What a new installation ceiling may name
The operator (profile.installation.manage, the workspace owner), signed in. The installation's connections by id, kind and billing (never an endpoint or a credential reference), the installed runtimes with the permission modes each accepts, the catalog repositories, the built-in tool catalogs a deny names (one entry per runtime version spelling, SDK and engine build), and whether PLATFORM_ALLOW_UNATTENDED_PERMISSIONS lets a ceiling run bypassPermissions here.
Auth: cookie session only; no scope.
cookieSession__Host-werft_session<token>For the web console: the browser session cookie set by POST /v1/auth/login. It holds the scopes of the user's workspace role (owner: all; admin and member: all but sessions:recover). Requests other than GET must also send X-Requested-With: werft-web.
What a new ceiling may name on this installation.
application/json- response
connections*array<>runtimes*array<>repositories?array<>tool_catalogs?array<>The built-in tools this installation supports, per runtime version: what a profile's deny may name. A version not listed takes only tools.
unattended_allowed*booleancurl -X GET 'https://example.com/v1/installation-profiles/options'{ "connections": [ { "id": "anthropic-main", "kind": "anthropic", "billing": "metered" } ], "runtimes": [ { "runtime_kind": "claude_agent_sdk", "permission_modes": [ "default", "acceptEdits", "dontAsk", "plan", "bypassPermissions", "auto" ] } ], "repositories": [ { "id": "sample-app" } ], "tool_catalogs": [ { "id": "claude_agent_sdk@0.3.319+claude-code@2.1.319", "runtime_kind": "claude_agent_sdk", "runtime_version": "0.3.319", "tools": [ { "name": "Read", "boundary": "local" }, { "name": "Bash", "boundary": "local" }, { "name": "WebFetch", "boundary": "egress" }, { "name": "WebSearch", "boundary": "provider" } ] } ], "unattended_allowed": false}