> ## Documentation Index
> Fetch the complete documentation index at: https://docs.devinenterprise.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create automation

> Create a new automation with triggers and actions.

## Permissions

Requires a service user with the `ManageOrgAutomations` permission at the organization level.

## Run identity

The `run_as` field is required. Service-user-created automations must use
`organization`; human-owned API callers with the `UsePersonalAutomations`
permission may use `creator` to run sessions with the creator's permissions.

## Triggers and actions

An automation fires when any of its `triggers` matches an event, and then runs its `actions` (for example, starting a Devin session with a prompt). Use the [event schemas endpoint](/api-reference/v3/automations/get-organizations-automations-schemas) to discover the supported trigger event types, their condition fields and operators, and the reply verbs each event type supports.

Trigger `conditions` use a two-level envelope — `{"any": [{"all": [...]}]}` — of `{field, operator, value}` conditions; a `null` conditions object matches every event.

## Webhook triggers

An automation with a `webhook:incoming` trigger (at most one) is assigned an inbox URL and secret at create time. The secret is minted again and returned when a webhook trigger is re-added during an update; it cannot be retrieved again, so capture it when you receive it. External systems send it in the `X-Webhook-Secret` header.


## OpenAPI

````yaml v3-openapi.yaml POST /v3/organizations/{org_id}/automations
openapi: 3.1.0
info:
  description: Devin v3 API with Service User authentication and RBAC
  title: Devin API v3
  version: 3.0.0
servers: []
security:
  - bearerAuth: []
paths:
  /v3/organizations/{org_id}/automations:
    post:
      tags:
        - automations
      summary: Create automation
      description: Create a new automation with triggers and actions.
      operationId: handle_create_automation_v3_organizations__org_id__automations_post
      parameters:
        - description: 'Organization ID (prefix: org-)'
          in: path
          name: org_id
          required: true
          schema:
            example: org-abc123def456
            title: Org Id
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AutomationCreateRequest'
        required: true
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AutomationResponse'
          description: Successful Response
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Unauthorized
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Not Found
        '409':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Conflict
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Unprocessable Content
        '429':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Too Many Requests
components:
  schemas:
    AutomationCreateRequest:
      additionalProperties: false
      properties:
        actions:
          description: >-
            Non-empty. Caps: at most one start_session; monitor_session must be
            the only action.
          items:
            discriminator:
              mapping:
                message_session:
                  $ref: '#/components/schemas/AutomationMessageSessionAction'
                monitor_session:
                  $ref: '#/components/schemas/AutomationMonitorSessionAction'
                start_session:
                  $ref: '#/components/schemas/AutomationStartSessionAction-Input'
              propertyName: type
            oneOf:
              - $ref: '#/components/schemas/AutomationStartSessionAction-Input'
              - $ref: '#/components/schemas/AutomationMessageSessionAction'
              - $ref: '#/components/schemas/AutomationMonitorSessionAction'
          title: Actions
          type: array
        concurrency:
          anyOf:
            - $ref: '#/components/schemas/AutomationConcurrency'
            - type: 'null'
        enabled:
          default: true
          title: Enabled
          type: boolean
        limits:
          anyOf:
            - $ref: '#/components/schemas/AutomationLimits'
            - type: 'null'
        metadata:
          additionalProperties:
            type: string
          default: {}
          description: >-
            Org-visible key/value labels for organizing/filtering automations.
            At most 16 pairs; keys at most 32 chars; values at most 128.
          title: Metadata
          type: object
        name:
          maxLength: 500
          minLength: 1
          title: Name
          type: string
        notifications:
          anyOf:
            - $ref: '#/components/schemas/AutomationNotifications'
            - type: 'null'
        run_as:
          description: >-
            Required: explicitly choose the identity spawned sessions run under
            (organization or creator).
          discriminator:
            mapping:
              creator:
                $ref: '#/components/schemas/AutomationRunAsCreator'
              organization:
                $ref: '#/components/schemas/AutomationRunAsOrganization'
            propertyName: type
          oneOf:
            - $ref: '#/components/schemas/AutomationRunAsOrganization'
            - $ref: '#/components/schemas/AutomationRunAsCreator'
          title: Run As
        security_profile:
          anyOf:
            - $ref: '#/components/schemas/AutomationSecurityProfileSelection'
            - type: 'null'
          description: >-
            The automation's own security-profile binding; omitted = inherit
            from the org/enterprise. Requires the security-profile management
            permission.
