@deepraxis/sdk 0.1.0-dev.331f4e7 → 0.1.0-dev.3a7324b

package/dist/generated/types.gen.d.ts

@@ -4186,7 +4186,7 @@ export type AgentManaged57 = {
     type: 'custom';
 };
 /**
- * Session spending limit in USD cents; null when unlimited. Creation defaults to USD 20 when omitted. A limit amount is a positive integer string; removing a limit with null prevents setting it again for that session.
+ * Session spending limit, {type: "limit", max_list_cost: {amount, currency}}; null when unlimited. Creation defaults to a limit of 2000 US cents (USD 20.00) when omitted. amount is a positive integer string of US cents; removing the limit with null prevents setting it again for that session.
  */
 export type AgentManaged76 = {
     /**
@@ -4194,7 +4194,7 @@ export type AgentManaged76 = {
      */
     max_list_cost: AgentManaged77;
     /**
-     * Always `limit`. A spending limit.
+     * Budget kind; always limit. Any other value, including max_list_cost, returns 400 budget.type must be "limit".
      */
     type: 'limit';
 };
@@ -4380,20 +4380,6 @@ export type AgentManaged179 = {
      */
     server_tool_use?: null | AgentManaged181;
 };
-/**
- * Agent definition the session uses after the change; null when unchanged.
- */
-export type AgentManaged182 = {
-    /**
-     * Praxis extension: HTTP, SSE or trusted stdio MCP servers paired with mcp_toolset entries and saved with the agent version.
-     */
-    mcp_servers?: Array<AgentManaged7>;
-    /**
-     * Replacement tool list. Full replacement: the provided array becomes the new
-     * value. Send an empty array to clear; omit to preserve.
-     */
-    tools?: Array<AgentManaged15 | AgentManaged29 | AgentManaged32>;
-};
 export type AgentManaged183 = {
     [key: string]: null | string;
 };
@@ -4658,8 +4644,7 @@ export type AgentManaged10 = {
      */
     type: 'agent';
     /**
-     * The specific `agent` version to use. Omit to use the latest version. Must be at
-     * least 1 if specified.
+     * Agent version to pin. Omit to use the agent's active_version.
      */
     version?: number;
 };
@@ -4669,34 +4654,16 @@ export type AgentManaged167 = {
      */
     id: string;
     /**
-     * Always `agent_with_overrides`. An agent reference with inline overrides. For session creation, system is the only supported override: omit it to inherit the agent system prompt, pass a string of at most 100,000 characters to replace it, or null to clear it. model, tools, mcp_servers and skills overrides return 400, even when null; any other field beyond type, id, version and system also returns 400. Deployment overrides follow the deployment operation description.
+     * Always `agent_with_overrides`. An agent reference with an inline system prompt. For session creation, system is the only override: omit it to inherit the agent system prompt, pass a string of at most 100,000 characters to replace it, or null to clear it. Any other field beyond type, id, version and system returns 400. Deployment overrides follow the deployment operation description.
      */
     type: 'agent_with_overrides';
-    /**
-     * Praxis extension: HTTP, SSE or trusted stdio MCP servers paired with mcp_toolset entries and saved with the agent version.
-     */
-    mcp_servers?: Array<AgentManaged7>;
-    /**
-     * Replacement model. Accepts the model string, e.g. `claude-opus-5`, or a
-     * `model_config` object. Omit to use the agent's model.
-     */
-    model?: 'claude-opus-5-5' | 'claude-fable-5-1' | 'claude-sonnet-5' | 'claude-fable-5' | 'claude-opus-5' | 'claude-opus-4-8' | 'claude-opus-4-7' | 'claude-opus-4-6' | 'claude-sonnet-4-6' | 'claude-haiku-4-5' | 'claude-haiku-4-5-20251001' | 'claude-opus-4-5' | 'claude-opus-4-5-20251101' | 'claude-sonnet-4-5' | 'claude-sonnet-4-5-20250929' | string | AgentManaged1;
-    /**
-     * Replacement skill attachment references stored and echoed unchanged. Not loaded by deployment resource operations.
-     */
-    skills?: Array<AgentManaged13 | AgentManaged14>;
     /**
      * Replacement system prompt. Up to 100,000 characters. Set to null to clear the
      * agent's system prompt; omit to preserve it.
      */
     system?: null | string;
     /**
-     * Replacement tool list. Full replacement: the provided array becomes the tool
-     * configuration. Send an empty array to clear; omit to preserve the agent's tools.
-     */
-    tools?: Array<AgentManaged15 | AgentManaged29 | AgentManaged32>;
-    /**
-     * The specific `agent` version to use. Omit to use the latest version.
+     * Agent version to pin. Omit to use the agent's active_version.
