Replace what callers may do through an agent
Owners, admins and the agent's own admins; never an API key. The whole set is replaced and If-Match: <revision> is required, so two edits cannot overwrite each other: the later one answers 412. A target is a workspace, a team or a Slack channel, once each; a person is not a target here (400). Tool, MCP server and credential names are not checked. A repository id this edit adds to a target must be in the catalog (400, details.reason_code repository_not_in_catalog, details.repository_ids); an id the target already holds stays, whatever the catalog says now, and counts as no allowance. An owner or admin names any live team; anyone else adds a rule only for a team they are in (403 FORBIDDEN, details.reason_code team_not_allowed), and removing a rule needs only this right. A team that is not in the workspace or is deleted is 404. Archiving a team deletes its rules and moves the revision of the agents that had one. This changes no session by itself. Writes a set_agent_caller_limits receipt with the rules before and after unless nothing changed (receipt_id null, revision kept).
Auth: cookie session only; no scope. Idempotency-Key: ignored.
cookieSession__Host-werft_session<token>For the web console: the browser session cookie set by POST /v1/auth/login. It holds the scopes of the user's workspace role (owner: all; admin and member: all but sessions:recover). Requests other than GET must also send X-Requested-With: werft-web.
id*stringThe agent's id.
^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$uuidIf-Match*stringThe revision last read, as a number (an entity tag's quotes are allowed). A different one answers 412 VERSION_MISMATCH; none answers 428 PRECONDITION_REQUIRED.
1 <= lengthX-Requested-With?"werft-web"Required with a cookie session: the literal werft-web.
"werft-web"application/json- body
rules*array<>items <= 100The rules now held, and their new revision.
application/json- response
limits*receipt_id*|nullcurl -X PUT 'https://example.com/v1/agents/497f6eca-6276-4993-bfeb-53cbbbba6f08/caller-limits' \ -H 'If-Match: string' \ -H 'Content-Type: application/json' \ -d '{ "rules": [ { "target": { "kind": "team", "id": "019a0000-0000-7000-8000-00000000b0a1" }, "tools_deny": [ "shell" ], "repositories": [ "platform" ], "mcp_servers": null, "credentials_deny": [] } ]}'{ "limits": { "rules": [ { "target": { "kind": "team", "id": "019a0000-0000-7000-8000-00000000b0a1" }, "tools_deny": [ "shell" ], "repositories": [ "platform" ], "mcp_servers": null, "credentials_deny": [] } ], "revision": 3 }, "receipt_id": "c4a1e9d2-7b3f-4e8a-a6c5-1d2e3f4a5b6c"}