Compute

Run governed outbound work for your organisation: prepared, parameterised HTTP Collections and one-off generic HTTP calls, all bounded by a layered egress allow-list and Vault credential indirection so secrets are resolved server-side and never exposed to the caller. Functions (managed serverless handlers) and a Browser family are coming soon.

Base URL/api/v1/compute

Automation triggers: view every Compute event, payload field, and predicate.

Collection Folders

Organisational containers for collections. Creating a folder mints a federated zone in IAM (registered under org/{company_id}/collection-folder/{id}), and the creator receives the folder's permission bundle. CRUD over the folder; child collections are created through the folder.

POST/api/v1/compute/collection-folders

Create Collection Folder

Create a collection folder. This is an org-border operation that mints the folder zone and grants the creator the folder bundle.

Bearer <token> + X-Company-Id header required. Permission: compute:collection-folders:create (on org/{company_id})

Request Body

Name	Type	Description
`name`*	string	Display name
`description`	string \| null	Optional description

Response Fields

Name	Type	Description
`id`*	string	Folder ID
`company_id`*	string	Owning company ID
`name`*	string	Display name
`description`*	string \| null	Description, or null

curl -X POST https://platform.ergondata.ai/api/v1/compute/collection-folders \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "External APIs",
    "description": "Outbound integrations for the billing domain"
  }'

Response

201 Created

{
  "id": "cf0a1b2c-3d4e-4f50-8617-2839abcd0011",
  "company_id": "c0ffee00-cafe-babe-dead-beefcafebabe",
  "name": "External APIs",
  "description": "Outbound integrations for the billing domain"
}

GET/api/v1/compute/collection-folders

List Collection Folders

List the collection folders for the company. Results are filtered by view access.

Bearer <token> + X-Company-Id header required. Filtered by compute:collection-folders:view

Response Fields

Name	Type	Description
`[]`*	CollectionFolder[]	Folders the caller may view

curl https://platform.ergondata.ai/api/v1/compute/collection-folders \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

[
  {
    "id": "cf0a1b2c-3d4e-4f50-8617-2839abcd0011",
    "company_id": "c0ffee00-cafe-babe-dead-beefcafebabe",
    "name": "External APIs",
    "description": "Outbound integrations for the billing domain"
  }
]

GET/api/v1/compute/collection-folders/{folder_id}

Get Collection Folder

Retrieve a single collection folder by ID.

Bearer <token> + X-Company-Id header required. Permission: compute:collection-folders:view (on the folder)

Path Parameters

Name	Type	Description
`folder_id`*	string	Folder ID

Response Fields

Name	Type	Description
`id`*	string	Folder ID
`company_id`*	string	Company ID
`name`*	string	Display name
`description`*	string \| null	Description, or null

curl https://platform.ergondata.ai/api/v1/compute/collection-folders/{folder_id} \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{
  "id": "cf0a1b2c-3d4e-4f50-8617-2839abcd0011",
  "company_id": "c0ffee00-cafe-babe-dead-beefcafebabe",
  "name": "External APIs",
  "description": "Outbound integrations for the billing domain"
}

PATCH/api/v1/compute/collection-folders/{folder_id}

Update Collection Folder

Update a folder's name or description. Only provided fields are changed.

Bearer <token> + X-Company-Id header required. Permission: compute:collection-folders:manage (on the folder)

Path Parameters

Name	Type	Description
`folder_id`*	string	Folder ID

Request Body

Name	Type	Description
`name`	string	New display name
`description`	string	New description

Response Fields

Name	Type	Description
`id`*	string	Folder ID
`company_id`*	string	Company ID
`name`*	string	Display name
`description`*	string \| null	Description, or null

curl -X PATCH https://platform.ergondata.ai/api/v1/compute/collection-folders/{folder_id} \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}" \
  -H "Content-Type: application/json" \
  -d '{"description": "Billing + payments integrations"}'

Response

200 OK

{
  "id": "cf0a1b2c-3d4e-4f50-8617-2839abcd0011",
  "company_id": "c0ffee00-cafe-babe-dead-beefcafebabe",
  "name": "External APIs",
  "description": "Billing + payments integrations"
}

DELETE/api/v1/compute/collection-folders/{folder_id}

Delete Collection Folder

Delete a folder and cascade-delete its collections and requests. Also soft-deletes the zone in IAM.

Bearer <token> + X-Company-Id header required. Permission: compute:collection-folders:delete (on the folder)

Path Parameters

Name	Type	Description
`folder_id`*	string	Folder ID

curl -X DELETE https://platform.ergondata.ai/api/v1/compute/collection-folders/{folder_id} \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

204 No Content

Collections

A collection is a federated zone holding shared config — base URL, variables, default headers, an auth strategy — plus the Vault credential references its requests may use. A collection references a Vault credential by {namespace, credential} only; it never stores a secret value. The collection is the zone you grant on to cover all of its requests.

POST/api/v1/compute/collection-folders/{folder_id}/collections

Create Collection

Create a collection inside a folder. The collection becomes its own zone; the creator receives the collection bundle. Provide base config, an optional auth_strategy, and credential_refs (references only).

Bearer <token> + X-Company-Id header required. Permission: compute:collection-folders:collections:create (on the folder)

Path Parameters

Name	Type	Description
`folder_id`*	string	Parent folder ID

Request Body

Name	Type	Description
`name`*	string	Display name
`description`	string \| null	Optional description
`base_url`	string \| null	Base URL prepended to each request path. Pins the host for egress.
`variables`	object	Collection-level variables referenced as {{vars.*}}Default: `{}`
`default_headers`	object	Headers applied to every request unless overriddenDefault: `{}`
`auth_strategy`	object \| null	How calls authenticate: {kind, credential_ref?, pre_request_request_id?}. kind ∈ none, header_token, basic, bearer, oauth2, custom.
`credential_refs`	CredentialRef[]	Vault references this collection may resolve — references only, never valuesDefault: `[]`

Response Fields

Name	Type	Description
`id`*	string	Collection ID
`company_id`*	string	Company ID
`folder_id`*	string	Parent folder ID
`name`*	string	Display name
`description`*	string \| null	Description, or null
`base_url`*	string \| null	Base URL, or null
`variables`*	object	Collection variables
`default_headers`*	object	Default headers
`auth_strategy`*	object \| null	Auth strategy, or null
`credential_refs`*	CredentialRef[]	Vault references (references only)
`principal_id`*	string \| null	The collection's own IAM principal, minted lazily on first Vault connect. Null until then.

curl -X POST https://platform.ergondata.ai/api/v1/compute/collection-folders/{folder_id}/collections \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Stripe",
    "base_url": "https://api.stripe.com",
    "default_headers": {"Accept": "application/json"},
    "auth_strategy": {
      "kind": "bearer",
      "credential_ref": {"namespace": "payments", "credential": "stripe_secret_key"}
    },
    "credential_refs": [{"namespace": "payments", "credential": "stripe_secret_key"}]
  }'

Response

201 Created

{
  "id": "c1a2b3c4-d5e6-4f70-8901-23456789abcd",
  "company_id": "c0ffee00-cafe-babe-dead-beefcafebabe",
  "folder_id": "cf0a1b2c-3d4e-4f50-8617-2839abcd0011",
  "name": "Stripe",
  "description": null,
  "base_url": "https://api.stripe.com",
  "variables": {},
  "default_headers": {"Accept": "application/json"},
  "auth_strategy": {
    "kind": "bearer",
    "credential_ref": {"namespace": "payments", "credential": "stripe_secret_key"}
  },
  "credential_refs": [{"namespace": "payments", "credential": "stripe_secret_key"}],
  "principal_id": null
}

GET/api/v1/compute/collections

List Collections

List the company's collections. Results are filtered by view access.