        session_settings:
          anyOf:
            - $ref: '#/components/schemas/AutomationSessionSettings-Input'
            - type: 'null'
          description: Applied to sessions this automation spawns.
        template_id:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            Create-only provenance marker; resolve ids via the templates
            endpoint. When set and tools.mcp_servers is omitted, the template's
            required_mcps apply.
          title: Template Id
        tools:
          anyOf:
            - $ref: '#/components/schemas/AutomationTools'
            - type: 'null'
        triggers:
          description: >-
            Fires when any trigger matches; once per event. At most one
            webhook:incoming trigger.
          items:
            $ref: '#/components/schemas/AutomationTriggerRequest-Input'
          title: Triggers
          type: array
      required:
        - name
        - triggers
        - actions
        - run_as
      title: AutomationCreateRequest
      type: object
    AutomationResponse:
      additionalProperties: false
      properties:
        actions:
          items:
            discriminator:
              mapping:
                message_session:
                  $ref: '#/components/schemas/AutomationMessageSessionAction'
                monitor_session:
                  $ref: '#/components/schemas/AutomationMonitorSessionAction'
                start_session:
                  $ref: '#/components/schemas/AutomationStartSessionAction-Output'
              propertyName: type
            oneOf:
              - $ref: '#/components/schemas/AutomationStartSessionAction-Output'
              - $ref: '#/components/schemas/AutomationMessageSessionAction'
              - $ref: '#/components/schemas/AutomationMonitorSessionAction'
          title: Actions
          type: array
        automation_id:
          title: Automation Id
          type: string
        concurrency:
          anyOf:
            - $ref: '#/components/schemas/AutomationConcurrency'
            - type: 'null'
        created_at:
          title: Created At
          type: integer
        created_by:
          $ref: '#/components/schemas/ActorResponse'
        enabled:
          title: Enabled
          type: boolean
        last_edited_by:
          anyOf:
            - $ref: '#/components/schemas/ActorResponse'
            - type: 'null'
        last_invocation:
          anyOf:
            - $ref: '#/components/schemas/AutomationLastInvocation'
            - type: 'null'
        limits:
          anyOf:
            - $ref: '#/components/schemas/AutomationLimits'
            - type: 'null'
        metadata:
          additionalProperties:
            type: string
          default: {}
          title: Metadata
          type: object
        name:
          title: Name
          type: string
        notifications:
          anyOf:
            - $ref: '#/components/schemas/AutomationNotifications'
            - type: 'null'
        run_as:
          description: >-
            Identity the spawned sessions run under. organization: the org's
            automation identity (the System User in the app) — sessions use
            system permissions, so MCP servers installed with a personal
            (user-scoped) connection cannot be selected, and switching an
            automation to organization removes them from its selection. creator:
            personal automation — runs with the creator's own permissions and is
            visible only to the creator and org admins; rejected for
            service-user-created automations. Required on create; null on update
            resets to organization.
          discriminator:
            mapping:
              creator:
                $ref: '#/components/schemas/AutomationRunAsCreator'
              organization:
                $ref: '#/components/schemas/AutomationRunAsOrganization'
            propertyName: type
          oneOf:
            - $ref: '#/components/schemas/AutomationRunAsOrganization'
            - $ref: '#/components/schemas/AutomationRunAsCreator'
          title: Run As
        security_profile:
          anyOf:
            - $ref: '#/components/schemas/AutomationSecurityProfileResponse'
            - type: 'null'
          description: >-
            The automation's security-profile binding and the resolved governing
            profiles. null when security profiles are not enabled for the
            organization.
        session_settings:
          anyOf:
            - $ref: '#/components/schemas/AutomationSessionSettings-Output'
            - type: 'null'
        template_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Template Id
        tools:
          anyOf:
            - $ref: '#/components/schemas/AutomationTools'
            - type: 'null'
        triggers:
          items:
            $ref: '#/components/schemas/AutomationTriggerResponse'
          title: Triggers
          type: array
        updated_at:
          title: Updated At
          type: integer
      required:
        - automation_id
        - name
        - enabled
        - triggers
        - actions
        - created_by
        - created_at
        - updated_at
      title: AutomationResponse
      type: object
    ProblemDetail:
      description: >-
        RFC 9457 application/problem+json error body for the v3 API.