      */
     version?: number;
 };
@@ -5516,7 +5483,7 @@ export type AgentManaged170 = {
      */
     name: string;
     /**
-     * Skill attachments are not supported: a nonempty skills array returns 400. Omit this field or send an empty array. The native skill tool loads available runtime skills independently of this field.
+     * Custom skills attached to the agent, each {type: "custom", skill_id, version?}: skill_id comes from skills.create or skills.list, at most 20 skills, no repeated skill_id. Omit version, or send "latest", to use the skill's newest version at the moment a session starts; a pinned version stays fixed. type anthropic returns 400: upload the skill and attach it as custom. On update, omit the field to keep the list, send an array to replace it, or send [] or null to clear it.
      */
     skills: Array<AgentManaged42 | AgentManaged43>;
     /**
@@ -7366,6 +7333,10 @@ export type AgentManaged132 = {
      * `true`.
      */
     packages?: null | AgentManaged135;
+    /**
+     * Sandbox template the environment's machines are created from: the name of a public Base from sandbox.bases.list (for example base, base-large, media) or the name or sbe_ id of one of your own ready sandbox Environments. Size is expressed by the template name, for example base-large; there is no separate size field. 1 to 128 characters of letters, digits, underscore, dot and hyphen; any other value returns 400 config.template must be a sandbox template name. The name is not checked when you save; a template the sandbox does not know fails the machine with Environment template <name> is not available. Omit on create, or send null, for the default node22; omit on update to keep it. /agent/v1 only.
+     */
+    template?: string | null;
 };
 export type AgentManaged136 = {
     /**
@@ -7644,6 +7615,113 @@ export type AgentManaged113 = {
      */
     type: 'deployment_run';
 };
+export type AgentManaged308 = {
+    /**
+     * Unique identifier for the skill.
+     *
+     * The format and length of IDs may change over time.
+     */
+    id: string;
+    /**
+     * ISO 8601 timestamp of when the skill was created.
+     */
+    created_at: string;
+    /**
+     * Human-readable, single-line label for the Skill. Maximum 255 characters. Always
+     * set: derived from the SKILL.md frontmatter `name` when omitted at creation. Not
+     * unique.
+     */
+    display_name: string;
+    /**
+     * ID of the newest Skill Version — what `latest` references resolve to. Always
+     * set: a Skill holds at least one version.
+     */
+    latest_version_id: string;
+    /**
+     * Where the Skill comes from.
+     *
+     * Possible values:
+     *
+     * - `"custom"`: authored by the platform user; private to their workspace
+     * - `"anthropic"`: published by Anthropic; shared and read-only
+     * - `"anthropic_example"`: Anthropic-published sample Skill
+     * - `"plugin"`: resolved from an installed plugin
+     */
+    source: AgentManaged309;
+    /**
+     * Object type.
+     *
+     * For Skills, this is always `"skill"`.
+     */
+    type: 'skill';
+    /**
+     * ISO 8601 timestamp of when the skill was last updated.
+     */
+    updated_at: string;
+};
+export type AgentManaged310 = {
+    /**
+     * Unique identifier for the skill.
+     *
+     * The format and length of IDs may change over time.
+     */
+    id: string;
+    /**
+     * Deleted object type.
+     *
+     * For Skills, this is always `"skill_deleted"`.
+     */
+    type: 'skill_deleted';
+};
+export type AgentManaged311 = {
+    /**
+     * Unique identifier for this Skill Version. The id addresses the version in paths
+     * and pins it in references.
+     */
+    id: string;
+    /**
+     * ISO 8601 timestamp of when the skill was created.
+     */
+    created_at: string;
+    /**
+     * Description of the skill version.
+     *
+     * This is extracted from the SKILL.md file in the skill upload.
+     */
+    description: string;
+    /**
+     * The Skill's immutable kebab-case slug, set at creation from the first upload's
+     * SKILL.md frontmatter `name` (or its enclosing directory). Every later upload
+     * must resolve to the same value. Also the top-level directory of the Skill's
+     * mounted files and the base name of a downloaded archive.
+     */
+    name: string;
+    /**
+     * Unique identifier for the skill.
+     *
+     * The format and length of IDs may change over time.
+     */
+    skill_id: string;
+    /**
+     * Object type.
+     *
+     * For Skill Versions, this is always `"skill_version"`.
+     */
+    type: 'skill_version';
+};
+export type AgentManaged312 = {
+    /**
+     * Unique identifier for this Skill Version. The id addresses the version in paths
+     * and pins it in references.
+     */
+    id: string;
+    /**
+     * Deleted object type.
+     *
+     * For Skill Versions, this is always `"skill_version_deleted"`.
