Registers a provider profile for a configuration home on this node's execution environment; the homes are validated on the server and must already exist.

POST

/v1/m/sessions/provider-profiles

curl --request POST \
  --url https://example.com/v1/m/sessions/provider-profiles \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "auth_source": "", "config_home": "example", "display_name": "example", "driver": "example", "environment_ref": "example", "provider_record_ref": "example", "session_egress_hosts": [ "example" ], "session_programs": [ "example" ], "session_registries": [ { "kind": "npm", "scope": "example", "secret": "example", "url": "example" } ], "session_work_grant": { "capabilities": [ "work.read" ], "role": "orchestrator", "workspace_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0" }, "user_home": "example" }'

• this engine

Registers a provider profile for a configuration home on this node’s execution environment; the homes are validated on the server and must already exist.

Authorizations

• bearerAuth
• browserSession

Parameters

Header Parameters

X-Olivares-Tenant

string format: uuid

Target tenant id; required when the principal can act in more than one tenant.

Request Body ^required

Media type application/json

object

auth_source

Any of:

string

Authorized authentication source for this profile: provider_account_home (the child uses the saved login inside its own homes) or managed_injection (a provider-compatible credential minted by that driver’s governed adapter). They are distinct authorizations with no fallback between them; empty authorizes neither and refuses every launch whose driver requires one.

string

Allowed values: "" provider_account_home managed_injection

null

null

config_home

required

Absolute path of the provider configuration directory on this node; symlinks are resolved and the canonical path is stored.

string

>= 1 characters

display_name

Any of:

string

Editable label; trimmed, at most 200 bytes, no control characters.

string

null

null

driver

required

Provider driver key, lower-cased ([a-z0-9][a-z0-9._-]*). Open set; only drivers with an operated runner on this node are launchable.

string

>= 1 characters

environment_ref

Any of:

string

Optional; when present must equal this node’s execution environment (a foreign environment cannot have its homes validated here).

string

null

null

provider_record_ref

Any of:

string

Optional: the registered provider whose credential this profile’s managed launches use. Empty binds no registered provider; auth_source still governs how launches authenticate. The engine refuses a credential whose kind this driver cannot read.

string

null

null

session_egress_hosts

Any of:

Array<string>

HTTPS hosts a confined session may reach beside its bound provider (a Git host, a module mirror); none by default. Each is admitted only at public addresses, whatever its name resolves to. Declaring hosts needs tenant administration and is recorded in the audit ledger. On PATCH, [] withdraws the declaration and null or omission keeps it.

Array<string>

<= 4 items

null

null

session_programs

Any of:

Array<string>

Installed third-party programs (the tool installer’s program names) put first on each session’s PATH. A launch whose program is not installed is refused 409. Declaring programs needs tenant administration. On PATCH, [] withdraws the declaration and null or omission keeps it.

Array<string>

<= 16 items

null

null

session_registries

Any of:

Array<object>

Npm registries each native session installs from. The token travels in a per-launch npm configuration file, never in the environment or argv, and a confined session’s network reaches the registry hosts. Declaring registries needs tenant administration. On PATCH, [] withdraws the declaration and null or omission keeps it.

Array<object>

<= 8 items

object

kind

required

string

Allowed values: npm

scope

An npm scope (@name) routed to this registry; empty makes it the default registry, one per profile.

string

secret

The tenant vault secret (env/…) holding the registry token. Empty sends none.

string

url

required

The registry’s base URL: https, or http on a loopback host.

string

>= 1 characters

null

null

session_work_grant

Any of:

object

object

capabilities

required

Array<string>

>= 1 items <= 6 items unique items

Allowed values: work.read work.create work.assign work.review decision.read decision.write

role

required

string

Allowed values: orchestrator

workspace_id

required

One active tenant workspace; UUIDv7.

string format: uuid

null

null

user_home

required

Absolute path used as HOME for the launched process; validated like config_home.

string

>= 1 characters

Responses

200

OK

Media type application/json

object

Example ^generated

{}

400

Bad request

Media type application/json

object

Example ^generated

{}

401

Unauthenticated

Media type application/json

object

Example ^generated

{}

403

Forbidden

Media type application/json

object

Example ^generated

{}

404

Not found

Media type application/json

object

Example ^generated

{}

409

Conflict / setup required

Media type application/json

object

Example ^generated

{}

429

Rate limited

Media type application/json

object

Example ^generated

{}