Skip to main content
POST
Create automation

Permissions

Requires a service user with the ManageOrgAutomations permission at the organization level.

Run identity

The run_as field is required. Service-user-created automations must use organization; human-owned API callers with the UsePersonalAutomations permission may use creator to run sessions with the creator’s permissions.

Triggers and actions

An automation fires when any of its triggers matches an event, and then runs its actions (for example, starting a Devin session with a prompt). Use the event schemas endpoint to discover the supported trigger event types, their condition fields and operators, and the reply verbs each event type supports. Trigger conditions use a two-level envelope — {"any": [{"all": [...]}]} — of {field, operator, value} conditions; a null conditions object matches every event.

Webhook triggers

An automation with a webhook:incoming trigger (at most one) is assigned an inbox URL and secret at create time. The secret is minted again and returned when a webhook trigger is re-added during an update; it cannot be retrieved again, so capture it when you receive it. External systems send it in the X-Webhook-Secret header.

Authorizations

Authorization
string
header
required

Service User credential (prefix: cog_)

Path Parameters

org_id
string
required

Organization ID (prefix: org-)

Example:

"org-abc123def456"

Body

application/json
actions
(AutomationStartSessionAction · object | AutomationMessageSessionAction · object | AutomationMonitorSessionAction · object)[]
required

Non-empty. Caps: at most one start_session; monitor_session must be the only action.

name
string
required
Required string length: 1 - 500
run_as
AutomationRunAsOrganization · object
required

Required: explicitly choose the identity spawned sessions run under (organization or creator).

triggers
AutomationTriggerRequest · object[]
required

Fires when any trigger matches; once per event. At most one webhook:incoming trigger.

concurrency
AutomationConcurrency · object | null
enabled
boolean
default:true
limits
AutomationLimits · object | null
metadata
Metadata · object

Org-visible key/value labels for organizing/filtering automations. At most 16 pairs; keys at most 32 chars; values at most 128.

notifications
AutomationNotifications · object | null
security_profile
AutomationSecurityProfileSelection · object | null

The automation's own security-profile binding; omitted = inherit from the org/enterprise. Requires the security-profile management permission.

session_settings
AutomationSessionSettings · object | null

Applied to sessions this automation spawns.

template_id
string | null

Create-only provenance marker; resolve ids via the templates endpoint. When set and tools.mcp_servers is omitted, the template's required_mcps apply.

tools
AutomationTools · object | null

Response

Successful Response

actions
(AutomationStartSessionAction · object | AutomationMessageSessionAction · object | AutomationMonitorSessionAction · object)[]
required
automation_id
string
required
created_at
integer
required
created_by
ActorResponse · object
required

A user or service-user principal attributed to an action or resource.

enabled
boolean
required
name
string
required
triggers
AutomationTriggerResponse · object[]
required
updated_at
integer
required
concurrency
AutomationConcurrency · object | null
last_edited_by
ActorResponse · object | null

A user or service-user principal attributed to an action or resource.

last_invocation
AutomationLastInvocation · object | null
limits
AutomationLimits · object | null
metadata
Metadata · object
notifications
AutomationNotifications · object | null
run_as
AutomationRunAsOrganization · object

Identity the spawned sessions run under. organization: the org's automation identity (the System User in the app) — sessions use system permissions, so MCP servers installed with a personal (user-scoped) connection cannot be selected, and switching an automation to organization removes them from its selection. creator: personal automation — runs with the creator's own permissions and is visible only to the creator and org admins; rejected for service-user-created automations. Required on create; null on update resets to organization.

security_profile
AutomationSecurityProfileResponse · object | null

The automation's security-profile binding and the resolved governing profiles. null when security profiles are not enabled for the organization.

session_settings
AutomationSessionSettings · object | null

Applied to every session this automation spawns (including monitor sessions).

template_id
string | null
tools
AutomationTools · object | null