+     */
+    type: 'skill_version_deleted';
+};
 export type ApplicationAccountSubdomain = {
     /**
      * Account subdomain, 8–32 lowercase letters and digits; part of every Worker URL.
@@ -10533,7 +10611,7 @@ export type DatabaseDatabase = {
     purge_at: string | null;
 };
 export type DatabaseDatabaseError = {
-    code: 'SINGULAR_MISMATCH' | 'AMBIGUOUS_EMBED' | 'EMBED_NOT_FOUND' | 'INVALID_PREFERENCE' | 'QUERY_CANCELED' | 'RANGE_NOT_SATISFIABLE' | 'NOT_ACCEPTABLE' | 'OPERATOR_TYPE_MISMATCH' | 'DATABASE_NOT_FOUND' | 'TABLE_NOT_FOUND' | 'FIELD_NOT_FOUND' | 'VALIDATION_FAILED' | 'UNIQUE_VIOLATION' | 'REFERENCE_RESTRICT' | 'FIELD_TYPE_IMMUTABLE' | 'LIMIT_EXCEEDED' | 'UNSUPPORTED' | 'INVALID_PARAMS' | 'DATABASE_INVALID_STATE' | 'CAPACITY' | 'NOT_IMPLEMENTED';
+    code: 'SINGULAR_MISMATCH' | 'AMBIGUOUS_EMBED' | 'EMBED_NOT_FOUND' | 'INVALID_PREFERENCE' | 'QUERY_CANCELED' | 'RANGE_NOT_SATISFIABLE' | 'NOT_ACCEPTABLE' | 'OPERATOR_TYPE_MISMATCH' | 'DATABASE_NOT_FOUND' | 'TABLE_NOT_FOUND' | 'FIELD_NOT_FOUND' | 'VALIDATION_FAILED' | 'UNIQUE_VIOLATION' | 'REFERENCE_RESTRICT' | 'FIELD_TYPE_IMMUTABLE' | 'LIMIT_EXCEEDED' | 'UNSUPPORTED' | 'INVALID_PARAMS' | 'DATABASE_INVALID_STATE' | 'CAPACITY' | 'NOT_IMPLEMENTED' | 'BINDING_READ_ONLY';
     message: string;
     details: string | null;
     hint: string | null;
@@ -17775,7 +17853,7 @@ export type AgentManaged172 = {
      */
     name: string;
     /**
-     * Skill attachments are not supported: a nonempty skills array returns 400. Omit this field or send an empty array. The native skill tool loads available runtime skills independently of this field.
+     * Custom skills attached to the agent, each {type: "custom", skill_id, version?}: skill_id comes from skills.create or skills.list, at most 20 skills, no repeated skill_id. Omit version, or send "latest", to use the skill's newest version at the moment a session starts; a pinned version stays fixed. type anthropic returns 400: upload the skill and attach it as custom. On update, omit the field to keep the list, send an array to replace it, or send [] or null to clear it.
      */
     skills: Array<AgentManaged42 | AgentManaged43>;
     /**
@@ -17995,19 +18073,15 @@ export type AgentManaged33 = {
     [key: string]: unknown;
 };
 /**
- * Largest list-price cost the session may reach.
+ * Largest list-price cost the session may reach, as {amount, currency}. amount is a string of US cents, not dollars.
  */
 export type AgentManaged77 = {
     /**
-     * Amount in minor units of the currency, as an integer decimal string with no
-     * leading zeros: "2500" is $25.00 and "50" is fifty cents. A string rather than a
-     * number so no float rounding is ever applied.
+     * Cost ceiling in US cents, as a positive integer string with no leading zeros: "2000" is USD 20.00 and "50" is fifty cents. Decimals and JSON numbers return 400.
      */
     amount: string;
     /**
-     * Uppercase ISO-4217 currency code. `USD` is the only currency currently
-     * supported; the accepted set is closed and grows only when a new currency is
-     * priced.
+     * Currency of amount; always USD.
      */
     currency: 'USD';
 };
@@ -18291,33 +18365,6 @@ export type AgentManaged28 = {
      */
     permission_policy?: null | AgentManaged17 | AgentManaged18 | AgentManaged19;
 };
-export type AgentManaged1 = {
-    /**
-     * The model that will power your agent.
-     *
-     * See [models](https://docs.anthropic.com/en/docs/models-overview) for additional
-     * details and options.
