Renames a provider profile and/or moves it between active and disabled; driver, environment and homes are immutable and retirement has its own route.

PATCH

/v1/m/sessions/provider-profiles/{ref}

curl --request PATCH \
  --url https://example.com/v1/m/sessions/provider-profiles/example \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "auth_source": "", "display_name": "example", "provider_record_ref": "example", "session_egress_hosts": [ "example" ], "session_programs": [ "example" ], "session_registries": [ { "kind": "npm", "scope": "example", "secret": "example", "url": "example" } ], "session_work_grant": { "capabilities": [ "work.read" ], "role": "orchestrator", "workspace_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0" }, "state": "active" }'

• this engine

Renames a provider profile and/or moves it between active and disabled; driver, environment and homes are immutable and retirement has its own route.

Authorizations

• bearerAuth
• browserSession

Parameters

Path Parameters

ref

required

string

Path parameter ref.

Header Parameters

X-Olivares-Tenant

string format: uuid

Target tenant id; required when the principal can act in more than one tenant.

Request Body ^required

Media type application/json

object

auth_source

Any of:

string

Re-authorizes (or, with the empty string, withdraws) the authentication source. It is not identity, so it does not create a new profile id; a live child keeps the source its own launch was authorized under.

string

Allowed values: "" provider_account_home managed_injection

null

null

display_name

Any of:

string

An explicit string replaces the stored label; null/omission preserves it.

string

null

null

provider_record_ref

Any of:

string

Binds (or, with the empty string, unbinds) the registered provider this profile’s managed launches use. Like auth_source it is an authorization and not identity, and it does not reach a live child: a running session keeps the provider its own launch resolved.

string

null

null

session_egress_hosts

Any of:

Array<string>

HTTPS hosts a confined session may reach beside its bound provider (a Git host, a module mirror); none by default. Each is admitted only at public addresses, whatever its name resolves to. Declaring hosts needs tenant administration and is recorded in the audit ledger. On PATCH, [] withdraws the declaration and null or omission keeps it.

Array<string>

<= 4 items

null

null

session_programs

Any of:

Array<string>

Installed third-party programs (the tool installer’s program names) put first on each session’s PATH. A launch whose program is not installed is refused 409. Declaring programs needs tenant administration. On PATCH, [] withdraws the declaration and null or omission keeps it.

Array<string>

<= 16 items

null

null

session_registries

Any of:

Array<object>

Npm registries each native session installs from. The token travels in a per-launch npm configuration file, never in the environment or argv, and a confined session’s network reaches the registry hosts. Declaring registries needs tenant administration. On PATCH, [] withdraws the declaration and null or omission keeps it.

Array<object>

<= 8 items

object

kind

required

string

Allowed values: npm

scope

An npm scope (@name) routed to this registry; empty makes it the default registry, one per profile.

string

secret

The tenant vault secret (env/…) holding the registry token. Empty sends none.

string

url

required

The registry’s base URL: https, or http on a loopback host.

string

>= 1 characters

null

null

session_work_grant

Any of:

object

object

capabilities

required

Array<string>

>= 1 items <= 6 items unique items

Allowed values: work.read work.create work.assign work.review decision.read decision.write

role

required

string

Allowed values: orchestrator

workspace_id

required

One active tenant workspace; UUIDv7.

string format: uuid

null

null

state

Any of:

string

Reversible lifecycle transition; retired is refused here.

string

Allowed values: active disabled

null

null

Responses

200

OK

Media type application/json

object

Example ^generated

{}

400

Bad request

Media type application/json

object

Example ^generated

{}

401

Unauthenticated

Media type application/json

object

Example ^generated

{}

403

Forbidden

Media type application/json

object

Example ^generated

{}

404

Not found

Media type application/json

object

Example ^generated

{}

409

Conflict / setup required

Media type application/json

object

Example ^generated

{}

429

Rate limited

Media type application/json

object

Example ^generated

{}