HIGH RISK: creates one website approval request to update one named BotSpot live deployment to a target saved strategy revision. Restart argument example: {"deploymentId":"RETURNED_DEPLOYMENT_ID","aiStrategyRevisionId":"RETURNED_CURRENT_REVISION_ID"}

Restart retaining known saved variables: {"deploymentId":"RETURNED_DEPLOYMENT_ID","aiStrategyRevisionId":"RETURNED_CURRENT_REVISION_ID","brokerCredentialId":"RETURNED_SAVED_BROKER_ID","envVarSetIds":["MATCHED_SAVED_VARIABLE_ID"]} Never add top-level source or liveCadenceMatchesBacktest to an update/restart call. Those are new-schedule metadata, not update arguments. Replace the example ID labels with the exact returned IDs. This is the complete minimal argument object only when no saved variables need retention. When retaining existing saved variables, use the second example with every matched active saved-variable ID, even when the revision can start without that variable. Omit the broker reference only when its actual ID is unavailable. Schedule configuration is separate and supplied only for a user-requested cadence change. Minimal immediate restart: copy deploymentId and the current aiStrategyRevisionId, set runImmediately=true when that parameter is available, and add only the evidenced broker and saved-variable references. A preserved-schedule restart does not submit schedule configuration. After the signed-in user approves on BotSpot, the server stops only the specified deploymentId, then starts aiStrategyRevisionId with the saved brokerCredentialId selected in the tool call or on the website approval page and the submitted envVarSetIds. Preserve-configuration checklist for an explicit restart: use the current revision, submit each matched saved-variable ID in envVarSetIds, use only an evidenced broker ID, and OMIT deploymentMode, schedulePolicyId and scheduleMetadata unless the user requested changing them. Check the actual submitted payload before claiming preservation. For example, restarting immediately uses the returned deploymentId and current aiStrategyRevisionId with runImmediately=true, plus evidenced broker/saved-variable references. It needs NO scheduleMetadata, schedulePolicyId or deploymentMode. This tool has no top-level source or liveCadenceMatchesBacktest parameters; do not copy those nested schedule-policy fields into this call. When restarting or retaining saved variables, first read saved_env_vars(action="list") and bind the matched active item.id values in envVarSetIds in this call. IDs are references, not secret values; include them even though raw env vars are forbidden. An omitted envVarSetIds or [] does not select the existing saved set. Never claim variables are prefilled unless their returned IDs were submitted. With the same saved broker connection, this preserves the deployment identity, bot history, and saved-state namespace. Selecting a different broker connection creates a fresh deployment and does not transfer the prior account state. This tool always requires website approval; it never executes from chat-only approval or reusable grants. Use it when the user explicitly asks to update, restart, sync, or move a running bot to the latest version or Version N. Also use it after a deployment external event or deployment logs show a fixable strategy-code failure and you have saved/read back a corrected revision; that recovery is incomplete until this approval request is created for the failed deploymentId and newest aiStrategyRevisionId. The server never infers or copies a broker connection into the escrow payload. Update/restart approvals include metadata.currentBroker from Deploy.brokerCredentialId (same source of truth as the Bots UI). Pass brokerCredentialId only when authoritative deployment evidence exposes its exact saved ID or the user names an exact saved replacement. If authoritative deployment evidence does not expose the credential ID, omit brokerCredentialId; the website approval page shows the current association and requires the owner to confirm or choose a connection. Never send a placeholder, a display name, or an invented ID. In the final answer identify the selected connection by both the returned broker and brokerCredentialDisplayName; never replace the returned account label with a generic paper/live description. Do not use it to stop duplicate/stale deployments unless the user named that deployment. If no valid saved connection is available, omit brokerCredentialId and still create the update approval. Do not pass a credential whose status is reconnect_required; the website approval page lets the owner select, add, or reconnect a broker before approving, including through /account-settings/broker-connections. No raw broker credentials, raw env vars, inline code, or raw runtime configuration are accepted. For Codex, Claude, Cursor, and other clients without BotSpot native confirmation cards, return the exact authorizationUrl as a clickable Markdown link in your reply. Do not say a card or button was created unless the client actually rendered it. BotSpot clients may render structuredContent as a native confirmation, but a button name alone is not an approval link. A pending request is not execution; only the signed-in user may approve on the website. Report expiry and check get_deployment_action_status after approval.