Capability catalog

Idempotently ensure a product exists for an externalId.

Ensure customer/products then create a hosted checkout (optional await).

Create embedded PIX transparent charge and await payment.

Clone an existing agent configuration

Create a new agent configuration

Soft-delete an agent configuration

Permanently deletes an AI provider configuration. Refuses to delete an enabled config — disable it first (the DB guarantees the org default is always enabled, so the default is transitively protected). Built for cleaning up configs orphaned by connection soft-delete.

Disables an AI provider configuration (sets enabled=False). Refuses to disable the last enabled default — caller must promote another config first. Idempotent: already-disabled configs complete with disabled=False and no DB mutation.

Enables an AI provider configuration (sets enabled=True). Refuses to enable a config whose cloud connection is missing or soft-deleted (orphaned config). Idempotent: already-enabled configs complete with enabled=False and no DB mutation. Counterpart of ai-provider.disable.

Send a chat completion via the org's AI CloudConnection (provider-agnostic)

OpenAI-compatible chat completion (any provider), with optional provider web search and citations

Back up the app's own Postgres instance to encrypted blob storage (customer tier, billed as storage)

List an app's encrypted backups: tier, status, stored size, checksum, expiry

Read an app's customer backup policy and when it next and last ran

Ensure Nostr Buzz (WebSocket relay + Redis + MinIO) on a claimed AppHost site: Redis, MinIO, and relay are created if missing and updated on re-apply. Re-apply keeps the live RELAY_URL host: that hostname is the Buzz community, and changing it would seed an empty one. Destroy is apphost.addon.remove, not apply. This is not native Chat Relay, not Orkestia AppData conversations, and not DPWAI Chat Relay REST/SSE. Postgres is the site's AppData instance (not Neon, not in-cluster). Forces the Machine always-on. Does not steal the CloudFront site host.

Read the last lines of the Buzz relay pod on a claimed AppHost site. One-shot tail, not a stream.

Supported upload/download path for Buzz attachments on a claimed site: durable MinIO PVC, Buzz /media with NIP-42, not shared document workflows. No kubeconfig. No secrets.

Create an approval request, notify approvers, collect decision events, and expire the request when timeout elapses.

Create a draft hosted MCP service owned by the calling organization.

Validate a hosted service's draft and publish it as an immutable revision.

Resume a suspended service on the revision it was serving.

Archive an audit scan run using the soft-delete lifecycle.

Soft-delete an audit scan run.

Get one audit scan run for an organization.

Call AWS ACM AddTagsToCertificate using a CloudConnection UUID.

Call AWS ACM DeleteCertificate using a CloudConnection UUID.

Call AWS ACM DescribeCertificate using a CloudConnection UUID.

Delete an ACR cache rule.

Read an ACR cache rule.

Create or update an ACR cache rule (pull-through mirror of an upstream repository).

Cancel an authorized NFS-e at Bling and reflect the cancellation on the commerce_entity row. Requires a justification.

Direct creation of a Bling lançamento. Caller supplies the Bling-side linked_receivable_external_ref or linked_payable_external_ref + amount; this workflow POSTs to /contas/{kind}/{id}/lancamentos and persists the result into commerce_entity.

Create a new accounts-payable row at Bling (POST /contas/pagar). Persists the result into commerce_entity (entity_type='payable').

Validate a Bunny CDN API key

Put a Staff actor into an app chat. The actor must already hold a paid end-user seat in the app (identity.end-user.bind-actor). It gets a server-held relay key, joins the listed channels as bot, and answers mentions, DMs, or every message in its channels. Its stored definition must act as the space's app (on_invoke.input_data.act_as_identity_app_uuid), unless the attachment replies as the organization (reply_principal organization: org admins only, allowlisted orgs and authors)

Open (or reuse) a direct-message channel between an attached actor and 1-8 members of the space, signed by the actor's key. Returns the DM channel id to post into. Same callers as buzz.message.post

Send a chat message as yourself, the attached Staff actor, from outside the chat (a schedule, an event, another workflow). target is '#channel', a channel name, a person's display name ('@name') or a member id: a person gets a direct message (opened if needed), a channel gets a post. Optional mention names one member. Ambiguous or unknown names fail listing candidates. Humans and the system pass as_actor_uuid

Create a new chat conversation owned by a member or an app end-user

Append a user turn to a chat conversation and return the assistant reply

Look up previously-resolved Lumen error groups similar to a query error message so the agent can reuse prior root_cause/solution knowledge instead of re-investigating from scratch.

Summarise a catalog's last N days: orders by status, revenue and average ticket from paid orders, items sold, a per-day series and the top products.

Add quantity of a product to the shopper's open cart, creating the cart if needed. Same product + same options merges into one line.

Read a shopper's open cart with lines and totals. Never creates one.

Validate a Cloudflare API token

Purge Cloudflare CDN cache for specific URLs or entire zone

Delete a Cloudflare DNS record by record ID

Collect Kubernetes kubeconfig from an AWS VM through SSM Run Command.

Collect the admin kubeconfig produced by a Azure VM Kubernetes bootstrap process.

Ensure standard namespace, service account, RBAC binding, and optional manifests for Orkestia access.