        detail is retained from the legacy {"detail": ...} body for back-compat;
        the

        other members are additive. errors carries field-level validation
        failures

        (422 only).
      properties:
        detail:
          anyOf:
            - type: string
            - type: 'null'
          description: A human-readable explanation specific to this occurrence.
          title: Detail
        errors:
          anyOf:
            - items:
                additionalProperties: true
                type: object
              type: array
            - type: 'null'
          description: Field-level validation errors (422 responses only).
          title: Errors
        instance:
          anyOf:
            - type: string
            - type: 'null'
          description: A URI reference (the request path) for this occurrence.
          title: Instance
        status:
          description: The HTTP status code.
          title: Status
          type: integer
        title:
          description: A short, human-readable summary of the problem type.
          title: Title
          type: string
        type:
          default: about:blank
          description: A URI reference identifying the problem type.
          title: Type
          type: string
      required:
        - title
        - status
      title: ProblemDetail
      type: object
    AutomationMessageSessionAction:
      additionalProperties: false
      properties:
        auto_create:
          default: false
          description: >-
            When true, the first trigger creates a new long-running session
            owned by the automation and subsequent triggers message it.
          title: Auto Create
          type: boolean
        prompt:
          description: The triggering event's payload is appended automatically.
          title: Prompt
          type: string
        target_devin_id:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            Must belong to the org; editing an automation containing this action
            requires write access to the target session (enable/disable-only
            edits exempt). Required unless auto_create is true, in which case it
            is set server-side once the first trigger creates the session;
            client-supplied values are ignored.
          title: Target Devin Id
        type:
          const: message_session
          default: message_session
          title: Type
          type: string
      required:
        - prompt
      title: AutomationMessageSessionAction
      type: object
    AutomationMonitorSessionAction:
      additionalProperties: false
      properties:
        setup_prompt:
          description: >-
            Injected into the session's system prompt. Same reference-token
            grammar as prompt.
          title: Setup Prompt
          type: string
        slack_monitor_config:
          $ref: '#/components/schemas/AutomationSlackMonitorConfig'
          description: Requires exactly one slack:message trigger on the same channel.
        type:
          const: monitor_session
          default: monitor_session
          title: Type
          type: string
      required:
        - setup_prompt
        - slack_monitor_config
      title: AutomationMonitorSessionAction
      type: object
    AutomationStartSessionAction-Input:
      additionalProperties: false
      properties:
        prompt:
          description: >-
            The single source of truth: plain text with inline reference tokens
            (@{owner}/{repo}, @{path}, @playbook:{id}, @skills:{name}, !{macro},
            ${SECRET_NAME}). Kind-prefixed tokens are validated at save; unknown
            ids are a 400. The triggering event's payload is appended
            automatically.
          title: Prompt
          type: string
        session:
          $ref: '#/components/schemas/AutomationSessionConfig-Input'
          description: Config for the spawned session.
        type:
          const: start_session
          default: start_session
          title: Type
          type: string
      required:
        - prompt
      title: AutomationStartSessionAction
      type: object
    AutomationConcurrency:
      additionalProperties: false
      properties:
        max_concurrent_runs:
          anyOf:
            - minimum: 1
              type: integer
            - type: 'null'
          description: >-
            Maximum in-flight runs for this automation; further triggered events
            wait in its queue. A run stops counting toward the limit once its
            session finishes and is awaiting further instructions, not only when
            the session stops. null = unlimited.
          title: Max Concurrent Runs
        max_queue_depth:
          anyOf:
            - minimum: 0
              type: integer
            - type: 'null'
          description: >-
            Maximum triggered events waiting in the automation's queue to run;
            events beyond this are dropped. Requires max_concurrent_runs to be
            set. null = unlimited.
          title: Max Queue Depth
      title: AutomationConcurrency
      type: object
    AutomationLimits:
      additionalProperties: false
      properties:
        invocations:
          anyOf:
            - $ref: '#/components/schemas/AutomationInvocationLimits'
            - type: 'null'
          description: Rate-limits the automation's own firing.
        max_acu_limit:
          anyOf:
            - maximum: 1000
              minimum: 1
              type: integer
            - type: 'null'
          description: Per spawned session (same name as the sessions API).