Bearer <token> + X-Company-Id header required. Filtered by compute:collections:view

Response Fields

Name	Type	Description
`[]`*	Collection[]	Collections the caller may view (same shape as Get Collection)

curl https://platform.ergondata.ai/api/v1/compute/collections \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

[
  {
    "id": "c1a2b3c4-d5e6-4f70-8901-23456789abcd",
    "company_id": "c0ffee00-cafe-babe-dead-beefcafebabe",
    "folder_id": "cf0a1b2c-3d4e-4f50-8617-2839abcd0011",
    "name": "Stripe",
    "description": null,
    "base_url": "https://api.stripe.com",
    "variables": {},
    "default_headers": {"Accept": "application/json"},
    "auth_strategy": {"kind": "bearer", "credential_ref": {"namespace": "payments", "credential": "stripe_secret_key"}},
    "credential_refs": [{"namespace": "payments", "credential": "stripe_secret_key"}],
    "principal_id": null
  }
]

GET/api/v1/compute/collections/{collection_id}

Get Collection

Retrieve a single collection by ID, including its config and credential references.

Bearer <token> + X-Company-Id header required. Permission: compute:collections:view (on the collection)

Path Parameters

Name	Type	Description
`collection_id`*	string	Collection ID

Response Fields

Name	Type	Description
`id`*	string	Collection ID
`company_id`*	string	Company ID
`folder_id`*	string	Parent folder ID
`name`*	string	Display name
`description`*	string \| null	Description, or null
`base_url`*	string \| null	Base URL, or null
`variables`*	object	Collection variables
`default_headers`*	object	Default headers
`auth_strategy`*	object \| null	Auth strategy, or null
`credential_refs`*	CredentialRef[]	Vault references (references only, never values)
`principal_id`*	string \| null	The collection's IAM principal, or null until first Vault connect

curl https://platform.ergondata.ai/api/v1/compute/collections/{collection_id} \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{
  "id": "c1a2b3c4-d5e6-4f70-8901-23456789abcd",
  "company_id": "c0ffee00-cafe-babe-dead-beefcafebabe",
  "folder_id": "cf0a1b2c-3d4e-4f50-8617-2839abcd0011",
  "name": "Stripe",
  "description": null,
  "base_url": "https://api.stripe.com",
  "variables": {"api_version": "2024-06-20"},
  "default_headers": {"Accept": "application/json"},
  "auth_strategy": {"kind": "bearer", "credential_ref": {"namespace": "payments", "credential": "stripe_secret_key"}},
  "credential_refs": [{"namespace": "payments", "credential": "stripe_secret_key"}],
  "principal_id": "a9b8c7d6-0000-4000-8000-000000000777"
}

PATCH/api/v1/compute/collections/{collection_id}

Update Collection

Update config, auth strategy, or credential references. Only provided fields are changed. Updating credential_refs adjusts which Vault credentials the collection's principal may resolve (still references only).

Bearer <token> + X-Company-Id header required. Permission: compute:collections:manage (on the collection)

Path Parameters

Name	Type	Description
`collection_id`*	string	Collection ID

Request Body

Name	Type	Description
`name`	string	New name
`description`	string	New description
`base_url`	string	New base URL
`variables`	object	Replace collection variables
`default_headers`	object	Replace default headers
`auth_strategy`	object	Replace the auth strategy
`credential_refs`	CredentialRef[]	Replace the Vault credential references (references only)

Response Fields

Name	Type	Description
`Collection`*	object	The updated collection (same shape as Get Collection)

curl -X PATCH https://platform.ergondata.ai/api/v1/compute/collections/{collection_id} \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}" \
  -H "Content-Type: application/json" \
  -d '{"variables": {"api_version": "2024-06-20"}}'

Response

200 OK

{
  "id": "c1a2b3c4-d5e6-4f70-8901-23456789abcd",
  "company_id": "c0ffee00-cafe-babe-dead-beefcafebabe",
  "folder_id": "cf0a1b2c-3d4e-4f50-8617-2839abcd0011",
  "name": "Stripe",
  "description": null,
  "base_url": "https://api.stripe.com",
  "variables": {"api_version": "2024-06-20"},
  "default_headers": {"Accept": "application/json"},
  "auth_strategy": {"kind": "bearer", "credential_ref": {"namespace": "payments", "credential": "stripe_secret_key"}},
  "credential_refs": [{"namespace": "payments", "credential": "stripe_secret_key"}],
  "principal_id": "a9b8c7d6-0000-4000-8000-000000000777"
}

DELETE/api/v1/compute/collections/{collection_id}

Delete Collection

Delete a collection and cascade-delete its requests. Also soft-deletes the zone in IAM.

Bearer <token> + X-Company-Id header required. Permission: compute:collections:delete (on the collection)

Path Parameters

Name	Type	Description
`collection_id`*	string	Collection ID

curl -X DELETE https://platform.ergondata.ai/api/v1/compute/collections/{collection_id} \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

204 No Content

GET/api/v1/compute/companies/{company_id}/collection-prefs

Get Collection Preferences

Return the caller's per-user collection-tree preferences — the favorite collection and custom drag order shown in the sidebar tree. Personal UI state (not an IAM resource): requires a user token and is scoped to the path company.

Bearer <token> + X-Company-Id header required. Requires a user token (personal UI state — no IAM permission).

Path Parameters

Name	Type	Description
`company_id`*	string (UUID)	Organization ID

Response Fields

Name	Type	Description
`favorite_collection_id`	string (UUID) \| null	Pinned favorite collection, or null
`collection_order`	array<UUID>	The caller's collection display order (collections missing here fall back to API order)

curl https://platform.ergondata.ai/api/v1/compute/companies/{company_id}/collection-prefs \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{
  "favorite_collection_id": "c1a2b3c4-d5e6-4f70-8901-23456789abcd",
  "collection_order": ["c1a2b3c4-d5e6-4f70-8901-23456789abcd"]
}

PUT/api/v1/compute/companies/{company_id}/collection-prefs

Update Collection Preferences

Update the caller's favorite collection and/or collection ordering. Only provided fields are changed. Personal UI state — requires a user token.

Bearer <token> + X-Company-Id header required. Requires a user token (personal UI state — no IAM permission).

Path Parameters

Name	Type	Description
`company_id`*	string (UUID)	Organization ID

Request Body

Name	Type	Description
`favorite_collection_id`	string (UUID) \| null	Pin a favorite collection, or null to clear it
`collection_order`	array<UUID>	Replace the collection display order

Response Fields

Name	Type	Description
`favorite_collection_id`	string (UUID) \| null	Pinned favorite collection, or null
`collection_order`	array<UUID>	The caller's collection display order

curl -X PUT https://platform.ergondata.ai/api/v1/compute/companies/{company_id}/collection-prefs \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}" \
  -H "Content-Type: application/json" \
  -d '{"favorite_collection_id": "c1a2b3c4-d5e6-4f70-8901-23456789abcd", "collection_order": ["c1a2b3c4-d5e6-4f70-8901-23456789abcd"]}'

Response

200 OK

{
  "favorite_collection_id": "c1a2b3c4-d5e6-4f70-8901-23456789abcd",
  "collection_order": ["c1a2b3c4-d5e6-4f70-8901-23456789abcd"]
}

Requests

A request is a single prepared call — the leaf of a collection. It carries a method, path, headers, query, body, and a params_schema for caller-filled, non-secret inputs. Invoking runs the request on the shared outbound engine. Credential indirection applies: the collection's own principal resolves the Vault secret, the caller never holds it, and the response is redacted.

POST/api/v1/compute/collections/{collection_id}/requests

Create Request

Create a request in a collection. kind is rest (default) or graphql; for graphql the method is forced to POST. path is appended to the collection base_url and may template {{vars.*}} and {{params.*}}.

