past.dev

Internal staff only. Creates a sign-up campaign: every new organization opened through its link is granted the credits, once, under the reason the customer's Billing screen shows. Granted credits never lapse and cannot be taken back. Answers the link to hand out. Call it without confirm first, put the sentence it answers with to the person, and call again with confirm: true only when they agree.

Internal staff only. Ends a sign-up campaign now: its link grants nothing from this moment, and the organizations it granted keep their grants. Call it without confirm first, put the sentence it answers with to the person, and call again with confirm: true only when they agree.

Internal staff only. Erases an account at its member's request (a GDPR erasure): deletes the member's WorkOS user, the organization with every project, API key, usage record and its database, its Stripe customer if it has one (Stripe keeps the invoices), and the member's profiles at Customer.io, recording each step, and answers a receipt to paste into the written confirmation. It takes an organization whose only member is the person who asked; it refuses your own organization, a staff one, one with other members, an unclaimed or provisioning one, and one on a paid plan or an Enterprise contract. A processor whose keys this deployment lacks is left to do by hand, and the answer names what to submit. Called again with the id of an organization it erased, it runs again the steps that failed, or answers the receipt again. Never pass the person's address. Call it without confirm first, put the sentence it answers with to the person, and call again with confirm: true only when they agree.

Internal staff only. Finds organizations anywhere on this deployment from what you were told about a customer: the organization's id or slug, a member's exact address, the domain members sign in from ("@acme.com" or "acme.com"), or part of the name. At most ten, the most exact matches first, each with its id, slug, status, plan, member count and what matched. An organization a coding agent made names that agent (createdByAgent); while nobody has claimed it, it reads unclaimed, with the date it is deleted unless claimed (unclaimedUntil), and its name and its one member are placeholders. Pass the id to admin_get_organization or admin_grant_credits.

Internal staff only. An organization's filed Enterprise contract, named by its id or slug: the term, the commitment and its rate, the terms that set its Enterprise plan (credits a month, how long bought credits last, days to pay an invoice, the monthly fee) and who filed it, beside the plan those terms make right now and the billing email Stripe sends its invoices and receipts to. contract is null where none is filed.

Internal staff only. One organization on this deployment, named by its id or slug: its status and creation date, its plan and subscription, its Stripe customer and subscription ids (to compare with Stripe's dashboard), the credits it was granted at sign-up, its members and pending invitations, and the credits granted to it (the latest twenty, each naming the sign-up campaign behind a campaign grant, and everything ever). An organization a coding agent made names that agent (createdByAgent); while nobody has claimed it, it reads unclaimed, with the date it is deleted unless claimed (unclaimedUntil), and its one member is a placeholder nobody signs in as. It does not read the balance, which lives in the organization's own database; the customer's Billing screen shows it.

Internal staff only. Grants an organization credits: they are spent after its included credits, never lapse, and cannot be taken back; on Flex and Enterprise they also raise the billing period's fair use on recall. The grant is recorded with your address as its author and the reason as the customer's Billing screen shows it. Call it without confirm first, put the sentence it answers with to the person, and call again with confirm: true only when they agree. Calling twice with confirm grants twice.

Internal staff only. Sends an organization a Stripe invoice for credits at its Enterprise contract's prices, due in the contract's days to pay; the credits are added once it is paid and last the contract's months from then. A price in place of the contract's needs approvedBy: who approved it, in writing, and when. Call it without confirm first, put the sentence it answers with to the person, and call again with confirm: true only when they agree. Calling twice with confirm sends two invoices.

Internal staff only. Every sign-up campaign, newest first, each with its credits, reason, end, cap, the organizations granted so far, its status (active, ended or full), its author and its link. Given a campaign's code, that campaign alone, the organizations still holding its grant and the credits they were granted in all, and the latest 50 of them. An organization deleted since is in the campaign's count and nowhere else.

Internal staff only. What a purchase of credits costs on an organization's Enterprise contract: priced on the contract's steps from the credits invoiced since its term began, one line per price, or at a price somebody approved in place of them. Sends nothing; admin_invoice_credits sends the invoice.