          title: Max Acu Limit
      title: AutomationLimits
      type: object
    AutomationNotifications:
      additionalProperties: false
      properties:
        email:
          anyOf:
            - $ref: '#/components/schemas/AutomationEmailNotification'
            - type: 'null'
        slack:
          anyOf:
            - $ref: '#/components/schemas/AutomationSlackNotification'
            - type: 'null'
      title: AutomationNotifications
      type: object
    AutomationRunAsCreator:
      additionalProperties: false
      properties:
        type:
          const: creator
          default: creator
          title: Type
          type: string
      title: AutomationRunAsCreator
      type: object
    AutomationRunAsOrganization:
      additionalProperties: false
      properties:
        type:
          const: organization
          default: organization
          title: Type
          type: string
      title: AutomationRunAsOrganization
      type: object
    AutomationSecurityProfileSelection:
      additionalProperties: false
      description: The automation's own security-profile binding.
      properties:
        profile_id:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            Security profile to bind to this automation. null records an
            explicit opt-out (no profile, even when the org or enterprise has a
            recommended default). Writing this field requires the
            security-profile management permission; an opt-out cannot escape a
            mandatory org/enterprise profile.
          title: Profile Id
      title: AutomationSecurityProfileSelection
      type: object
    AutomationSessionSettings-Input:
      additionalProperties: false
      description: |-
        Applied to every session this automation spawns (including monitor
        sessions).
      properties:
        devin_mode:
          anyOf:
            - enum:
                - normal
                - fast
                - lite
                - ultra
                - fusion
              type: string
            - type: 'null'
          description: null = org default.
          title: Devin Mode
        net_policy:
          anyOf:
            - $ref: '#/components/schemas/AutomationNetPolicy'
            - type: 'null'
      title: AutomationSessionSettings
      type: object
    AutomationTools:
      additionalProperties: false
      properties:
        linear_enabled:
          anyOf:
            - type: boolean
            - type: 'null'
          description: Grant Linear tools.
          title: Linear Enabled
        mcp_servers:
          default: []
          description: >-
            Marketplace slugs (the slug field of the mcp-servers resource, e.g.
            'github', 'notion') enabled for spawned sessions. Servers installed
            with a personal (user-scoped) connection require run_as creator;
            selecting them with run_as organization is rejected since the
            Automations service identity has no personal token for them, and
            switching an automation's run_as to organization removes them from
            the stored selection.
          items:
            type: string
          title: Mcp Servers
          type: array
        slack_channels:
          default: []
          description: Channels the session's Slack tools may post to.
          items:
            $ref: '#/components/schemas/AutomationSlackChannel'
          title: Slack Channels
          type: array
        slack_dm_scope:
          anyOf:
            - enum:
                - org_members
                - workspace
              type: string
            - type: 'null'
          description: >-
            Allow spawned sessions to open 1:1 Slack DMs in the organization's
            connected workspaces. 'org_members' (enterprise accounts only)
            restricts DM targets to members of the organization; 'workspace'
            (non-enterprise accounts only) allows any eligible workspace member.
            Omit or null to disable DMs.
          title: Slack Dm Scope
      title: AutomationTools
      type: object
    AutomationTriggerRequest-Input:
      additionalProperties: false
      properties:
        conditions:
          anyOf:
            - $ref: '#/components/schemas/AutomationConditions-Input'
            - type: 'null'
          description: null matches every event.
        event_type:
          description: Trigger event type, e.g. 'github:pull_request'.
          enum:
            - github:issue_comment
            - github:issues
            - github:pull_request
            - github:pull_request_review
            - github:pull_request_review_comment
            - github:check_run
            - github:push
            - gitlab:merge_request
            - gitlab:note
            - gitlab:issue
            - gitlab:issue_note
            - gitlab:push
            - gitlab:pipeline
            - schedule:recurring
            - slack:message
            - slack:reaction_added
            - linear:create
            - linear:label_added
            - linear:assigned
            - linear:status_changed
            - linear:priority_changed
            - linear:moved
            - jira:issue_created
            - jira:label_added
            - jira:status_changed
            - jira:assigned
            - pylon:issue_created
            - pylon:issue_tag_added
            - pylon:issue_status_changed
            - incident_io:incident_created
            - incident_io:status_changed
            - incident_io:severity_changed
            - incident_io:follow_up_created
            - webhook:incoming
            - snapshot_build:completed
          title: Event Type
          type: string
        replies:
          default: []
          description: >-
            Where this trigger's session binds and its response is delivered.