Bearer <token> + X-Company-Id header required. Permission: compute:collections:requests:create (on the collection)

Path Parameters

Name	Type	Description
`collection_id`*	string	Collection ID

Request Body

Name	Type	Description
`name`*	string	Display name
`kind`	string	rest or graphqlDefault: `rest`
`method`*	string	GET, POST, PUT, PATCH, or DELETE (forced to POST for graphql)
`path`*	string	Path appended to base_url; may template {{vars.}} / {{params.}}
`headers`	object	Per-request headersDefault: `{}`
`query`	object	Query-string templateDefault: `{}`
`body`	any \| null	Body template; for graphql: {query, variables}
`params_schema`	object \| null	JSON Schema for the caller-filled parameters. Becomes the tool's args_schema.
`response_schema`	object \| null	JSON Schema describing the response
`expose_as_tool`	boolean	When true, registers a row in IAM's tools table for this requestDefault: `false`

Response Fields

Name	Type	Description
`id`*	string	Request ID
`company_id`*	string	Company ID
`collection_id`*	string	Parent collection ID
`name`*	string	Display name
`kind`*	string	rest or graphql
`method`*	string	HTTP method
`path`*	string	Path template
`headers`*	object	Per-request headers
`query`*	object	Query template
`body`*	any \| null	Body template, or null
`params_schema`*	object \| null	Params JSON Schema, or null
`response_schema`*	object \| null	Response JSON Schema, or null
`expose_as_tool`*	boolean	Whether registered as a tool

curl -X POST https://platform.ergondata.ai/api/v1/compute/collections/{collection_id}/requests \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Get invoice",
    "kind": "rest",
    "method": "GET",
    "path": "/v1/invoices/{{params.invoice_id}}",
    "headers": {"Accept": "application/json"},
    "params_schema": {
      "type": "object",
      "required": ["invoice_id"],
      "properties": {"invoice_id": {"type": "string"}}
    },
    "expose_as_tool": true
  }'

Response

201 Created

{
  "id": "r1234567-89ab-4cde-f012-3456789abcde",
  "company_id": "c0ffee00-cafe-babe-dead-beefcafebabe",
  "collection_id": "c1a2b3c4-d5e6-4f70-8901-23456789abcd",
  "name": "Get invoice",
  "kind": "rest",
  "method": "GET",
  "path": "/v1/invoices/{{params.invoice_id}}",
  "headers": {"Accept": "application/json"},
  "query": {},
  "body": null,
  "params_schema": {
    "type": "object",
    "required": ["invoice_id"],
    "properties": {"invoice_id": {"type": "string"}}
  },
  "response_schema": null,
  "expose_as_tool": true
}

GET/api/v1/compute/collections/{collection_id}/requests

List Requests

List the requests in a collection.

Bearer <token> + X-Company-Id header required. Permission: compute:collections:view (on the collection)

Path Parameters

Name	Type	Description
`collection_id`*	string	Collection ID

Response Fields

Name	Type	Description
`[]`*	Request[]	Requests in the collection (same shape as Get Request)

curl https://platform.ergondata.ai/api/v1/compute/collections/{collection_id}/requests \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

[
  {
    "id": "r1234567-89ab-4cde-f012-3456789abcde",
    "company_id": "c0ffee00-cafe-babe-dead-beefcafebabe",
    "collection_id": "c1a2b3c4-d5e6-4f70-8901-23456789abcd",
    "name": "Get invoice",
    "kind": "rest",
    "method": "GET",
    "path": "/v1/invoices/{{params.invoice_id}}",
    "headers": {"Accept": "application/json"},
    "query": {},
    "body": null,
    "params_schema": {"type": "object", "required": ["invoice_id"], "properties": {"invoice_id": {"type": "string"}}},
    "response_schema": null,
    "expose_as_tool": true
  }
]

GET/api/v1/compute/collections/{collection_id}/requests/{request_id}

Get Request

Retrieve a single request by ID.

Bearer <token> + X-Company-Id header required. Permission: compute:collections:view (on the collection)

Path Parameters

Name	Type	Description
`collection_id`*	string	Collection ID
`request_id`*	string	Request ID

Response Fields

Name	Type	Description
`Request`*	object	The request (id, name, kind, method, path, headers, query, body, params_schema, response_schema, expose_as_tool)

curl https://platform.ergondata.ai/api/v1/compute/collections/{collection_id}/requests/{request_id} \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{
  "id": "r1234567-89ab-4cde-f012-3456789abcde",
  "company_id": "c0ffee00-cafe-babe-dead-beefcafebabe",
  "collection_id": "c1a2b3c4-d5e6-4f70-8901-23456789abcd",
  "name": "Get invoice",
  "kind": "rest",
  "method": "GET",
  "path": "/v1/invoices/{{params.invoice_id}}",
  "headers": {"Accept": "application/json"},
  "query": {},
  "body": null,
  "params_schema": {"type": "object", "required": ["invoice_id"], "properties": {"invoice_id": {"type": "string"}}},
  "response_schema": null,
  "expose_as_tool": true
}

PATCH/api/v1/compute/collections/{collection_id}/requests/{request_id}

Update Request

Edit a request. Only provided fields are changed.

Bearer <token> + X-Company-Id header required. Permission: compute:collections:requests:edit (on the request)

Path Parameters

Name	Type	Description
`collection_id`*	string	Collection ID
`request_id`*	string	Request ID

Request Body

Name	Type	Description
`name`	string	New name
`kind`	string	rest or graphql
`method`	string	New HTTP method
`path`	string	New path template
`headers`	object	Replace headers
`query`	object	Replace query template
`body`	any	Replace body template
`params_schema`	object	Replace params schema
`response_schema`	object	Replace response schema
`expose_as_tool`	boolean	Toggle tool registration

Response Fields

Name	Type	Description
`Request`*	object	The updated request

curl -X PATCH https://platform.ergondata.ai/api/v1/compute/collections/{collection_id}/requests/{request_id} \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}" \
  -H "Content-Type: application/json" \
  -d '{"name": "Get invoice by ID"}'

Response

200 OK

{
  "id": "r1234567-89ab-4cde-f012-3456789abcde",
  "company_id": "c0ffee00-cafe-babe-dead-beefcafebabe",
  "collection_id": "c1a2b3c4-d5e6-4f70-8901-23456789abcd",
  "name": "Get invoice by ID",
  "kind": "rest",
  "method": "GET",
  "path": "/v1/invoices/{{params.invoice_id}}",
  "headers": {"Accept": "application/json"},
  "query": {},
  "body": null,
  "params_schema": {"type": "object", "required": ["invoice_id"], "properties": {"invoice_id": {"type": "string"}}},
  "response_schema": null,
  "expose_as_tool": true
}

DELETE/api/v1/compute/collections/{collection_id}/requests/{request_id}

Delete Request

Delete a request.

Bearer <token> + X-Company-Id header required. Permission: compute:collections:requests:delete (on the request)

Path Parameters

Name	Type	Description
`collection_id`*	string	Collection ID
`request_id`*	string	Request ID

curl -X DELETE https://platform.ergondata.ai/api/v1/compute/collections/{collection_id}/requests/{request_id} \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

204 No Content

POST/api/v1/compute/collections/{collection_id}/requests/{request_id}/invoke

Invoke Request

Run the request with caller-supplied, non-secret params (validated against params_schema and rendered into the final call). Credential indirection: when the collection has an auth strategy and a credential reference, Compute resolves the Vault secret as the collection's own principal and redacts it — the caller never holds it and needs no Vault permission. The rendered target is bounded by the layered egress allow-list.

