| gvc | Yes | GVC slug (lowercase kebab-case). Use the GVC the user named; otherwise discover with list_resources (kind="gvc") and let them choose — never guess (a wrong GVC targets the wrong environment). | |
| org | Yes | Organization slug (lowercase kebab-case). NEVER guess — if the user has not named one, ask. On org-not-found, stop and ask; do not retry variants. | |
| name | Yes | Workload name (lowercase kebab-case, must start with a letter, max 49 chars, cannot end with -headless). The name is IMMUTABLE — "renaming" requires delete + recreate (loses public URL, internal DNS, policy targetLinks). | |
| tags | No | Add or update tags without replacing the full set. Submit an empty list to clear all tags. | |
| debug | No | Enable or disable spec.defaultOptions.debug. Not valid for a cron workload. | |
| public | No | Convenience shortcut: opens the external firewall BOTH ways — inbound 0.0.0.0/0 AND outbound 0.0.0.0/0. Mutually exclusive with firewallConfig (an explicit firewallConfig overrides it). | |
| suspend | No | Enable or disable spec.defaultOptions.suspend (for a cron workload, pauses/resumes scheduled runs) | |
| schedule | No | New cron schedule (NUMERIC 5-field expression, e.g. "0 */6 * * *" — no macros or day/month names). Only valid when the target workload is type "cron". | |
| capacityAI | No | Enable or disable spec.defaultOptions.capacityAI — applies to every type (default ON for serverless/standard/cron; on cron the new reservation takes effect at the next scheduled run). Explicit true is rejected with the cpu metric and with GPUs. | |
| containers | No | Optional container patches, merged by required `name` into existing containers. Minimal patch item is { "name": "app" }; other containers are preserved. Set only fields you want to change. An unknown name ADDS a new container and must include image. | |
| autoscaling | No | Autoscaling patch → merged key-by-key into spec.defaultOptions.autoscaling. | |
| description | No | Update workload description | |
| historyLimit | No | Number of completed job instances to retain (default 5) | |
| identityLink | No | Identity link granting 3rd-party cloud resource access, e.g. //identity/my-id | |
| removeTagKeys | No | Tag keys to remove from the resource. | |
| restartPolicy | No | What to do when a job instance fails | |
| firewallConfig | No | Replace the firewall config wholesale. | |
| timeoutSeconds | No | Set spec.defaultOptions.timeoutSeconds — max request duration (platform default 5s; serverless caps at 600) | |
| concurrencyPolicy | No | What to do when a run is due while a prior run is still active (default Forbid) | |
| removeIdentityLink | No | true deletes spec.identityLink, revoking the cloud/secret access it granted. | |
| supportDynamicTags | No | Enable or disable spec.supportDynamicTags (detects image digest changes) | |
| activeDeadlineSeconds | No | Max seconds to wait for the job to complete before it is stopped | |