            Only the matched trigger's replies execute, all entries
            independently; entries are deduplicated.
          items:
            $ref: '#/components/schemas/AutomationReply'
          title: Replies
          type: array
      required:
        - event_type
      title: AutomationTriggerRequest
      type: object
    AutomationStartSessionAction-Output:
      additionalProperties: false
      properties:
        prompt:
          description: >-
            The single source of truth: plain text with inline reference tokens
            (@{owner}/{repo}, @{path}, @playbook:{id}, @skills:{name}, !{macro},
            ${SECRET_NAME}). Kind-prefixed tokens are validated at save; unknown
            ids are a 400. The triggering event's payload is appended
            automatically.
          title: Prompt
          type: string
        session:
          $ref: '#/components/schemas/AutomationSessionConfig-Output'
          description: Config for the spawned session.
        type:
          const: start_session
          default: start_session
          title: Type
          type: string
      required:
        - prompt
      title: AutomationStartSessionAction
      type: object
    ActorResponse:
      description: A user or service-user principal attributed to an action or resource.
      properties:
        id:
          description: User id or service-user id.
          title: Id
          type: string
        name:
          anyOf:
            - type: string
            - type: 'null'
          description: Display name, resolved server-side; null when deleted.
          title: Name
        type:
          description: Kind of principal.
          enum:
            - user
            - service_user
          title: Type
          type: string
      required:
        - type
        - id
      title: ActorResponse
      type: object
    AutomationLastInvocation:
      additionalProperties: false
      properties:
        fired_at:
          title: Fired At
          type: integer
        status:
          description: >-
            succeeded | failed | skipped — open enum, clients must tolerate new
            values.
          title: Status
          type: string
      required:
        - fired_at
        - status
      title: AutomationLastInvocation
      type: object
    AutomationSecurityProfileResponse:
      additionalProperties: false
      properties:
        profile_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Profile Id
        selection:
          description: >-
            The automation's own binding: inherit (no binding), none (explicit
            opt-out), or profile (pins profile_id). Sessions resolve the full
            enterprise -> org -> automation chain: the automation's network
            policy only ever narrows the governing profiles' policies, and an
            opt-out cannot escape a mandatory org/enterprise profile.
          enum:
            - inherit
            - none
            - profile
          title: Selection
          type: string
        warnings:
          default: []
          description: >-
            Non-blocking configuration conflicts, e.g. a recommended MCP server
            whose endpoint hostname the governing profile blocks (spawned
            sessions will not be able to connect to that server). Only remote
            MCP endpoint hostnames are checked; an empty list does not guarantee
            every MCP or network destination will work. Populated on
            single-automation reads and writes; empty in list responses.
          items:
            type: string
          title: Warnings
          type: array
      required:
        - selection
      title: AutomationSecurityProfileResponse
      type: object
    AutomationSessionSettings-Output:
      additionalProperties: false
      description: |-
        Applied to every session this automation spawns (including monitor
        sessions).
      properties:
        devin_mode:
          anyOf:
            - enum:
                - normal
                - fast
                - lite
                - ultra
                - fusion
              type: string
            - type: 'null'
          description: null = org default.
          title: Devin Mode
        net_policy:
          anyOf:
            - $ref: '#/components/schemas/AutomationNetPolicy'
            - type: 'null'
      title: AutomationSessionSettings
      type: object
    AutomationTriggerResponse:
      additionalProperties: false
      properties:
        conditions:
          anyOf:
            - $ref: '#/components/schemas/AutomationConditions-Output'
            - type: 'null'
        event_type:
          title: Event Type
          type: string
        replies:
          default: []
          items:
            $ref: '#/components/schemas/AutomationReply'
          title: Replies
          type: array
        trigger_id:
          description: Re-minted when triggers is replaced — not stable across edits.
          title: Trigger Id
          type: string
        webhook:
          anyOf:
            - $ref: '#/components/schemas/AutomationWebhookResponse'
            - type: 'null'
          description: Only on webhook:incoming triggers.
      required:
        - trigger_id
        - event_type
      title: AutomationTriggerResponse
      type: object
    AutomationSlackMonitorConfig:
      additionalProperties: false
      properties:
        source_channel_id:
          title: Source Channel Id
          type: string
        team_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Team Id
      required:
        - source_channel_id
      title: AutomationSlackMonitorConfig
      type: object
    AutomationSessionConfig-Input:
      additionalProperties: false
      properties:
        bypass_approval:
          default: false
          description: >-
            Auto-approves child-session creation (the only check this flag
            bypasses); any future bypassable check requires a new field.
          title: Bypass Approval
          type: boolean
        notifications:
          anyOf:
            - $ref: '#/components/schemas/AutomationSessionNotificationsConfig'
            - type: 'null'
          description: Session-content notifications (currently Slack only).