Bearer <token> + X-Company-Id header required. Permission: compute:collections:requests:invoke (on the request or collection)

Path Parameters

Name	Type	Description
`collection_id`*	string	Collection ID
`request_id`*	string	Request ID

Request Body

Name	Type	Description
`params`	object	Non-secret, invoke-time inputs validated against the request's params_schemaDefault: `{}`

Response Fields

Name	Type	Description
`invocation_id`*	string	Invocation audit row ID
`status`*	string	queued, running, succeeded, failed, or cancelled
`response`	object \| null	The upstream response (status, headers, body), with any secrets redacted
`failure_kind`	string \| null	egress_denied, credential_denied, upstream_error, timeout, handler_error, or internal — on failure
`failure_message`	string \| null	Human-readable failure detail, or null

curl -X POST https://platform.ergondata.ai/api/v1/compute/collections/{collection_id}/requests/{request_id}/invoke \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}" \
  -H "Content-Type: application/json" \
  -d '{"params": {"invoice_id": "in_1MqABCdef"}}'

Response

200 OK

{
  "invocation_id": "inv_01h2x3y4-5678-4abc-9012-3456789abcde",
  "status": "succeeded",
  "response": {
    "status": 200,
    "headers": {"content-type": "application/json"},
    "body": {"id": "in_1MqABCdef", "amount_due": 4200, "currency": "usd", "status": "paid"}
  },
  "failure_kind": null,
  "failure_message": null
}

Generic HTTP

A collection-less, org-scoped one-off outbound call — the governed home for the legacy automations.http action. Gated by the org-border capability compute:http:request (a consumer-granted capability toggled on the agent/automation that will hold it, never offered from the global IAM drawer). Unlike collection requests, there is no credential indirection: when credential_ref is set the calling principal itself must hold vault:credentials:use. Resolution is still server-side and redacted.

POST/api/v1/compute/http/request

Generic HTTP Request

Make a one-off outbound HTTP call with a full {method, url, headers, query, body} and an optional Vault credential_ref. Org-scoped, so it needs only service access + the org permission — no connection, no collection. Subject to the same layered egress guardrails as collection requests; the caller's own principal scopes the per-principal (Layer-2) egress policy.

Bearer <token> + X-Company-Id header required. Permission: compute:http:request (on org/{company_id})

Request Body

Name	Type	Description
`method`*	string	HTTP method (GET, POST, …)
`url`*	string	Absolute target URL
`headers`	object	Request headersDefault: `{}`
`query`	object	Query-string parametersDefault: `{}`
`body`	any \| null	Request body
`credential_ref`	CredentialRef \| null	Optional Vault reference {namespace, credential}. When set, the CALLING principal must itself hold vault:credentials:use (no indirection).
`auth_strategy`	object \| null	How to apply the resolved credential (inferred from the Vault credential type when omitted)

Response Fields

Name	Type	Description
`invocation_id`*	string	Invocation audit row ID
`status`*	string	queued, running, succeeded, failed, or cancelled
`response`	object \| null	The upstream response (status, headers, body), with any secrets redacted
`failure_kind`	string \| null	egress_denied, credential_denied, upstream_error, timeout, handler_error, or internal
`failure_message`	string \| null	Failure detail, or null

curl -X POST https://platform.ergondata.ai/api/v1/compute/http/request \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}" \
  -H "Content-Type: application/json" \
  -d '{
    "method": "GET",
    "url": "https://api.example.com/v1/status",
    "headers": {"Accept": "application/json"},
    "credential_ref": {"namespace": "integrations", "credential": "example_api_key"}
  }'

Response

200 OK

{
  "invocation_id": "inv_02a1b2c3-4d5e-4f60-8901-23456789abcd",
  "status": "succeeded",
  "response": {
    "status": 200,
    "headers": {"content-type": "application/json"},
    "body": {"ok": true, "region": "us-east-1"}
  },
  "failure_kind": null,
  "failure_message": null
}

Egress Policies

The configurable layers of the outbound allow-list behind compute:http:request and collection requests. A hardcoded platform floor (deny private/loopback/link-local/reserved, including the cloud metadata endpoint 169.254.169.254) is always on, not configurable, and has no endpoint. Above it sits the company allow-list (deny by default), and an optional per-principal subset for a specific agent/automation. A target is allowed only if every applicable layer permits it.

GET/api/v1/compute/egress/company-policy

Get Company Egress Policy

Read the company (Layer-1) egress policy. Default state is disabled / allow-none — out of the box no outbound call succeeds past the platform floor.

Bearer <token> + X-Company-Id header required. Permission: compute:egress:view (on org/{company_id})

Response Fields

Name	Type	Description
`company_id`*	string	Company ID
`enabled`*	boolean	When false, no target passes Layer 1 (deny-all)
`allow_hosts`*	string[]	Hostname / suffix allow-list, or ["*"] for all public hosts (still subject to the floor)

curl https://platform.ergondata.ai/api/v1/compute/egress/company-policy \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{
  "company_id": "c0ffee00-cafe-babe-dead-beefcafebabe",
  "enabled": true,
  "allow_hosts": ["api.stripe.com", "*.example.com"]
}

PUT/api/v1/compute/egress/company-policy

Set Company Egress Policy

Enable/disable company egress and set the hostname allow-list. The allow-list may be specific hosts/suffixes or ["*"] for all public hosts (still subject to the platform floor). This is company-wide config — the superset every principal draws from.

Bearer <token> + X-Company-Id header required. Permission: compute:egress:manage (on org/{company_id})

Request Body

Name	Type	Description
`enabled`*	boolean	Enable or disable company egress
`allow_hosts`	string[]	Hostname / suffix allow-list, or ["*"] for all public hostsDefault: `[]`

Response Fields

Name	Type	Description
`company_id`*	string	Company ID
`enabled`*	boolean	Whether egress is enabled
`allow_hosts`*	string[]	The stored allow-list

curl -X PUT https://platform.ergondata.ai/api/v1/compute/egress/company-policy \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}" \
  -H "Content-Type: application/json" \
  -d '{"enabled": true, "allow_hosts": ["api.stripe.com", "*.example.com"]}'

Response

200 OK

{
  "company_id": "c0ffee00-cafe-babe-dead-beefcafebabe",
  "enabled": true,
  "allow_hosts": ["api.stripe.com", "*.example.com"]
}

GET/api/v1/compute/egress/principal-policies/{principal_id}

Get Principal Egress Policy

Read a consumer's per-principal (Layer-2) allow-list. If no policy exists, the principal inherits the company policy as-is.

Bearer <token> + X-Company-Id header required. Permission: compute:egress:view (on org/{company_id})

Path Parameters

Name	Type	Description
`principal_id`*	string	The agent / automation principal that holds the capability

Response Fields

Name	Type	Description
`company_id`*	string	Company ID
`principal_id`*	string	Consumer principal ID
`principal_type`*	string	agent, automation, or service
`allow_hosts`*	string[]	Subset of the company allow-list; empty when no policy is stored

curl https://platform.ergondata.ai/api/v1/compute/egress/principal-policies/{principal_id} \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{
  "company_id": "c0ffee00-cafe-babe-dead-beefcafebabe",
  "principal_id": "a9b8c7d6-0000-4000-8000-000000000777",
  "principal_type": "agent",
  "allow_hosts": ["api.stripe.com"]
}

PUT/api/v1/compute/egress/principal-policies/{principal_id}

Set Principal Egress Policy

Set a consumer's per-principal allow-list. The list is intersected with the company policy at save time — entries the company list would not permit are dropped, so a per-principal policy can only ever narrow Layer 1, never widen it.

Bearer <token> + X-Company-Id header required. Permission: compute:egress:manage (on org/{company_id})

Path Parameters

Name	Type	Description
`principal_id`*	string	Consumer principal ID

Request Body

Name	Type	Description
`principal_type`*	string	agent, automation, or service
`allow_hosts`	string[]	Requested subset of the company allow-list (intersected at save)Default: `[]`

Response Fields

Name	Type	Description
`company_id`*	string	Company ID
`principal_id`*	string	Consumer principal ID
`principal_type`*	string	agent, automation, or service
`allow_hosts`*	string[]	The effective stored allow-list after intersecting with the company policy

curl -X PUT https://platform.ergondata.ai/api/v1/compute/egress/principal-policies/{principal_id} \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}" \
  -H "Content-Type: application/json" \
  -d '{"principal_type": "agent", "allow_hosts": ["api.stripe.com"]}'

Response

200 OK

{
  "company_id": "c0ffee00-cafe-babe-dead-beefcafebabe",
  "principal_id": "a9b8c7d6-0000-4000-8000-000000000777",
  "principal_type": "agent",
  "allow_hosts": ["api.stripe.com"]
}

Invocations

The audit read surface for every call Compute makes — generic HTTP, collection request, or function. Each row records status, timing, egress records, and which credential references were resolved (references only, never values). Secrets are redacted at write time, so these read endpoints surface no credential material.

