What callers may do through an agent
One rule per caller target: the whole workspace, a team or a Slack channel. A rule's tools_deny and credentials_deny name what the caller may not use; repositories and mcp_servers name all the caller may use, null meaning no limit and [] none. Owners, admins and the agent's own admins read it, as they edit it; never an API key. revision is the If-Match of the next edit; it moves with every change, and with the archive of a team the agent has a rule for. Reading it changes no session: these are stored rules, not a decision.
Auth: cookie session only; no scope.
cookieSession__Host-werft_session<token>For the web console: the browser session cookie set by POST /v1/auth/login. It holds the scopes of the user's workspace role (owner: all; admin and member: all but sessions:recover). Requests other than GET must also send X-Requested-With: werft-web.
id*stringThe agent's id.
^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$uuidThe agent's caller limit rules.
application/json- response
rules*array<>revision*integer0 < value <= 9007199254740991curl -X GET 'https://example.com/v1/agents/497f6eca-6276-4993-bfeb-53cbbbba6f08/caller-limits'{ "rules": [ { "target": { "kind": "team", "id": "019a0000-0000-7000-8000-00000000b0a1" }, "tools_deny": [ "shell" ], "repositories": [ "platform" ], "mcp_servers": null, "credentials_deny": [] } ], "revision": 2}