        platform:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            VM platform for the session. When null, the session uses the
            organization's default platform at invocation time.
          title: Platform
        playbook_id:
          anyOf:
            - type: string
            - type: 'null'
          description: 'Read-only: derived from the first @playbook: token in the prompt.'
          title: Playbook Id
        repos:
          default: []
          description: 'Read-only: derived from repo tokens in the prompt.'
          items:
            type: string
          title: Repos
          type: array
        tags:
          default: []
          description: >-
            Session tags. For tagging-enforced enterprises exactly one allowed
            value is required.
          items:
            type: string
          title: Tags
          type: array
      title: AutomationSessionConfig
      type: object
    AutomationInvocationLimits:
      additionalProperties: false
      properties:
        max_per_window:
          minimum: 1
          title: Max Per Window
          type: integer
        window_seconds:
          minimum: 60
          title: Window Seconds
          type: integer
      required:
        - max_per_window
        - window_seconds
      title: AutomationInvocationLimits
      type: object
    AutomationEmailNotification:
      additionalProperties: false
      properties:
        recipients:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          description: >-
            null = the automation creator; required for service-user-created
            automations.
          title: Recipients
        when:
          enum:
            - always
            - dispatch_failed
            - dispatch_succeeded
          title: When
          type: string
      required:
        - when
      title: AutomationEmailNotification
      type: object
    AutomationSlackNotification:
      additionalProperties: false
      properties:
        channel_id:
          title: Channel Id
          type: string
        when:
          enum:
            - always
            - dispatch_failed
            - dispatch_succeeded
          title: When
          type: string
      required:
        - when
        - channel_id
      title: AutomationSlackNotification
      type: object
    AutomationNetPolicy:
      additionalProperties: false
      properties:
        allow:
          items:
            anyOf:
              - $ref: '#/components/schemas/AutomationHostnameDestination'
              - $ref: '#/components/schemas/AutomationIpv4Destination'
              - $ref: '#/components/schemas/AutomationIpv6Destination'
          title: Allow
          type: array
      required:
        - allow
      title: AutomationNetPolicy
      type: object
    AutomationSlackChannel:
      additionalProperties: false
      properties:
        channel_id:
          title: Channel Id
          type: string
        team_id:
          title: Team Id
          type: string
      required:
        - team_id
        - channel_id
      title: AutomationSlackChannel
      type: object
    AutomationConditions-Input:
      additionalProperties: false
      properties:
        any:
          description: OR of AND-groups (fixed two-level DNF).
          items:
            $ref: '#/components/schemas/AutomationConditionGroup'
          title: Any
          type: array
      required:
        - any
      title: AutomationConditions
      type: object
    AutomationReply:
      additionalProperties: false
      properties:
        type:
          description: >-
            notify_thread: dispatch-time one-way 'session started' breadcrumb in
            the triggering thread (Slack triggers). attach_thread: dispatch-time
            two-way binding to the triggering thread (Slack triggers).
            post_response: deliver the agent's response to the triggering
            context.
          enum:
            - notify_thread
            - attach_thread
            - post_response
          title: Type
          type: string
      required:
        - type
      title: AutomationReply
      type: object
    AutomationSessionConfig-Output:
      additionalProperties: false
      properties:
        bypass_approval:
          default: false
          description: >-
            Auto-approves child-session creation (the only check this flag
            bypasses); any future bypassable check requires a new field.
          title: Bypass Approval
          type: boolean
        notifications:
          anyOf:
            - $ref: '#/components/schemas/AutomationSessionNotificationsConfig'
            - type: 'null'
          description: Session-content notifications (currently Slack only).
        platform:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            VM platform for the session. When null, the session uses the
            organization's default platform at invocation time.
          title: Platform
        playbook_id:
          anyOf:
            - type: string
            - type: 'null'
          description: 'Read-only: derived from the first @playbook: token in the prompt.'
          title: Playbook Id
        repos:
          default: []
          description: 'Read-only: derived from repo tokens in the prompt.'
          items:
            type: string
          title: Repos
          type: array
        tags:
          default: []
          description: >-
            Session tags. For tagging-enforced enterprises exactly one allowed
            value is required.
          items:
            type: string
          title: Tags
          type: array
      title: AutomationSessionConfig
      type: object
    AutomationConditions-Output:
      additionalProperties: false
      properties:
        any:
          description: OR of AND-groups (fixed two-level DNF).