GET/api/v1/compute/invocations

List Invocations

List invocations for the company, most recent first, with optional filters by status and target kind.

Bearer <token> + X-Company-Id header required. Permission: compute:activity:view (on org/{company_id})

Query Parameters

Name	Type	Description
`status`	string	Filter by status: queued, running, succeeded, failed, cancelled
`target_kind`	string	Filter by target kind: http, request, function
`limit`	integer	Results to return (≤ 200)Default: `50`

Response Fields

Name	Type	Description
`[]`*	Invocation[]	Matching invocations (same shape as Get Invocation)

curl "https://platform.ergondata.ai/api/v1/compute/invocations?target_kind=request&status=succeeded&limit=20" \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

[
  {
    "id": "inv_01h2x3y4-5678-4abc-9012-3456789abcde",
    "company_id": "c0ffee00-cafe-babe-dead-beefcafebabe",
    "target_kind": "request",
    "request_id": "r1234567-89ab-4cde-f012-3456789abcde",
    "function_id": null,
    "trigger_kind": "api",
    "status": "succeeded",
    "failure_kind": null,
    "failure_message": null,
    "egress_records": [{"host": "api.stripe.com", "status": 200, "bytes_out": 312, "bytes_in": 1840}],
    "used_credential_refs": [{"namespace": "payments", "credential": "stripe_secret_key"}],
    "duration_ms": 412,
    "output_digest": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
    "queued_at": "2026-04-14T10:30:00Z",
    "started_at": "2026-04-14T10:30:00Z",
    "finished_at": "2026-04-14T10:30:00.412Z"
  }
]

GET/api/v1/compute/invocations/{invocation_id}

Get Invocation

Retrieve a single invocation by ID, including status, output reference, egress records, and resolved credential references.

Bearer <token> + X-Company-Id header required. Permission: compute:activity:view (on org/{company_id})

Path Parameters

Name	Type	Description
`invocation_id`*	string	Invocation ID

Response Fields

Name	Type	Description
`id`*	string	Invocation ID
`company_id`*	string	Company ID
`target_kind`*	string	http, request, or function
`request_id`*	string \| null	Request ID when target_kind=request
`function_id`*	string \| null	Function ID when target_kind=function
`trigger_kind`*	string	api, agent_tool, automation, app_action, or internal
`status`*	string	queued, running, succeeded, failed, or cancelled
`failure_kind`*	string \| null	egress_denied, credential_denied, upstream_error, timeout, handler_error, or internal
`failure_message`*	string \| null	Failure detail, or null
`egress_records`*	object[] \| null	Per-call egress records: [{host, status, bytes_out, bytes_in}]
`used_credential_refs`*	CredentialRef[] \| null	Which Vault references were resolved — references only, never values
`duration_ms`*	integer \| null	Duration in milliseconds, or null
`output_digest`*	string \| null	SHA-256 of the output, or null
`queued_at`*	string (ISO 8601)	When queued
`started_at`*	string (ISO 8601) \| null	When started, or null
`finished_at`*	string (ISO 8601) \| null	When finished, or null

curl https://platform.ergondata.ai/api/v1/compute/invocations/{invocation_id} \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{
  "id": "inv_01h2x3y4-5678-4abc-9012-3456789abcde",
  "company_id": "c0ffee00-cafe-babe-dead-beefcafebabe",
  "target_kind": "request",
  "request_id": "r1234567-89ab-4cde-f012-3456789abcde",
  "function_id": null,
  "trigger_kind": "api",
  "status": "succeeded",
  "failure_kind": null,
  "failure_message": null,
  "egress_records": [{"host": "api.stripe.com", "status": 200, "bytes_out": 312, "bytes_in": 1840}],
  "used_credential_refs": [{"namespace": "payments", "credential": "stripe_secret_key"}],
  "duration_ms": 412,
  "output_digest": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
  "queued_at": "2026-04-14T10:30:00Z",
  "started_at": "2026-04-14T10:30:00Z",
  "finished_at": "2026-04-14T10:30:00.412Z"
}

GET/api/v1/compute/invocations/{invocation_id}/logs

Get Invocation Logs

Retrieve the stored logs for an invocation. Secrets are redacted at write time, so no credential material is surfaced. Streaming of out-of-row logs from object storage lands with later blob support; until then the log_blob_ref is returned with an empty logs array.

Bearer <token> + X-Company-Id header required. Permission: compute:activity:view (on org/{company_id})

Path Parameters

Name	Type	Description
`invocation_id`*	string	Invocation ID

Response Fields

Name	Type	Description
`invocation_id`*	string	Invocation ID
`log_blob_ref`*	string \| null	Out-of-row log reference, or null
`logs`*	object[]	Inline log lines (empty until blob streaming ships); secrets redacted

curl https://platform.ergondata.ai/api/v1/compute/invocations/{invocation_id}/logs \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{
  "invocation_id": "inv_01h2x3y4-5678-4abc-9012-3456789abcde",
  "log_blob_ref": null,
  "logs": []
}

Access & Connections

The shared per-zone Access surface — the backend for the Security tab. Every federated zone (collection-folder, collection, and the preview function-folder, function) exposes /{zone}/{id}/access/* with an identical shape: grant management (eligible principals, resource-types, grants), the connection-request approver inbox, and the active inbound connections list. Storage and lifecycle live in IAM; Compute proxies, gated by compute:permissions:<zone>:manage. The examples below use the collection zone; substitute the zone prefix for folders or functions.

POST/api/v1/compute/collections/{collection_id}/access/grants

Create Access Grant

Grant a principal a permission on the zone (or a leaf scoped beneath it). The resource defaults to the zone and must be scoped within it; the permission must be grantable at this zone (e.g. compute:collections:requests:invoke on a collection).

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:collections:manage (on the collection)

Path Parameters

Name	Type	Description
`collection_id`*	string	Collection (zone) ID

Request Body

Name	Type	Description
`principal_type`*	string	member, api_key, agent, automation, workflow, team, or role
`principal_id`*	string	Principal to grant to
`permission_id`*	string	IAM permission ID to grant
`resource`	string \| null	Resource path; defaults to the zone. Must be scoped within the zone — append /request/{request_id} to scope a grant to a single request (the governed leaf) instead of the whole collection.
`effect`	string	allow or denyDefault: `allow`

Response Fields

Name	Type	Description
`id`*	string	Grant ID
`permission_id`*	string	Granted permission ID
`name`*	string	Permission name
`resource`*	string	Resource the grant applies to
`effect`*	string	allow or deny
`is_system`*	boolean	Whether the grant is system-managed
`granted_at`*	string (ISO 8601)	When granted

curl -X POST https://platform.ergondata.ai/api/v1/compute/collections/{collection_id}/access/grants \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}" \
  -H "Content-Type: application/json" \
  -d '{
    "principal_type": "agent",
    "principal_id": "{agent_principal_id}",
    "permission_id": "{permission_id}",
    "effect": "allow"
  }'

Response

201 Created

{
  "id": "g1234567-89ab-4cde-f012-3456789abcde",
  "permission_id": "p1234567-89ab-4cde-f012-3456789abcde",
  "name": "compute:collections:requests:invoke",
  "resource": "org/c0ffee00-cafe-babe-dead-beefcafebabe/collection-folder/cf0a1b2c-3d4e-4f50-8617-2839abcd0011/collection/c1a2b3c4-d5e6-4f70-8901-23456789abcd",
  "effect": "allow",
  "is_system": false,
  "granted_at": "2026-04-14T10:30:00Z"
}

GET/api/v1/compute/collections/{collection_id}/access/connection-requests

List Connection Requests

The approver inbox: incoming connection requests targeting this zone, which the zone admin approves or rejects (approve via .../connection-requests/{request_id}/approve, reject via .../reject).