-     */
-    id: 'claude-opus-5-5' | 'claude-fable-5-1' | 'claude-sonnet-5' | 'claude-fable-5' | 'claude-opus-5' | 'claude-opus-4-8' | 'claude-opus-4-7' | 'claude-opus-4-6' | 'claude-sonnet-4-6' | 'claude-haiku-4-5' | 'claude-haiku-4-5-20251001' | 'claude-opus-4-5' | 'claude-opus-4-5-20251101' | 'claude-sonnet-4-5' | 'claude-sonnet-4-5-20250929' | string;
-    /**
-     * How hard Claude works on each inference call. Accepts a bare level string
-     * (`"high"`) or `{"type": "high"}`. On create, omitting it resolves the per-model
-     * default; on update, omitting it leaves the stored value unchanged.
-     */
-    effort?: null | 'low' | 'medium' | 'high' | 'xhigh' | 'max' | AgentManaged2 | AgentManaged3 | AgentManaged4 | AgentManaged5 | AgentManaged6;
-    /**
-     * Geographic region for model inference. When unset, requests fall through to the
-     * workspace's default_inference_geo. On update, `model` is whole-object
-     * replacement — omitting inference_geo clears it.
-     */
-    inference_geo?: null | string;
-    /**
-     * Inference speed mode. `fast` provides significantly faster output token
-     * generation at premium pricing. Not all models support `fast`; invalid
-     * combinations are rejected at create time.
-     */
-    speed?: null | 'standard' | 'fast';
-};
 export type AgentManaged72 = {
     /**
      * ID of the rubric file.
@@ -18657,12 +18704,9 @@ export type AgentManaged89 = {
  */
 export type AgentManaged38 = {
     /**
-     * The model that will power your agent.
-     *
-     * See [models](https://docs.anthropic.com/en/docs/models-overview) for additional
-     * details and options.
+     * A model id from the Praxis model catalog (`praxis.model.models.list`). Unlike Anthropic, Claude model ids other than those in the catalog are rejected.
      */
-    id: 'claude-opus-5-5' | 'claude-fable-5-1' | 'claude-sonnet-5' | 'claude-fable-5' | 'claude-opus-5' | 'claude-opus-4-8' | 'claude-opus-4-7' | 'claude-opus-4-6' | 'claude-sonnet-4-6' | 'claude-haiku-4-5' | 'claude-haiku-4-5-20251001' | 'claude-opus-4-5' | 'claude-opus-4-5-20251101' | 'claude-sonnet-4-5' | 'claude-sonnet-4-5-20250929' | string;
+    id: string;
     /**
      * How hard Claude works on each turn. Sets `output_config.effort` on every
      * Messages call the session makes.
@@ -20108,6 +20152,10 @@ export type AgentManaged139 = {
      * Environment type
      */
     type: 'cloud';
+    /**
+     * Sandbox template machines of this environment are created from: a public Base name or one of your own sandbox Environments (name or sbe_ id); size is expressed by the template name. The built-in node22 shows node22; null or absent means the default node22. /agent/v1 only.
+     */
+    template?: string | null;
 };
 export type AgentManaged142 = {
     /**
@@ -20381,6 +20429,22 @@ export type AgentManaged131 = {
      */
     type: 'manual';
 };
+/**
+ * Source of the content.
+ */
+export type AgentManaged309 = {
+    /**
+     * Where the Skill comes from.
+     *
+     * Possible values:
+     *
+     * - `"custom"`: authored by the platform user; private to their workspace
+     * - `"anthropic"`: published by Anthropic; shared and read-only
+     * - `"anthropic_example"`: Anthropic-published sample Skill
+     * - `"plugin"`: resolved from an installed plugin
+     */
+    type: 'anthropic' | 'custom' | 'anthropic_example' | 'plugin';
+};
 export type ApplicationModule = {
     /**
      * Module file name.
@@ -27199,6 +27263,14 @@ export type ApplyAgentVersionErrors = {
      * Version must be a positive integer; select a version from agents.versions.list.
      */
     400: unknown;
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
     /**
      * Agent or version is unavailable. A missing version returns Agent version not found; check the version list.
      */
@@ -27317,12 +27389,9 @@ export type ApplyAgentVersionResponses = {
          */
         model: {
             /**
-             * The model that will power your agent.
-             *
-             * See [models](https://docs.anthropic.com/en/docs/models-overview) for additional
-             * details and options.
+             * A model id from the Praxis model catalog (`praxis.model.models.list`). Unlike Anthropic, Claude model ids other than those in the catalog are rejected.
              */
-            id: 'claude-opus-5-5' | 'claude-fable-5-1' | 'claude-sonnet-5' | 'claude-fable-5' | 'claude-opus-5' | 'claude-opus-4-8' | 'claude-opus-4-7' | 'claude-opus-4-6' | 'claude-sonnet-4-6' | 'claude-haiku-4-5' | 'claude-haiku-4-5-20251001' | 'claude-opus-4-5' | 'claude-opus-4-5-20251101' | 'claude-sonnet-4-5' | 'claude-sonnet-4-5-20250929' | string;
+            id: string;
             /**
              * How hard Claude works on each turn. Sets `output_config.effort` on every
              * Messages call the session makes.