          items:
            $ref: '#/components/schemas/AutomationConditionGroup'
          title: Any
          type: array
      required:
        - any
      title: AutomationConditions
      type: object
    AutomationWebhookResponse:
      additionalProperties: false
      properties:
        secret:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            Present only when newly minted (create or re-add); never retrievable
            again. Replacing triggers preserves the existing secret.
          title: Secret
        url:
          description: The inbox external systems POST to (header X-Webhook-Secret).
          title: Url
          type: string
      required:
        - url
      title: AutomationWebhookResponse
      type: object
    AutomationSessionNotificationsConfig:
      additionalProperties: false
      description: |-
        Where the spawned session's content goes, as opposed to the
        automation-level ``notifications`` group (dispatch-status pings).
      properties:
        slack:
          anyOf:
            - $ref: '#/components/schemas/AutomationSessionSlackConfig'
            - type: 'null'
          description: >-
            Gives the session a Slack home: two-way for
            post_updates/forward_thread and post_response after its initial
            delivery binds the thread.
      title: AutomationSessionNotificationsConfig
      type: object
    AutomationHostnameDestination:
      additionalProperties: false
      properties:
        hostname:
          title: Hostname
          type: string
      required:
        - hostname
      title: AutomationHostnameDestination
      type: object
    AutomationIpv4Destination:
      additionalProperties: false
      properties:
        ipv4:
          title: Ipv4
          type: string
      required:
        - ipv4
      title: AutomationIpv4Destination
      type: object
    AutomationIpv6Destination:
      additionalProperties: false
      properties:
        ipv6:
          title: Ipv6
          type: string
      required:
        - ipv6
      title: AutomationIpv6Destination
      type: object
    AutomationConditionGroup:
      additionalProperties: false
      properties:
        all:
          description: 'AND: every condition in the group must match.'
          items:
            discriminator:
              mapping:
                between:
                  $ref: '#/components/schemas/AutomationRangeCondition'
                contains:
                  $ref: '#/components/schemas/AutomationStringCondition'
                ends_with:
                  $ref: '#/components/schemas/AutomationStringCondition'
                eq:
                  $ref: '#/components/schemas/AutomationComparisonCondition'
                globs:
                  $ref: '#/components/schemas/AutomationGlobCondition'
                gt:
                  $ref: '#/components/schemas/AutomationNumericCondition'
                gte:
                  $ref: '#/components/schemas/AutomationNumericCondition'
                in:
                  $ref: '#/components/schemas/AutomationListCondition'
                is_empty:
                  $ref: '#/components/schemas/AutomationEmptyCondition'
                is_not_empty:
                  $ref: '#/components/schemas/AutomationEmptyCondition'
                lt:
                  $ref: '#/components/schemas/AutomationNumericCondition'
                lte:
                  $ref: '#/components/schemas/AutomationNumericCondition'
                matches:
                  $ref: '#/components/schemas/AutomationMatchCondition'
                neq:
                  $ref: '#/components/schemas/AutomationComparisonCondition'
                not_contains:
                  $ref: '#/components/schemas/AutomationStringCondition'
                not_ends_with:
                  $ref: '#/components/schemas/AutomationStringCondition'
                not_globs:
                  $ref: '#/components/schemas/AutomationGlobCondition'
                not_in:
                  $ref: '#/components/schemas/AutomationListCondition'
                not_matches:
                  $ref: '#/components/schemas/AutomationMatchCondition'
                not_starts_with:
                  $ref: '#/components/schemas/AutomationStringCondition'
                recurrence:
                  $ref: '#/components/schemas/AutomationRecurrenceCondition'
                starts_with:
                  $ref: '#/components/schemas/AutomationStringCondition'
              propertyName: operator
            oneOf:
              - $ref: '#/components/schemas/AutomationComparisonCondition'
              - $ref: '#/components/schemas/AutomationStringCondition'
              - $ref: '#/components/schemas/AutomationNumericCondition'
              - $ref: '#/components/schemas/AutomationEmptyCondition'
              - $ref: '#/components/schemas/AutomationRangeCondition'
              - $ref: '#/components/schemas/AutomationListCondition'
              - $ref: '#/components/schemas/AutomationMatchCondition'
              - $ref: '#/components/schemas/AutomationRecurrenceCondition'
              - $ref: '#/components/schemas/AutomationGlobCondition'
          title: All
          type: array
      required:
        - all
      title: AutomationConditionGroup
      type: object
    AutomationSessionSlackConfig:
      additionalProperties: false
      properties:
        channel_id:
          title: Channel Id
          type: string
        mode:
          description: >-
            post_updates: the session converses in a thread in the channel
            (available for non-Slack triggers). forward_thread: the same, plus a
            backlink posted in the triggering thread (requires a Slack trigger).