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:collections:manage (on the collection)

Path Parameters

Name	Type	Description
`collection_id`*	string	Collection (zone) ID

Query Parameters

Name	Type	Description
`status`	string	Filter by request statusDefault: `pending`

Response Fields

Name	Type	Description
`[]`*	ConnectionRequest[]	Connection requests targeting this zone

curl "https://platform.ergondata.ai/api/v1/compute/collections/{collection_id}/access/connection-requests?status=pending" \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

[
  {
    "id": "cr123456-789a-4bcd-ef01-23456789abcd",
    "principal_id": "a9b8c7d6-0000-4000-8000-000000000777",
    "principal_label": "Billing Assistant",
    "direction": "inbound",
    "target_service": "compute",
    "target_resource": "org/c0ffee00-cafe-babe-dead-beefcafebabe/collection-folder/cf0a1b2c-3d4e-4f50-8617-2839abcd0011/collection/c1a2b3c4-d5e6-4f70-8901-23456789abcd",
    "requested_permissions": ["compute:collections:requests:invoke"],
    "message": "Needs to invoke the Get invoice request",
    "status": "pending",
    "created_at": "2026-04-14T10:25:00Z"
  }
]

POST/api/v1/compute/collections/{collection_id}/access/connection-requests/{request_id}/approve

Approve Connection Request

Approve an incoming connection request, optionally granting a subset of the requested permissions. Only permissions grantable at this zone are allowed.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:collections:manage (on the collection)

Path Parameters

Name	Type	Description
`collection_id`*	string	Collection (zone) ID
`request_id`*	string	Connection request ID

Request Body

Name	Type	Description
`permissions`	string[] \| null	Permissions to grant; defaults to the requested set
`grant`	boolean	Whether to issue the grant on approvalDefault: `true`
`label`	string \| null	Optional connection label

Response Fields

Name	Type	Description
`id`*	string	Request ID
`status`*	string	approved
`connection_id`	string \| null	The created connection ID
`decided_by`	string \| null	Approving principal
`decided_at`	string (ISO 8601) \| null	When decided

curl -X POST https://platform.ergondata.ai/api/v1/compute/collections/{collection_id}/access/connection-requests/{request_id}/approve \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}" \
  -H "Content-Type: application/json" \
  -d '{"permissions": ["compute:collections:requests:invoke"], "grant": true}'

Response

200 OK

{
  "id": "cr123456-789a-4bcd-ef01-23456789abcd",
  "principal_id": "a9b8c7d6-0000-4000-8000-000000000777",
  "target_service": "compute",
  "target_resource": "org/c0ffee00-cafe-babe-dead-beefcafebabe/collection-folder/cf0a1b2c-3d4e-4f50-8617-2839abcd0011/collection/c1a2b3c4-d5e6-4f70-8901-23456789abcd",
  "status": "approved",
  "connection_id": "cx987654-3210-4fed-cba9-87654321fedc",
  "decided_by": "u9000000-0000-4000-8000-000000000001",
  "decided_at": "2026-04-14T10:31:00Z",
  "created_at": "2026-04-14T10:25:00Z"
}

GET/api/v1/compute/collections/{collection_id}/access/connections

List Inbound Connections

List the active connections wired into this zone — each enriched with the connected principal, who established the bridge, who originally requested it, and when. This is the owning-side connections surface; revoke a connection via DELETE .../access/connections/{connection_id}.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:collections:manage (on the collection)

Path Parameters

Name	Type	Description
`collection_id`*	string	Collection (zone) ID

Response Fields

Name	Type	Description
`[]`*	InboundConnection[]	Active connections into the zone

curl https://platform.ergondata.ai/api/v1/compute/collections/{collection_id}/access/connections \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

[
  {
    "id": "cx987654-3210-4fed-cba9-87654321fedc",
    "principal_id": "a9b8c7d6-0000-4000-8000-000000000777",
    "principal_type": "agent",
    "principal_label": "Billing Assistant",
    "target_service": "compute",
    "target_resource": "org/c0ffee00-cafe-babe-dead-beefcafebabe/collection-folder/cf0a1b2c-3d4e-4f50-8617-2839abcd0011/collection/c1a2b3c4-d5e6-4f70-8901-23456789abcd",
    "label": "Billing Assistant → Stripe",
    "created_at": "2026-04-14T10:31:00Z",
    "created_by": "u9000000-0000-4000-8000-000000000001",
    "requested_by": "a9b8c7d6-0000-4000-8000-000000000777"
  }
]

Batch Access Grants

These JWT and X-Company-Id routes accept BatchCreateGrantsRequest and return ordered BatchCreateGrantsResponse partial-success envelopes. Operations expand as resources × permission_ids with a hard limit of 200 expanded grants. HTTP 200 may contain failures; `already_exists` is an idempotent success, so retrying the whole request or failed index/client_ref entries is safe. A side-effect error means the primary grant succeeded and only the follow-up needs reconciliation; it does not indicate rollback.

POST/api/v1/compute/collection-folders/access/grants/batch

Batch Create Collection Folder Grants

Create grants across collection-folder roots with independent preflight and partial success. Agent ToolDef slug: `compute.collection_folder_access.create_grants_batch`.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:collection-folders:manage on every concrete collection-folder root.

Request Body

Name	Type	Description
`operations`*	BatchGrantOperation[]	One or more grouped operations; maximum 200 expanded grants

Response Fields

Name	Type	Description
`results`*	BatchGrantResult[]	Ordered results with index, client_ref, status, principal, permission_id, canonical resource, effect, grant, error_status/error_detail, and side_effect_error_status/side_effect_error_detail
`summary`*	object	created, already_exists, and failed counts

curl -X POST https://platform.ergondata.ai/api/v1/compute/collection-folders/access/grants/batch \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}" \
  -H "Content-Type: application/json" \
  -d '{"operations":[{"client_ref":"folder-access","principal_type":"member","principal_id":"{principal_id}","resources":["org/{company_id}/collection-folder/{folder_id}"],"permission_ids":["{permission_id}"],"effect":"allow"}]}'

Response

200 OK

{
  "results": [{
    "index": 0, "client_ref": "folder-access", "status": "created",
    "principal_type": "member", "principal_id": "{principal_id}",
    "permission_id": "{permission_id}", "resource": "org/{company_id}/collection-folder/{folder_id}",
    "effect": "allow", "grant": {}, "error_status": null, "error_detail": null,
    "side_effect_error_status": null, "side_effect_error_detail": null
  }],
  "summary": { "created": 1, "already_exists": 0, "failed": 0 }
}

POST/api/v1/compute/collections/access/grants/batch

Batch Create Collection Grants

Create grants across collection roots with the same ≤200 expansion, partial-success, retry, and side-effect semantics. Agent ToolDef slug: `compute.collection_access.create_grants_batch`.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:collections:manage on every concrete collection root.

Request Body

Name	Type	Description
`operations`*	BatchGrantOperation[]	BatchCreateGrantsRequest operations: client_ref, principal_type/id, resources, permission_ids, and effect

Response Fields

Name	Type	Description
`results`*	BatchGrantResult[]	Ordered partial-success results with primary and side-effect errors
`summary`*	object	created, already_exists, and failed counts

curl -X POST https://platform.ergondata.ai/api/v1/compute/collections/access/grants/batch \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}" \
  -H "Content-Type: application/json" \
  -d '{"operations":[{"principal_type":"agent","principal_id":"{principal_id}","resources":["org/{company_id}/collection-folder/{folder_id}/collection/{collection_id}"],"permission_ids":["{permission_id}"]}]}'

Response

200 OK

{
  "results": [{ "index": 0, "client_ref": null, "status": "already_exists", "principal_type": "agent", "principal_id": "{principal_id}", "permission_id": "{permission_id}", "resource": "{collection_resource}", "effect": "allow", "grant": {}, "error_status": null, "error_detail": null, "side_effect_error_status": null, "side_effect_error_detail": null }],
  "summary": { "created": 0, "already_exists": 1, "failed": 0 }
}

POST/api/v1/compute/function-folders/access/grants/batch

Batch Create Function Folder Grants

Create grants across function-folder roots with the same ≤200 expansion, partial-success, retry, and side-effect semantics. Agent ToolDef slug: `compute.function_folder_access.create_grants_batch`.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:function-folders:manage on every concrete function-folder root.