@@ -27415,7 +27484,7 @@ export type ApplyAgentVersionResponses = {
          */
         name: string;
         /**
-         * Skill attachments are not supported: a nonempty skills array returns 400. Omit this field or send an empty array. The native skill tool loads available runtime skills independently of this field.
+         * Custom skills attached to the agent, each {type: "custom", skill_id, version?}: skill_id comes from skills.create or skills.list, at most 20 skills, no repeated skill_id. Omit version, or send "latest", to use the skill's newest version at the moment a session starts; a pinned version stays fixed. type anthropic returns 400: upload the skill and attach it as custom. On update, omit the field to keep the list, send an array to replace it, or send [] or null to clear it.
          */
         skills: Array<{
             /**
@@ -27938,38 +28007,21 @@ export type ApplyAgentVersionResponses = {
          */
         note: string | null;
         /**
-         * Database allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
+         * Platform resources and services this service agent's codemode may reach, as one list of typed bindings. Only kind=service accepts a nonempty list; personal agents return 400. There are two kinds. A resource binding names one resource with id and access: database (id db_..., read_only or read_write), vector_store (id vs_..., read_only or read_write), file (id file- plus 24 letters or digits, as the File API returns it; read_only), media_library (any id without ':' or whitespace, read_only or read_write), model (a model catalog id, invoke), workflow and script (id <namespace>/<name>, invoke). A service binding opens a whole service and carries only enabled: search or browser. At most 20 bindings per type, no repeated type and id, and each service type at most once. A session is authorized by the agent version it runs: newly added bindings apply only to new sessions, and a version saved with apply=false changes no access until it is applied. Applying a version that disables, removes or downgrades a binding revokes it immediately in running sessions on older versions. A resource that is not bound returns 404, a service that is not opened returns 403, and a write to a resource bound read_only returns 403 BINDING_READ_ONLY. Unknown types, fields on the wrong kind (id, access or instructions on a service binding), wrong access and malformed ids return 400. The former databases, vector_stores and files fields are removed and return 400. Omit on create for no bindings.
          */
-        databases: Array<{
-            /**
-             * Resource id from database.databases.list or database.databases.create; use the returned id, not its name. Must start with db_ and be unique within this binding array.
-             */
-            id: string;
+        bindings: Array<{
             /**
-             * read_only permits reads of the bound resource; read_write permits reads and writes.
+             * Resource type. Decides the id format and the allowed access.
              */
-            access: 'read_only' | 'read_write';
+            type: 'database' | 'vector_store' | 'file' | 'media_library' | 'model' | 'workflow' | 'script';
             /**
-             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
-             */
-            instructions?: string;
-            /**
-             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
-             */
-            enabled?: boolean;
-        }>;
-        /**
-         * Knowledge vector store allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
-         */
-        vector_stores: Array<{
-            /**
-             * Resource id from knowledge.vectorStores.list or knowledge.vectorStores.create; use the returned id, not its name. Must start with vs_ and be unique within this binding array.
+             * Resource id, never its name. database db_..., vector_store vs_..., file file- plus 24 letters or digits; media_library and model ids must not contain ':' or whitespace; workflow and script use <namespace>/<name> with no '/', '@', ':' or whitespace inside a part.
              */
             id: string;
             /**
-             * read_only permits reads of the bound resource; read_write permits reads and writes.
+             * database, vector_store and media_library accept read_only or read_write; file accepts read_only; model, workflow and script accept invoke. Any other combination returns 400.
              */
-            access: 'read_only' | 'read_write';
+            access: 'read_only' | 'read_write' | 'invoke';
             /**
              * Optional guidance for using this resource, up to 4096 characters; does not expand access.
              */
@@ -27978,25 +28030,13 @@ export type ApplyAgentVersionResponses = {
              * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
              */
             enabled?: boolean;
-        }>;
-        /**
-         * File allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
-         */
-        files: Array<{
-            /**
-             * Resource id from file.files.list or file.files.create (upload); use the returned id, not its name. Must start with file_ and be unique within this binding array.
-             */
-            id: string;
-            /**
-             * read_only permits reading the bound file; files do not accept read_write.
-             */
-            access: 'read_only';
+        } | {
             /**
-             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+             * Service type. Opens the whole service to codemode; there is no per-resource id.
              */
-            instructions?: string;
+            type: 'search' | 'browser';
             /**
-             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+             * Whether the service is open. Defaults to true; false immediately closes it for running sessions.