Re-validate a composition against the live registry and set it active

Archive a composition (no longer startable)

Soft-delete archived compositions for an organization

Refresh John Deere Operations Center organizations for a connection via GET /organizations using the stored OAuth access token

Disconnects a cloud provider connection: scrubs its secrets and soft-deletes the CloudConnection record

Get a single cloud connection by UUID

Drop duplicate elements (optionally by a field), preserving order

Keep the list elements matching one comparison predicate

Flatten nested lists up to a given depth (-1 = fully flat)

Report budget utilisation for an organisation for a given period

Aggregate agent cost by config for an org, optionally filtered by date range

Aggregate agent LLM cost and token usage by model for an org

Provision backend container capacity immediately

Restore Cloud Run traffic to a previously stable revision.

Roll out a Cloud Run revision through staged traffic percentages with rollback support.

Query active connections (read-only; scoped to organization)

Extract and return DAG structure

Call the org's LLM for a one-shot reasoning turn (via ai.chat)

Verify a DocuSign envelope is completed, then stream its signed PDF and certificate of completion into the customer bucket as audit-tracked objects (verify → presign → download)

Create a DocuSign envelope from documents fetched by presigned URL — draft by default, sent with send=true

Create a DocuSign envelope from a server template with role assignments — draft by default, sent with send=true

Set the organization's buyer policy for the Agent Exchange.

Cancel an open Agent Exchange deal. Settled one_shot deals cannot be cancelled here (refunds arrive from the PSP). Settled subscriptions revoke the lease without calling a live PSP.

Start an Agent Exchange deal. Same-org hires settle on rail=internal with no provider objects. Hosted checkout on live PSP rails is deferred.

Clone repo for FailGuard indexing (DAG step)

Create Bedrock Data Source for FailGuard project (DAG step)

Create Bedrock KB for FailGuard project (DAG step)

Get remaining credits for the authenticated team

Get remaining tokens for the authenticated team (Extract only)

Cancel a crawl job

Delete an Artifact Registry package (image) and all versions; idempotent when already absent.

Describe a GCP Artifact Registry remote repository

Delete an Artifact Registry repository; idempotent when already absent.

Activate one immutable trusted Git-remote binding.

Create an immutable repository-to-trusted-broker binding version without storing a remote URL or credential.

Get an organization-scoped trusted Git-remote binding.

Read bounded metadata and tail logs for one GitHub Actions job.

Trigger a GitHub Actions workflow_dispatch run through an installed GitHub App connection.

Generate a GitHub App installation access token

Bind a GitHub repo path to a Kubernetes cluster and start GitOps sync

Soft-delete a GitOpsApplication and stop its controller (optional cascade prune)

Pause reconciliation for a GitOpsApplication

Scaffold: create a paused Google Ads campaign draft. Always returns status=PAUSED / enabled=false. Never sets ACTIVE (SOCIAL-004). No live API yet.

Create a Staff ActorOutboxEnvelope for Google Ads spend enable (SOCIAL-004 hard inbox gate).

Scaffold: accept a StorageObject UUID for Google Ads creative attach. Does not upload or enable spend. No live Google Ads API yet.

Acknowledge webhook event delivery from DevKit to local target

Create new webhook redirect with signed UUID

Soft delete webhook redirect and cleanup pending events

Generate a new API token for the current user

List API tokens for the current user

Revoke (hard-delete) an API token for the current user

Start a merchant's authorization of the registered iFood application

Exchange a merchant's authorization code for a durable iFood grant

Validate iFood authentication and merchant visibility

Deploy a containerised app: Namespace + ConfigMap + Secret + Deployment + Service, with optional PVC / HPA / PDB / Ingress

Patch a Deployment's container image and wait for rollout to be Available. Helm-safe — only touches the image field.

Tear down a containerised app: Ingress/HPA/PDB + Service + Deployment + ConfigMap + Secret; PVCs only when delete_pvcs=true

List all API resources advertised by the cluster (kubectl api-resources equivalent)

Read Kubernetes API server version.

Delete a ClusterRole (cluster-scoped, rbac.authorization.k8s.io/v1)

Resolve KV keys into runtime secret_env / Pages secrets (references only)

Resolve an Orkestia KV key to a reference (value only on explicit reveal)

Write one Orkestia KV key as a new version via LTIP (value redacted)

Scaffold: record a paused LinkedIn Ads campaign draft. Never sets ACTIVE or spends (SOCIAL-004). No live Campaign Manager write yet.

Create a Staff ActorOutboxEnvelope for LinkedIn Ads spend enable (SOCIAL-004 hard inbox gate).

Associate a sponsored campaign with a Conversions API rule (PUT /rest/campaignConversions). Required before event attribution.

Provision Sign in with Orkestia for a Lovable project

Build a Lovable project's synced repo and deploy it to production

Create the payment webhook that grants a Lovable app's end-users access

Creates a Lumen alert rule that dispatches webhook, Slack, or email notifications — or opens a native Orkestia incident ticket (channel=ticket) — when fingerprint_log detects a new_group, regressed, or threshold event.

Permanently delete a Lumen alert rule by its public UUID.