Internal staff only. Files an organization's Enterprise contract, replacing the one filed before: every term is set again, and a term left out returns to the Enterprise catalog's figure. On Enterprise the terms set the plan from the moment they are filed: the credits each period includes, how long bought credits last from payment, and, with payment days, that an overdue invoice withholds the month's credits until it is paid. The signed PDF is kept; filing a new one is the contract command line's. Money is in minor units of the currency (USD 500.00 is 50000). billingEmail is required: the address Stripe sends the contract's invoices and receipts to, which becomes the organization's billing email. Ask the person for it when they have not given it, and never guess it from a name. Call it without confirm first, put the sentence it answers with to the person, and call again with confirm: true only when they agree.

Internal staff only. Puts an organization on Pay as you go onto Flex free for some months, for a startup program or any other deal: creates its Stripe customer where it holds none, starts a Flex subscription at 100% off for those months that cancels itself when they end, and records the plan at once. Nothing is ever charged; when the months end the organization returns to Pay as you go. An organization already on Flex or Enterprise is refused. Call it without confirm first, put the sentence it answers with to the person, and call again with confirm: true only when they agree.

Internal staff only. Brings an organization's plan to what Stripe bills it for: lists the subscriptions of the Stripe customer the organization holds and writes each one's row exactly as a Stripe subscription event would. Use it when an organization paid for Enterprise (or Flex) in Stripe but still reads Pay as you go. A subscription on a price that maps to no plan writes nothing, and the answer names it. Call it without confirm first, put the sentence it answers with to the person, and call again with confirm: true only when they agree.

Internal staff only. Changes a sign-up campaign's terms for the sign-ups from now on; the organizations it has granted keep what they received. A term left out keeps its value, so an end or a cap can be moved, never removed. A future endsAt runs an ended campaign again. Call it without confirm first, put the sentence it answers with to the person, and call again with confirm: true only when they agree.

Archives a project, as Archive on Settings › Projects does: out of the switcher, every call on its keys refused, its data still readable. The organization's last live project cannot be archived. Needs project Admin.

Creates a group of members that rules can name. A group grants nothing until a rule names it. Mirrors New group on Settings › Roles & access; needs Owner or Admin. Only members who have joined can be added.

Creates a tag-matched rule: the groups and people it names reach every live project its tags match, at its level, until it lapses. Mirrors New rule on Settings › Roles & access; needs Owner or Admin. Name at least one group or person, and give tags unless match is Every. Call preview_access_rule first and tell the person what it would reach.

Mints a project key named name, attributed to the person under Created by. The answer carries the key's clear value: show it to the person once, and never paste it anywhere but back to them, since it is not recoverable here afterwards. Mirrors API keys › Create key; needs project Admin. Name the project by slug; omit it when the organization has one live project.

Mints an access link to a project's MCP server for one identity: an MCP URL whose secret is the credential, so a client connects with it and every call runs as that identity, with no sign-in. The server must be on. identity names an identity the project already holds; with newIdentity: true it is created here, with traits (for example {"kind": "agent"}), which decide the audiences it is in. The answer carries the link: show it to the person once, and never paste it anywhere but back to them, since it is not recoverable here afterwards. Mirrors Build › MCP server › Create access link; needs project Admin.

Creates a project, as New project in the switcher or Settings › Projects does. The slug is derived from the name as the console derives it and never changes; the person becomes project Admin on it. Member and above.

Adds a tag to the organization's vocabulary, as Manage tags does. Lowercase letters, numbers and dashes, 2-40 characters, starting with a letter. Owner and Admin.

Deletes a group. Mirrors deleting a group on Settings › Roles & access; needs Owner or Admin. Everyone cannot be deleted, and neither can a group a rule still names: change or delete those rules first. Destructive: call without confirm first, put the sentence it answers to the person, and pass confirm: true only if they agree.

Deletes a rule; the people it reached lose that access unless a role, another rule or a grant gives it. Mirrors deleting a rule on Settings › Roles & access; needs Owner or Admin. Destructive: call without confirm first, put the sentence it answers to the person, and pass confirm: true only if they agree.