              */
             enabled?: boolean;
         }>;
@@ -28338,7 +28378,7 @@ export type ApplyAgentVersionResponses = {
                  */
                 commands?: Array<string>;
                 /**
-                 * Skill attachments are not supported: a nonempty array returns 400. Omit this field or send an empty array; the native skill tool is configured separately through tools.
+                 * Names of disabled skills declarations.
                  */
                 skills?: Array<string>;
                 /**
@@ -28360,6 +28400,26 @@ export type ApplyAgentVersionResponses = {
              */
             allowed: Array<string>;
         };
+        /**
+         * Avatar image URL of this agent version (absolute https), shown in agent lists, the agent detail, the chat header and as the default avatar of embedded chat; null when none is set. Follows the version like other configuration: a version saved with apply=false does not change the avatar in effect. /agent/v1 only.
+         */
+        avatar: string | null;
+        /**
+         * Channel the agent was created through (for example api or console); null for historical agents whose channel is unknown. Display only. /agent/v1 only; /anthropic neither returns it.
+         */
+        creation_source: string | null;
+        /**
+         * Platform-wide identity number of the agent (8 characters), usable wherever an agent is addressed by identity_number; null when the agent has none. /agent/v1 only; /anthropic neither returns it.
+         */
+        identity_number: string | null;
+        /**
+         * Default environment of this service agent version: the environment_id new sessions get when they name none; null means no environment. Present for service agents only. Follows the version like other configuration: a version saved with apply=false does not change the environment in effect. Versions saved before this field existed read as light. /agent/v1 only.
+         */
+        environment_id?: string | null;
+        /**
+         * Default vaults of this service agent version: the vault_ids new sessions get when they name none. Present for service agents only. Follows the version like other configuration: a version saved with apply=false does not change the vaults in effect. Versions saved before this field existed read as []. /agent/v1 only.
+         */
+        vault_ids?: Array<string>;
         /**
          * Current agent lifecycle status; unarchive restores an archived agent to active.
          */
@@ -28379,6 +28439,14 @@ export type UnarchiveAgentData = {
     url: '/agent/v1/agents/{agent_id}/unarchive';
 };
 export type UnarchiveAgentErrors = {
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
     /**
      * Agent does not exist or is inaccessible to this caller.
      */
@@ -28493,12 +28561,9 @@ export type UnarchiveAgentResponses = {
          */
         model: {
             /**
-             * The model that will power your agent.
-             *
-             * See [models](https://docs.anthropic.com/en/docs/models-overview) for additional
-             * details and options.
+             * A model id from the Praxis model catalog (`praxis.model.models.list`). Unlike Anthropic, Claude model ids other than those in the catalog are rejected.
              */
-            id: 'claude-opus-5-5' | 'claude-fable-5-1' | 'claude-sonnet-5' | 'claude-fable-5' | 'claude-opus-5' | 'claude-opus-4-8' | 'claude-opus-4-7' | 'claude-opus-4-6' | 'claude-sonnet-4-6' | 'claude-haiku-4-5' | 'claude-haiku-4-5-20251001' | 'claude-opus-4-5' | 'claude-opus-4-5-20251101' | 'claude-sonnet-4-5' | 'claude-sonnet-4-5-20250929' | string;
+            id: string;
             /**
              * How hard Claude works on each turn. Sets `output_config.effort` on every
              * Messages call the session makes.
@@ -28591,7 +28656,7 @@ export type UnarchiveAgentResponses = {
          */
         name: string;
         /**
-         * Skill attachments are not supported: a nonempty skills array returns 400. Omit this field or send an empty array. The native skill tool loads available runtime skills independently of this field.
+         * Custom skills attached to the agent, each {type: "custom", skill_id, version?}: skill_id comes from skills.create or skills.list, at most 20 skills, no repeated skill_id. Omit version, or send "latest", to use the skill's newest version at the moment a session starts; a pinned version stays fixed. type anthropic returns 400: upload the skill and attach it as custom. On update, omit the field to keep the list, send an array to replace it, or send [] or null to clear it.
          */
         skills: Array<{
             /**
@@ -29114,38 +29179,21 @@ export type UnarchiveAgentResponses = {
          */
         note: string | null;
         /**
-         * Database allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
+         * Platform resources and services this service agent's codemode may reach, as one list of typed bindings. Only kind=service accepts a nonempty list; personal agents return 400. There are two kinds. A resource binding names one resource with id and access: database (id db_..., read_only or read_write), vector_store (id vs_..., read_only or read_write), file (id file- plus 24 letters or digits, as the File API returns it; read_only), media_library (any id without ':' or whitespace, read_only or read_write), model (a model catalog id, invoke), workflow and script (id <namespace>/<name>, invoke). A service binding opens a whole service and carries only enabled: search or browser. At most 20 bindings per type, no repeated type and id, and each service type at most once. A session is authorized by the agent version it runs: newly added bindings apply only to new sessions, and a version saved with apply=false changes no access until it is applied. Applying a version that disables, removes or downgrades a binding revokes it immediately in running sessions on older versions. A resource that is not bound returns 404, a service that is not opened returns 403, and a write to a resource bound read_only returns 403 BINDING_READ_ONLY. Unknown types, fields on the wrong kind (id, access or instructions on a service binding), wrong access and malformed ids return 400. The former databases, vector_stores and files fields are removed and return 400. Omit on create for no bindings.
