.chat.broadcast()`       | High risk | `runtime.operate`     |
| Pipeline Connections Inspect live websocket connection status for pipeline chat.       | `pipeline.chat.connections` `workspace.pipeline.chat.connections()`   | Read      | `runtime.operate`     |
| Pipeline Chat History Retrieve debug chat message history for a pipeline session.      | `pipeline.chat.history` `workspace.pipeline.chat.history()`           | Read      | `runtime.operate`     |
| Reset Chat Session Clear memory and chat history for a pipeline debug session.         | `pipeline.chat.reset` `workspace.pipeline.chat.reset()`               | High risk | `runtime.operate`     |
| Copy Pipeline Duplicate an existing pipeline to create a new copy.                     | `pipeline.copy` `workspace.pipeline.copy()`                           | Write     | `resource.manage`     |
| Create Pipeline Create a new processing pipeline in the workspace.                     | `pipeline.create` `workspace.pipeline.create()`                       | Write     | `resource.manage`     |
| Pipeline Defaults Get template defaults and initial values for new pipelines.          | `pipeline.defaults` `workspace.pipeline.defaults()`                   | Read      | `resource.view`       |
| Delete Pipeline Permanently delete a pipeline from the workspace.                      | `pipeline.delete` `workspace.pipeline.delete()`                       | High risk | `resource.manage`     |
| Get Pipeline Extensions Get bound plugins, MCP servers, and tools for a pipeline.      | `pipeline.extensions.get` `workspace.pipeline.extensions.get()`       | Read      | `resource.view`       |
| Update Pipeline Extensions Update bound plugins, MCP servers, and tools on a pipeline. | `pipeline.extensions.update` `workspace.pipeline.extensions.update()` | Write     | `resource.manage`     |
| Get Pipeline Get complete definition and node graph of a pipeline.                     | `pipeline.get` `workspace.pipeline.get()`                             | Read      | `resource.view`       |
| List Pipelines List all message processing pipelines in the workspace.                 | `pipeline.list` `workspace.pipeline.list()`                           | Read      | `resource.view`       |
| Pipeline Metadata Get available component types and node specifications.               | `pipeline.metadata` `workspace.pipeline.metadata()`                   | Read      | `resource.view`       |
| Run Pipeline Execute a pipeline run with custom input data.                            | `pipeline.run` `workspace.pipeline.run()`                             | Write     | `runtime.operate`     |
| Update Pipeline Update topology, nodes, or settings of a pipeline.                     | `pipeline.update` `workspace.pipeline.update()`                       | Write     | `resource.manage`     |

### Plugin (`plugin`)

| Operation                                                                     | ID and method                                                 | Risk | Granting member needs |
| ----------------------------------------------------------------------------- | ------------------------------------------------------------- | ---- | --------------------- |
| Get Plugin Config Get configured parameters and settings for a plugin.        | `plugin.config.get` `workspace.plugin.config.get()`           | Read | `resource.view`       |
| Plugin Debug Info Inspect internal plugin runtime process state and memory.   | `plugin.debug_info` `workspace.plugin.debug_info()`           | Read | `resource.manage`     |
| Get Plugin Get detailed metadata and manifest for an installed plugin.        | `plugin.get` `workspace.plugin.get()`                         | Read | `resource.view`       |
| Plugin GitHub Assets List downloadable asset files for a GitHub release.      | `plugin.github.assets` `workspace.plugin.github.assets()`     | Read | `resource.view`       |
| Plugin GitHub Releases List releases of a plugin repository hosted on GitHub. | `plugin.github.releases` `workspace.plugin.github.releases()` | Read | `resource.view`       |
| List Plugins List all installed plugins and their running status.             | `plugin.list` `workspace.plugin.list()`                       | Read | `resource.view`       |
| Plugin Logs Fetch runtime logs and error messages from a plugin.              | `plugin.logs` `workspace.plugin.logs()`                       | Read | `audit.view`          |
| Plugin Readme Get documentation and usage instructions for a plugin.          | `plugin.readme` `workspace.plugin.readme()`                   | Read | `resource.view`       |