Deletes data points from a project's memory by their source ids, as POST /api/v1/data-points/delete does: each data point and every memory past drew from it leave recall at once, and their stored copies and index entries are purged in the background. A recall names each source's id as sourceId. Every id must name a live data point of the project, or nothing is deleted and the refusal names the ids that do not. Destructive: call it without confirm first, put the sentence it answers to the person, and call again with confirm: true only if they agree. It answers the deletion's operationId; get_memory_deletion says when the purge is done. Deleting spends no credits. Needs project Write.

Deletes a project permanently and revokes every key it holds, as Delete on Settings › Projects does. Destructive: call it without confirm first, put the sentence it answers to the person, and call again with confirm: true only if they agree. The organization's last live project cannot be deleted. Needs project Admin.

Deletes a tag nothing depends on, as Delete on Manage tags does; a tag a project carries or a rule matches is refused. Destructive: call it without confirm first, put the sentence it answers to the person, and call again with confirm: true only if they agree. Owner and Admin.

Turns a project's end-user MCP server on and answers with its address, which is derived from the organization and project slugs, so there is nothing to choose. A server that was on before takes back the same address. Nobody can sign in until the project has a login connection (set on Build › MCP server) or an access link (create_mcp_access_link). Mirrors Build › MCP server › Enable MCP server; needs project Admin.

Cut files into the data points past reads best and price them, before anything is sent. Each file is detected as email, chat, transcript, table, records, code, documentation or notes (or pass kind to skip detection), cut at its natural boundaries, ordered by time and batched for POST /api/v1/ingest/batch. Answers the points (at most 200, with a preview each), the batches with their idempotency keys, the credits, the balance, and fitsFirst: how many points in order fit what is left. Writes nothing, spends nothing, and leaves no row in the request log. Mirrors the API Explorer's drop review; needs project Read on the project.

Where one ingestion stopped and what to do: its phase (queued, preparing, prepared, processing, captured, indexed, failed, nothing-changed),why it stopped and whether a retry can fix it when it failed, each data point it carried with whether it is searchable and how many memories came out of it, and one sentence naming the next step. Start here when data does not show up. Name the ingestion by its id (the ingest answer's ingestionId) or by the request id that carried it. Needs project Read.

Memories and sources matching a search, newest first, in two paged groups: a source matches on its text and its data point id, a memory on its own words and on an artifact id. Pass ingestionId to list the sources one ingestion carried and the memories drawn from them. Each entry's id is what get_lineage and get_timeline take. Mirrors Trace's root picker; needs project Read.

The organization's credits left, the included and bought credits, the reset date, and one project's month: credits spent, ingestions, recalls, and what is left of its credit and ingestion caps. Use it when an ingestion is refused with 402 (out of credits) or 429 project-cap-reached. metered is false on a self-hosted deployment with no plan, and the credit figures are then null. Answers what GET /api/v1/usage answers for a project key; needs project Read on the project.

What a memory was built from and what was built on it: the nodes reachable from the root and the edges among them (each edge reads: derivedId was built from inputId), with how many the limit left out. Walks every side by default. Mirrors Trace's Lineage tab; needs project Read.

What the organization's management key called in the last 30 days: each route with its method, call count and last call, busiest first; a route nobody called is absent. Mirrors Settings › Management key › Recent activity; needs Owner or Admin.

A project's end-user MCP server, as Build › MCP server shows it: whether it is on, its address (while it is off, the address it would take), whether end users may write, the login connection, the live access links and whether anybody can sign in yet. Needs project Admin.

Shows where a deletion that delete_memory or the Memory API accepted stands: its source ids and its status, deleting while their stored copies and index entries are being purged, then deleted once none is left. Recall stops returning them as soon as the deletion is accepted. Needs project Read.

The organization: name, slug, plan, creation date and member count. Mirrors Settings › General; every role holds it.

The organization's plan: the credits it includes and whether they come back each billing period or were granted once, how many content bytes buy a credit, what one recall costs, the fair use on recall where the plan has one (this billing period's figure, the recalls served against it, and what a recall above it costs), any cap on recalls, how long request payloads are kept, how long unused credits roll over, and what happens when the credits run out. Mirrors the plan the Usage screen and the sidebar meter show; every role holds it.

One project in full, as the Settings › Projects drawer shows it: its row, and the Access tab listing who reaches it, at what level, through their role, a rule or a grant, and until when. Needs project Read.