            post_response: the session's final response is posted to the channel
            as a top-level message, then its thread is bound for replies and
            follow-up messages (available for any trigger).
          enum:
            - post_updates
            - forward_thread
            - post_response
          title: Mode
          type: string
      required:
        - mode
        - channel_id
      title: AutomationSessionSlackConfig
      type: object
    AutomationRangeCondition:
      additionalProperties: false
      properties:
        field:
          title: Field
          type: string
        operator:
          const: between
          title: Operator
          type: string
        value:
          description: Inclusive [low, high] range.
          maxItems: 2
          minItems: 2
          prefixItems:
            - anyOf:
                - type: integer
                - type: number
            - anyOf:
                - type: integer
                - type: number
          title: Value
          type: array
      required:
        - field
        - operator
        - value
      title: AutomationRangeCondition
      type: object
    AutomationStringCondition:
      additionalProperties: false
      properties:
        field:
          title: Field
          type: string
        operator:
          enum:
            - contains
            - not_contains
            - starts_with
            - not_starts_with
            - ends_with
            - not_ends_with
          title: Operator
          type: string
        value:
          title: Value
          type: string
      required:
        - field
        - operator
        - value
      title: AutomationStringCondition
      type: object
    AutomationComparisonCondition:
      additionalProperties: false
      properties:
        field:
          title: Field
          type: string
        operator:
          enum:
            - eq
            - neq
          title: Operator
          type: string
        value:
          anyOf:
            - type: string
            - type: integer
            - type: number
            - type: boolean
          title: Value
      required:
        - field
        - operator
        - value
      title: AutomationComparisonCondition
      type: object
    AutomationGlobCondition:
      additionalProperties: false
      properties:
        field:
          title: Field
          type: string
        operator:
          enum:
            - globs
            - not_globs
          title: Operator
          type: string
        value:
          description: Glob patterns; any changed path matches (github:push, gitlab:push).
          items:
            type: string
          title: Value
          type: array
      required:
        - field
        - operator
        - value
      title: AutomationGlobCondition
      type: object
    AutomationNumericCondition:
      additionalProperties: false
      properties:
        field:
          title: Field
          type: string
        operator:
          enum:
            - gt
            - lt
            - gte
            - lte
          title: Operator
          type: string
        value:
          anyOf:
            - type: integer
            - type: number
          title: Value
      required:
        - field
        - operator
        - value
      title: AutomationNumericCondition
      type: object
    AutomationListCondition:
      additionalProperties: false
      properties:
        field:
          title: Field
          type: string
        operator:
          enum:
            - in
            - not_in
          title: Operator
          type: string
        value:
          items:
            type: string
          title: Value
          type: array
      required:
        - field
        - operator
        - value
      title: AutomationListCondition
      type: object
    AutomationEmptyCondition:
      additionalProperties: false
      description: >-
        Unary operator: matches on the field's emptiness; `value` carries no
        data.
      properties:
        field:
          title: Field
          type: string
        operator:
          enum:
            - is_empty
            - is_not_empty
          title: Operator
          type: string
        value:
          title: Value
          type: 'null'
      required:
        - field
        - operator
      title: AutomationEmptyCondition
      type: object
    AutomationMatchCondition:
      additionalProperties: false
      properties:
        field:
          title: Field
          type: string
        operator:
          enum:
            - matches
            - not_matches
          title: Operator
          type: string
        value:
          description: Regular expression.
          title: Value
          type: string
      required:
        - field
        - operator
        - value
      title: AutomationMatchCondition
      type: object
    AutomationRecurrenceCondition:
      additionalProperties: false
      properties:
        field:
          title: Field
          type: string
        operator:
          const: recurrence
          title: Operator
          type: string
        value:
          description: >-
            iCalendar RRULE for schedule:recurring's rrule field, e.g.
            FREQ=WEEKLY;BYDAY=MO;BYHOUR=9;BYMINUTE=0
          title: Value
          type: string
      required:
        - field
        - operator
        - value
      title: AutomationRecurrenceCondition
      type: object
  securitySchemes:
    bearerAuth:
      description: 'Service User credential (prefix: cog_)'
      scheme: bearer
      type: http

````