Request Body

Name	Type	Description
`operations`*	BatchGrantOperation[]	BatchCreateGrantsRequest operations: client_ref, principal_type/id, resources, permission_ids, and effect

Response Fields

Name	Type	Description
`results`*	BatchGrantResult[]	Ordered partial-success results with primary and side-effect errors
`summary`*	object	created, already_exists, and failed counts

curl -X POST https://platform.ergondata.ai/api/v1/compute/function-folders/access/grants/batch \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}" \
  -H "Content-Type: application/json" \
  -d '{"operations":[{"principal_type":"workflow","principal_id":"{principal_id}","resources":["org/{company_id}/function-folder/{folder_id}"],"permission_ids":["{permission_id}"]}]}'

Response

200 OK

{
  "results": [{ "index": 0, "client_ref": null, "status": "created", "principal_type": "workflow", "principal_id": "{principal_id}", "permission_id": "{permission_id}", "resource": "{function_folder_resource}", "effect": "allow", "grant": {}, "error_status": null, "error_detail": null, "side_effect_error_status": null, "side_effect_error_detail": null }],
  "summary": { "created": 1, "already_exists": 0, "failed": 0 }
}

POST/api/v1/compute/functions/access/grants/batch

Batch Create Function Grants

Create grants across function roots with the same ≤200 expansion, partial-success, retry, and side-effect semantics. Agent ToolDef slug: `compute.function_access.create_grants_batch`.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:functions:manage on every concrete function root.

Request Body

Name	Type	Description
`operations`*	BatchGrantOperation[]	BatchCreateGrantsRequest operations: client_ref, principal_type/id, resources, permission_ids, and effect

Response Fields

Name	Type	Description
`results`*	BatchGrantResult[]	Ordered partial-success results with primary and side-effect errors
`summary`*	object	created, already_exists, and failed counts

curl -X POST https://platform.ergondata.ai/api/v1/compute/functions/access/grants/batch \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}" \
  -H "Content-Type: application/json" \
  -d '{"operations":[{"principal_type":"automation","principal_id":"{principal_id}","resources":["org/{company_id}/function-folder/{folder_id}/function/{function_id}"],"permission_ids":["{permission_id}"]}]}'

Response

200 OK

{
  "results": [{ "index": 0, "client_ref": null, "status": "failed", "principal_type": "automation", "principal_id": "{principal_id}", "permission_id": "{permission_id}", "resource": "{function_resource}", "effect": "allow", "grant": null, "error_status": 403, "error_detail": "Permission denied", "side_effect_error_status": null, "side_effect_error_detail": null }],
  "summary": { "created": 0, "already_exists": 0, "failed": 1 }
}

Access Route Matrix

The remaining per-zone access operations for collection folders, collections, function folders, and functions. Every operation is an OpenAPI-derived agent tool and retains the concrete zone manage permission.

GET/api/v1/compute/collection-folders/{folder_id}/access/eligible

List Eligible Principals — collection-folder

Manage the collection-folder federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:collection-folders:manage on the concrete zone.

curl -X GET https://platform.ergondata.ai/api/v1/compute/collection-folders/{folder_id}/access/eligible \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{}

GET/api/v1/compute/collection-folders/{folder_id}/access/resource-types

List Resource Types — collection-folder

Manage the collection-folder federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:collection-folders:manage on the concrete zone.

curl -X GET https://platform.ergondata.ai/api/v1/compute/collection-folders/{folder_id}/access/resource-types \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{}

GET/api/v1/compute/collection-folders/{folder_id}/access/permissions

List Permissions — collection-folder

Manage the collection-folder federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:collection-folders:manage on the concrete zone.

curl -X GET https://platform.ergondata.ai/api/v1/compute/collection-folders/{folder_id}/access/permissions \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{}

GET/api/v1/compute/collection-folders/{folder_id}/access/grants

List Grants — collection-folder

Manage the collection-folder federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:collection-folders:manage on the concrete zone.

curl -X GET https://platform.ergondata.ai/api/v1/compute/collection-folders/{folder_id}/access/grants \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{}

POST/api/v1/compute/collection-folders/{folder_id}/access/grants

Create Grant — collection-folder

Manage the collection-folder federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:collection-folders:manage on the concrete zone.

curl -X POST https://platform.ergondata.ai/api/v1/compute/collection-folders/{folder_id}/access/grants \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

201 Created

{}

DELETE/api/v1/compute/collection-folders/{folder_id}/access/grants/{grant_id}

Delete Grant — collection-folder

Manage the collection-folder federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:collection-folders:manage on the concrete zone.

curl -X DELETE https://platform.ergondata.ai/api/v1/compute/collection-folders/{folder_id}/access/grants/{grant_id} \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

204 No Content

GET/api/v1/compute/collection-folders/{folder_id}/access/connection-requests

List Connection Requests — collection-folder

Manage the collection-folder federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:collection-folders:manage on the concrete zone.

curl -X GET https://platform.ergondata.ai/api/v1/compute/collection-folders/{folder_id}/access/connection-requests \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{}

POST/api/v1/compute/collection-folders/{folder_id}/access/connection-requests/{request_id}/approve

Approve Connection Request — collection-folder

Manage the collection-folder federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:collection-folders:manage on the concrete zone.

curl -X POST https://platform.ergondata.ai/api/v1/compute/collection-folders/{folder_id}/access/connection-requests/{request_id}/approve \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{}

POST/api/v1/compute/collection-folders/{folder_id}/access/connection-requests/{request_id}/reject

Reject Connection Request — collection-folder

Manage the collection-folder federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:collection-folders:manage on the concrete zone.

curl -X POST https://platform.ergondata.ai/api/v1/compute/collection-folders/{folder_id}/access/connection-requests/{request_id}/reject \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{}

GET/api/v1/compute/collection-folders/{folder_id}/access/connections

List Connections — collection-folder

Manage the collection-folder federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:collection-folders:manage on the concrete zone.

curl -X GET https://platform.ergondata.ai/api/v1/compute/collection-folders/{folder_id}/access/connections \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{}

DELETE/api/v1/compute/collection-folders/{folder_id}/access/connections/{connection_id}

Revoke Connection — collection-folder

Manage the collection-folder federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:collection-folders:manage on the concrete zone.

curl -X DELETE https://platform.ergondata.ai/api/v1/compute/collection-folders/{folder_id}/access/connections/{connection_id} \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

204 No Content

GET/api/v1/compute/collections/{collection_id}/access/eligible

List Eligible Principals — collection

Manage the collection federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:collections:manage on the concrete zone.

curl -X GET https://platform.ergondata.ai/api/v1/compute/collections/{collection_id}/access/eligible \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{}

GET/api/v1/compute/collections/{collection_id}/access/resource-types

List Resource Types — collection

Manage the collection federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:collections:manage on the concrete zone.

curl -X GET https://platform.ergondata.ai/api/v1/compute/collections/{collection_id}/access/resource-types \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{}

GET/api/v1/compute/collections/{collection_id}/access/permissions

List Permissions — collection

Manage the collection federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:collections:manage on the concrete zone.

curl -X GET https://platform.ergondata.ai/api/v1/compute/collections/{collection_id}/access/permissions \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{}