Who reaches one project: each person with their level, where it comes from (Role, Rule or Grant), the rule's name when a rule gives it, and when it lapses. Mirrors the Access tab of a project on Settings › Projects; needs project Read.

One call from a project's request log, as the Requests detail drawer shows it: method, path, status, the request id, when it arrived, how long it took, the key, the outcome and phase, what it was billed, and the allowlisted headers with the request and response bodies. Past the plan's retention window the row stays and the payload is gone. Mirrors the Requests detail screen; needs project Read on the project.

The work around a root on a clock: every node reachable from it with when it occurred, arrived and became searchable, sectioned as revision, built-from, produced or elsewhere; the ingestions in the window that carried its sources, with their phase; the recalls in the window that returned one of the nodes; and which node replaced which. The window is at most 31 days, the root's recent history by default. Mirrors Trace's Timeline tab; needs project Read.

One memory or source by its id: its headline, kind, data point and revision, when it occurred, arrived and became searchable, its validity, whether it is current, and how many inputs and outputs it has. A source carries its text, cut to 4,000 characters. Mirrors Trace's sheet; needs project Read.

This billing period's usage (UTC): credits spent against the credits included, split by what spent them — ingesting content, receiving webhook events and serving recalls — with ingestion and recall counts, each project's credits and share, and the date the included credits reset. Mirrors the Usage screen's balance and its By project table; Owner, Admin and Billing hold it. Reading usage spends no allowance.

Who you act for: name, email, platform role, the organization, and every live project they reach with the level they reach it at. Call it first. Every role holds it.

Grants one member direct access to one project at Read, Write or Admin, optionally until a date; granting again replaces their grant. Mirrors Grant access on a project's Access tab; needs project Admin on that project. Owners and Admins already reach every project and Billing none, so they cannot be granted.

Ingests one data point into a project's memory, as POST /api/v1/ingest does, and answers as it does: the ingestion id, the source id and the status. With no audience the data point is for the whole project; name an audience by its slug to keep it to that audience. An id that already exists replaces the earlier revision and the memories that came from it, and the same content under the same id is unchanged and costs nothing. It spends the project's credits as an API ingestion does. Ingest only what the person asks you to keep. Needs project Write.

Invites an email address into the organization at a platform role, with the person you act for as the inviter. Mirrors Settings › Members › Invite member; needs Owner or Admin. The role is Admin, Member or Billing: Owner is refused, because ownership moves by set_member_role once they have joined. Project access is left to rules and grants. Where no mail goes out the answer carries the single-use link: give it to the person you act for and nowhere else.

The organization's groups: name, whether it is the built-in Everyone, its members (userId, name, email, role) and how many rules name it. Mirrors Groups on Settings › Roles & access; needs Owner or Admin.

The organization's tag-matched access rules: who each names (groups and people), the tags and how they match, the level it gives, when it lapses, the projects it matches today and how many people it reaches. A rule whose expiry has passed is still listed, marked lapsed, matching nothing and reaching nobody. Mirrors Project access rules on Settings › Roles & access; needs Owner or Admin.

A project's live keys, newest first: id, name, masked value, created by, created and last used. Never the clear value of a key, which only the person can reveal on the screen. Mirrors API keys; needs project Admin. Name the project by slug; omit it when the organization has one live project.

Everyone in the organization: each member's id, userId, name, email, platform role, joined date and the projects they reach ("Every project", "No projects", or a count and its largest source), then the pending invitations. Mirrors Settings › Members; needs Owner or Admin. Use id with set_member_role, remove_member and resend_invitation, and userId with grant_project_access and the access rule and group tools.

The live projects the person reaches, as Settings › Projects lists them: id, slug, display name, tags, monthly caps with this month's spend, memory count and the level they reach each at. includeArchived adds archived projects for an Owner or Admin and is ignored for a Member. Every role but Billing holds it.

One project's request log, newest first, with the Requests screen's filters, search and date range, paged by cursor. Pass endCursor back as after for the next page; use get_request for a call's payload. A range is at most 31 days. Mirrors the Requests screen; needs project Read on the project.

The organization's tags, as Manage tags on Settings › Projects lists them: id, name, how many projects carry each and how many access rules match it. Owner and Admin.