### Model Provider (`provider`)

| Operation                                                                      | ID and method                                               | Risk      | Granting member needs    |
| ------------------------------------------------------------------------------ | ----------------------------------------------------------- | --------- | ------------------------ |
| Create Provider Add a new model provider and credentials to the workspace.     | `provider.create` `workspace.provider.create()`             | Write     | `provider_secret.manage` |
| Delete Provider Delete a model provider and its associated models.             | `provider.delete` `workspace.provider.delete()`             | High risk | `resource.manage`        |
| Get Provider Get configuration and credentials of a model provider.            | `provider.get` `workspace.provider.get()`                   | Read      | `resource.view`          |
| List Providers List all configured model providers in the workspace.           | `provider.list` `workspace.provider.list()`                 | Read      | `resource.view`          |
| Provider Models Count Count models configured under a specific model provider. | `provider.models.count` `workspace.provider.models.count()` | Read      | `resource.view`          |
| Scan Provider Models Scan remote provider endpoint for available models.       | `provider.models.scan` `workspace.provider.models.scan()`   | Write     | `provider_secret.manage` |
| Update Provider Update credentials or base URL of a model provider.            | `provider.update` `workspace.provider.update()`             | Write     | `provider_secret.manage` |

### Requester (`requester`)

| Operation                                                               | ID and method                                 | Risk | Granting member needs |
| ----------------------------------------------------------------------- | --------------------------------------------- | ---- | --------------------- |
| Get Requester Get configuration and capabilities of an HTTP requester.  | `requester.get` `workspace.requester.get()`   | Read | `resource.view`       |
| List Requesters List HTTP request client adapters used for model calls. | `requester.list` `workspace.requester.list()` | Read | `resource.view`       |

### Skill (`skill`)

| Operation                                                               | ID and method                                             | Risk      | Granting member needs |
| ----------------------------------------------------------------------- | --------------------------------------------------------- | --------- | --------------------- |
| Create Skill Create and register a new custom skill package.            | `skill.create` `workspace.skill.create()`                 | Write     | `resource.manage`     |
| Delete Skill Delete a custom skill and remove its code files.           | `skill.delete` `workspace.skill.delete()`                 | High risk | `resource.manage`     |
| List Skill Files List files and directories within a skill package.     | `skill.file.list` `workspace.skill.file.list()`           | Read      | `resource.view`       |
| Read Skill File Read the source code or content of a file in a skill.   | `skill.file.read` `workspace.skill.file.read()`           | Read      | `resource.view`       |
| Write Skill File Write or update a code file inside a skill package.    | `skill.file.write` `workspace.skill.file.write()`         | Write     | `resource.manage`     |
| Get Skill Get full manifest and metadata for a specific skill.          | `skill.get` `workspace.skill.get()`                       | Read      | `resource.view`       |
| Preview GitHub Skill Preview a skill package from a GitHub repository.  | `skill.github.preview` `workspace.skill.github.preview()` | Read      | `resource.manage`     |
| List Skills List all custom skills installed in the workspace.          | `skill.list` `workspace.skill.list()`                     | Read      | `resource.view`       |
| Reload Skills Reload all skill packages and refresh runtime registries. | `skill.reload` `workspace.skill.reload()`                 | Write     | `resource.manage`     |
| Update Skill Update metadata or configuration of an existing skill.     | `skill.update` `workspace.skill.update()`                 | Write     | `resource.manage`     |

### Statistics (`stats`)

| Operation                                                                         | ID and method                           | Risk | Granting member needs |
| --------------------------------------------------------------------------------- | --------------------------------------- | ---- | --------------------- |
| Basic Statistics Get workspace overview counters for bots, models, and pipelines. | `stats.basic` `workspace.stats.basic()` | Read | `resource.view`       |

### Tool (`tool`)

| Operation                                                              | ID and method                       | Risk | Granting member needs |
| ---------------------------------------------------------------------- | ----------------------------------- | ---- | --------------------- |
| Get Tool Get parameter schema and description for a specific tool.     | `tool.get` `workspace.tool.get()`   | Read | `resource.view`       |
| List Tools List all registered function tools available for execution. | `tool.list` `workspace.tool.list()` | Read | `resource.view`       |