          */
-        databases: Array<{
-            /**
-             * Resource id from database.databases.list or database.databases.create; use the returned id, not its name. Must start with db_ and be unique within this binding array.
-             */
-            id: string;
-            /**
-             * read_only permits reads of the bound resource; read_write permits reads and writes.
-             */
-            access: 'read_only' | 'read_write';
-            /**
-             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
-             */
-            instructions?: string;
+        bindings: Array<{
             /**
-             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+             * Resource type. Decides the id format and the allowed access.
              */
-            enabled?: boolean;
-        }>;
-        /**
-         * Knowledge vector store allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
-         */
-        vector_stores: Array<{
+            type: 'database' | 'vector_store' | 'file' | 'media_library' | 'model' | 'workflow' | 'script';
             /**
-             * Resource id from knowledge.vectorStores.list or knowledge.vectorStores.create; use the returned id, not its name. Must start with vs_ and be unique within this binding array.
+             * Resource id, never its name. database db_..., vector_store vs_..., file file- plus 24 letters or digits; media_library and model ids must not contain ':' or whitespace; workflow and script use <namespace>/<name> with no '/', '@', ':' or whitespace inside a part.
              */
             id: string;
             /**
-             * read_only permits reads of the bound resource; read_write permits reads and writes.
+             * database, vector_store and media_library accept read_only or read_write; file accepts read_only; model, workflow and script accept invoke. Any other combination returns 400.
              */
-            access: 'read_only' | 'read_write';
+            access: 'read_only' | 'read_write' | 'invoke';
             /**
              * Optional guidance for using this resource, up to 4096 characters; does not expand access.
              */
@@ -29154,25 +29202,13 @@ export type UnarchiveAgentResponses = {
              * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
              */
             enabled?: boolean;
-        }>;
-        /**
-         * File allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
-         */
-        files: Array<{
-            /**
-             * Resource id from file.files.list or file.files.create (upload); use the returned id, not its name. Must start with file_ and be unique within this binding array.
-             */
-            id: string;
+        } | {
             /**
-             * read_only permits reading the bound file; files do not accept read_write.
+             * Service type. Opens the whole service to codemode; there is no per-resource id.
              */
-            access: 'read_only';
+            type: 'search' | 'browser';
             /**
-             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
-             */
-            instructions?: string;
-            /**
-             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+             * Whether the service is open. Defaults to true; false immediately closes it for running sessions.
              */
             enabled?: boolean;
         }>;
@@ -29514,7 +29550,7 @@ export type UnarchiveAgentResponses = {
                  */
                 commands?: Array<string>;
                 /**
-                 * Skill attachments are not supported: a nonempty array returns 400. Omit this field or send an empty array; the native skill tool is configured separately through tools.
+                 * Names of disabled skills declarations.
                  */
                 skills?: Array<string>;
                 /**
@@ -29536,6 +29572,26 @@ export type UnarchiveAgentResponses = {
              */
             allowed: Array<string>;
         };
+        /**
+         * Avatar image URL of this agent version (absolute https), shown in agent lists, the agent detail, the chat header and as the default avatar of embedded chat; null when none is set. Follows the version like other configuration: a version saved with apply=false does not change the avatar in effect. /agent/v1 only.
+         */
+        avatar: string | null;
+        /**
+         * Channel the agent was created through (for example api or console); null for historical agents whose channel is unknown. Display only. /agent/v1 only; /anthropic neither returns it.
+         */
+        creation_source: string | null;
+        /**
+         * Platform-wide identity number of the agent (8 characters), usable wherever an agent is addressed by identity_number; null when the agent has none. /agent/v1 only; /anthropic neither returns it.
+         */
+        identity_number: string | null;
+        /**
+         * Default environment of this service agent version: the environment_id new sessions get when they name none; null means no environment. Present for service agents only. Follows the version like other configuration: a version saved with apply=false does not change the environment in effect. Versions saved before this field existed read as light. /agent/v1 only.
+         */
+        environment_id?: string | null;
+        /**
+         * Default vaults of this service agent version: the vault_ids new sessions get when they name none. Present for service agents only. Follows the version like other configuration: a version saved with apply=false does not change the vaults in effect. Versions saved before this field existed read as []. /agent/v1 only.