Merges one tag into another, as Merge on Manage tags does: the projects carrying it carry the other, the rules matching it match the other, and it is gone. This usually widens who reaches what. Destructive: call it without confirm first, put the sentence it answers to the person, and call again with confirm: true only if they agree. Owner and Admin.

Which live projects and which people a rule would match if it were saved as described. Nothing is written. Mirrors the preview in the New rule drawer on Settings › Roles & access; needs Owner or Admin. People whose role already decides their reach (Owner, Admin, Billing) are left out, because the rule moves nothing for them.

Recalls from one project's memory, as POST /api/v1/recall does: the same arguments, the same refusals and the same answer, each result with its sources. With no identity it reads what the console's Memories screen shows: everything in the project. With an identity it reads as that identity: what the whole project sees, and the audiences that hold the identity. While ingestions of the project are still processing, pending says how many and that their memory is not in this answer yet. It spends credits where the recall is priced, as an API recall does: every recall on Pay as you go, and on Flex and Enterprise each one above the billing period's fair use, which get_plan states. Needs project Read.

Removes a member from the organization, or revokes a pending invitation. Mirrors Remove from organization and Revoke invitation on Settings › Members; needs Owner or Admin, removing an Owner needs an Owner, and the last Owner is refused. Their sessions end at once; keys they minted keep working. Destructive: call without confirm first, put the sentence it answers to the person, and pass confirm: true only if they agree.

Renames a tag, as Manage tags does. The projects carrying it and the rules matching it follow the new name, so nobody's access moves. Renaming onto an existing tag is refused: merge_tags combines two tags. Owner and Admin.

Calls per time bucket over a range for one project, split by how they ended: accepted, accepted then failed later, and rejected. The bucket follows the range as on the screen, so a range never draws more than about a hundred buckets. Takes the same filters and search as list_requests. Mirrors the Requests screen's histogram; needs project Read on the project.

Sends a pending invitation again with a fresh link; the old link stops working. Mirrors Resend invitation on a pending row of Settings › Members; needs Owner or Admin. Where no mail goes out the answer carries the new link: give it to the person you act for and nowhere else.

Runs an ingestion that failed again, under the same ingestion id, as Retry in the request drawer and on Trace does. It spends no credits. Only a failed ingestion can be retried; explain_ingestion says whether a retry can fix it. Call it without confirm first, put the sentence it answers to the person, and pass confirm: true only if they agree. Needs project Write.

Destructive: revokes a project key, which stops working on its next call and cannot be restored. id is the key id exactly as list_api_keys returned it. Without confirm: true nothing happens and the answer is the sentence to put to the person. Mirrors API keys › Delete; needs project Admin.

Withdraws one member's direct grant on a project at once; access they hold through their role or a rule stays. Mirrors the remove button on a grant in a project's Access tab; needs project Admin on that project. Destructive: call without confirm first, put the sentence it answers to the person, and pass confirm: true only if they agree.

Changes a member's platform role: Owner, Admin, Member or Billing. Mirrors the Platform role select on Settings › Members; needs Owner or Admin, and only an Owner sets or clears Owner. Making someone Owner transfers ownership: they become the Owner and the person you act for becomes an Admin. A pending invitation cannot become Owner, and the last Owner cannot step down. Destructive: call without confirm first, put the sentence it answers to the person, and pass confirm: true only if they agree.

Sets a project's monthly caps, as Set caps on Settings › Projects does: ingestions a month and credits a month. Both are set together, so a cap you omit is cleared; pass the one to keep as well. Needs project Admin.

Brings an archived project back, as Unarchive on Settings › Projects does: in the switcher and taking calls on its keys again. Needs project Admin.

Renames a group or sets its members. What you omit is kept; userIds, when sent, is the whole membership. Mirrors editing a group on Settings › Roles & access; needs Owner or Admin. Everyone is built in and cannot be renamed or emptied.

Replaces a rule with what you send, as saving the rule drawer does: send every group, person and tag it should keep. Mirrors editing a rule on Settings › Roles & access; needs Owner or Admin.

Renames a project and sets its tags, as the Settings › Projects drawer does. The slug never changes. Tags must already exist (list_tags); applying or removing one can change who reaches the project. Needs project Admin.