GET/api/v1/compute/collections/{collection_id}/access/grants

List Grants — collection

Manage the collection federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:collections:manage on the concrete zone.

curl -X GET https://platform.ergondata.ai/api/v1/compute/collections/{collection_id}/access/grants \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{}

DELETE/api/v1/compute/collections/{collection_id}/access/grants/{grant_id}

Delete Grant — collection

Manage the collection federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:collections:manage on the concrete zone.

curl -X DELETE https://platform.ergondata.ai/api/v1/compute/collections/{collection_id}/access/grants/{grant_id} \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

204 No Content

POST/api/v1/compute/collections/{collection_id}/access/connection-requests/{request_id}/reject

Reject Connection Request — collection

Manage the collection federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:collections:manage on the concrete zone.

curl -X POST https://platform.ergondata.ai/api/v1/compute/collections/{collection_id}/access/connection-requests/{request_id}/reject \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{}

DELETE/api/v1/compute/collections/{collection_id}/access/connections/{connection_id}

Revoke Connection — collection

Manage the collection federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:collections:manage on the concrete zone.

curl -X DELETE https://platform.ergondata.ai/api/v1/compute/collections/{collection_id}/access/connections/{connection_id} \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

204 No Content

GET/api/v1/compute/function-folders/{folder_id}/access/eligible

List Eligible Principals — function-folder

Manage the function-folder federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:function-folders:manage on the concrete zone.

curl -X GET https://platform.ergondata.ai/api/v1/compute/function-folders/{folder_id}/access/eligible \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{}

GET/api/v1/compute/function-folders/{folder_id}/access/resource-types

List Resource Types — function-folder

Manage the function-folder federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:function-folders:manage on the concrete zone.

curl -X GET https://platform.ergondata.ai/api/v1/compute/function-folders/{folder_id}/access/resource-types \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{}

GET/api/v1/compute/function-folders/{folder_id}/access/permissions

List Permissions — function-folder

Manage the function-folder federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:function-folders:manage on the concrete zone.

curl -X GET https://platform.ergondata.ai/api/v1/compute/function-folders/{folder_id}/access/permissions \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{}

GET/api/v1/compute/function-folders/{folder_id}/access/grants

List Grants — function-folder

Manage the function-folder federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:function-folders:manage on the concrete zone.

curl -X GET https://platform.ergondata.ai/api/v1/compute/function-folders/{folder_id}/access/grants \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{}

POST/api/v1/compute/function-folders/{folder_id}/access/grants

Create Grant — function-folder

Manage the function-folder federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:function-folders:manage on the concrete zone.

curl -X POST https://platform.ergondata.ai/api/v1/compute/function-folders/{folder_id}/access/grants \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

201 Created

{}

DELETE/api/v1/compute/function-folders/{folder_id}/access/grants/{grant_id}

Delete Grant — function-folder

Manage the function-folder federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:function-folders:manage on the concrete zone.

curl -X DELETE https://platform.ergondata.ai/api/v1/compute/function-folders/{folder_id}/access/grants/{grant_id} \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

204 No Content

GET/api/v1/compute/function-folders/{folder_id}/access/connection-requests

List Connection Requests — function-folder

Manage the function-folder federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:function-folders:manage on the concrete zone.

curl -X GET https://platform.ergondata.ai/api/v1/compute/function-folders/{folder_id}/access/connection-requests \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{}

POST/api/v1/compute/function-folders/{folder_id}/access/connection-requests/{request_id}/approve

Approve Connection Request — function-folder

Manage the function-folder federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:function-folders:manage on the concrete zone.

curl -X POST https://platform.ergondata.ai/api/v1/compute/function-folders/{folder_id}/access/connection-requests/{request_id}/approve \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{}

POST/api/v1/compute/function-folders/{folder_id}/access/connection-requests/{request_id}/reject

Reject Connection Request — function-folder

Manage the function-folder federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:function-folders:manage on the concrete zone.

curl -X POST https://platform.ergondata.ai/api/v1/compute/function-folders/{folder_id}/access/connection-requests/{request_id}/reject \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{}

GET/api/v1/compute/function-folders/{folder_id}/access/connections

List Connections — function-folder

Manage the function-folder federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:function-folders:manage on the concrete zone.

curl -X GET https://platform.ergondata.ai/api/v1/compute/function-folders/{folder_id}/access/connections \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{}

DELETE/api/v1/compute/function-folders/{folder_id}/access/connections/{connection_id}

Revoke Connection — function-folder

Manage the function-folder federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:function-folders:manage on the concrete zone.

curl -X DELETE https://platform.ergondata.ai/api/v1/compute/function-folders/{folder_id}/access/connections/{connection_id} \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

204 No Content

GET/api/v1/compute/functions/{function_id}/access/eligible

List Eligible Principals — function

Manage the function federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:functions:manage on the concrete zone.

curl -X GET https://platform.ergondata.ai/api/v1/compute/functions/{function_id}/access/eligible \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{}

GET/api/v1/compute/functions/{function_id}/access/resource-types

List Resource Types — function

Manage the function federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:functions:manage on the concrete zone.

curl -X GET https://platform.ergondata.ai/api/v1/compute/functions/{function_id}/access/resource-types \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{}

GET/api/v1/compute/functions/{function_id}/access/permissions

List Permissions — function

Manage the function federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:functions:manage on the concrete zone.

curl -X GET https://platform.ergondata.ai/api/v1/compute/functions/{function_id}/access/permissions \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{}

GET/api/v1/compute/functions/{function_id}/access/grants

List Grants — function

Manage the function federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:functions:manage on the concrete zone.

curl -X GET https://platform.ergondata.ai/api/v1/compute/functions/{function_id}/access/grants \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{}

POST/api/v1/compute/functions/{function_id}/access/grants

Create Grant — function

Manage the function federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:functions:manage on the concrete zone.

curl -X POST https://platform.ergondata.ai/api/v1/compute/functions/{function_id}/access/grants \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

201 Created

{}

DELETE/api/v1/compute/functions/{function_id}/access/grants/{grant_id}

Delete Grant — function

Manage the function federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:functions:manage on the concrete zone.

curl -X DELETE https://platform.ergondata.ai/api/v1/compute/functions/{function_id}/access/grants/{grant_id} \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

204 No Content

GET/api/v1/compute/functions/{function_id}/access/connection-requests

List Connection Requests — function

Manage the function federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:functions:manage on the concrete zone.

curl -X GET https://platform.ergondata.ai/api/v1/compute/functions/{function_id}/access/connection-requests \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{}

POST/api/v1/compute/functions/{function_id}/access/connection-requests/{request_id}/approve

Approve Connection Request — function

Manage the function federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:functions:manage on the concrete zone.

curl -X POST https://platform.ergondata.ai/api/v1/compute/functions/{function_id}/access/connection-requests/{request_id}/approve \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{}

POST/api/v1/compute/functions/{function_id}/access/connection-requests/{request_id}/reject

Reject Connection Request — function

Manage the function federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:functions:manage on the concrete zone.

curl -X POST https://platform.ergondata.ai/api/v1/compute/functions/{function_id}/access/connection-requests/{request_id}/reject \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{}

GET/api/v1/compute/functions/{function_id}/access/connections

List Connections — function

Manage the function federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:functions:manage on the concrete zone.

curl -X GET https://platform.ergondata.ai/api/v1/compute/functions/{function_id}/access/connections \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

200 OK

{}

DELETE/api/v1/compute/functions/{function_id}/access/connections/{connection_id}

Revoke Connection — function

Manage the function federated zone through Compute's IAM-backed access surface.

Bearer <token> + X-Company-Id header required. Permission: compute:permissions:functions:manage on the concrete zone.

curl -X DELETE https://platform.ergondata.ai/api/v1/compute/functions/{function_id}/access/connections/{connection_id} \
  -H "Authorization: Bearer {token}" \
  -H "X-Company-Id: {company_id}"

Response

204 No Content