+         */
+        vault_ids?: Array<string>;
         /**
          * Current agent lifecycle status; unarchive restores an archived agent to active.
          */
@@ -29567,6 +29623,10 @@ export type DeleteRunFeedbackErrors = {
      * Authenticate with a valid organization or end-user credential.
      */
     401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
     /**
      * Session is inaccessible or the run does not belong to it; verify both identifiers.
      */
@@ -29612,6 +29672,10 @@ export type SetRunFeedbackErrors = {
      * Authenticate with a valid organization or end-user credential.
      */
     401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
     /**
      * Session is inaccessible or the run does not belong to it; verify both identifiers.
      */
@@ -29686,6 +29750,10 @@ export type ListEndUsersErrors = {
      * Authenticate with a host credential.
      */
     401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
     /**
      * Agent or requested user is unavailable to this caller, or the caller is an end user.
      */
@@ -29761,6 +29829,10 @@ export type DeleteEndUserErrors = {
      * Authenticate with a host credential.
      */
     401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
     /**
      * Agent or requested user is unavailable to this caller, or the caller is an end user.
      */
@@ -29806,6 +29878,10 @@ export type GetEndUserErrors = {
      * Authenticate with a host credential.
      */
     401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
     /**
      * Agent or requested user is unavailable to this caller, or the caller is an end user.
      */
@@ -29892,6 +29968,10 @@ export type GetEndUserDeletionErrors = {
      * Authenticate with a host credential.
      */
     401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
     /**
      * Agent or requested user is unavailable to this caller, or the caller is an end user.
      */
@@ -29978,6 +30058,10 @@ export type RevokeEndUserTokensErrors = {
      * Authenticate with a host credential.
      */
     401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
     /**
      * Agent or requested user is unavailable to this caller, or the caller is an end user.
      */
@@ -30023,6 +30107,10 @@ export type BlockEndUserErrors = {
      * Authenticate with a host credential.
      */
     401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
     /**
      * Agent or requested user is unavailable to this caller, or the caller is an end user.
      */
@@ -30092,6 +30180,10 @@ export type UnblockEndUserErrors = {
      * Authenticate with a host credential.
      */
     401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
     /**
      * Agent or requested user is unavailable to this caller, or the caller is an end user.
      */
@@ -30133,6 +30225,303 @@ export type UnblockEndUserResponses = {
     };
 };
 export type UnblockEndUserResponse = UnblockEndUserResponses[keyof UnblockEndUserResponses];
+export type CreateCustomerGrantCodeData = {
+    body: {
+        /**
+         * Your stable, opaque identifier for the signed-in customer, such as your database user id. Do not use an email address or phone number. "auth" is reserved, and ids starting with anon_ are reserved for anonymous customers.
+         */
+        customer_id: string;
+        /**
+         * Existing agent version that every token of this sign-in pins. Defaults to the agent's active_version when the code is issued.
+         */
+        version?: number;
+        /**
+         * Budget in cents for each session the customer starts. Defaults to the embed policy session budget and cannot exceed its maximum.
+         */
+        budget_cents?: number;
+        /**
+         * Optional context the agent receives at the start of each session, as text blocks, limited to 8192 UTF-8 bytes in total.
+         */
+        system_message?: Array<{
+            /**
+             * The text block kind; text is the only supported kind.
+             */
+            type: 'text';
+            /**
+             * Context text about this customer. All blocks together must fit within 8192 UTF-8 bytes.
+             */
+            text: string;
+        }>;
+        /**
+         * Optional system prompt override, accepted only when the embed policy allows agent overrides.
+         */
+        agent_override?: {
+            /**
+             * Replacement system prompt, or null to clear it for this sign-in.
+             */
+            system: string | null;
+        };
+        /**
+         * Up to 16 string pairs copied onto every session the customer starts. The playground key is reserved.
+         */
+        metadata?: {
+            [key: string]: string;
+        };
+        /**
+         * Page origin, such as https://shop.example.com, that must be one of the agent policy's allowed_origins (or localhost when the policy allows it). When set, every token of this sign-in works only from exactly this origin. Omit to accept any policy origin.
+         */
+        origin?: string;
+        /**
+         * Seconds the code stays redeemable, from 60 to 86400. Defaults to 900.
+         */
+        expires_in?: number;
+        /**
+         * Total lifetime of the sign-in in seconds, from 3600 to 604800 (7 days). Tokens renew within it; after it the customer signs in again. Defaults to 604800.
+         */
+        max_session_seconds?: number;
+        /**
+         * The current access token of the anonymous customer who used this agent before signing in. Their conversations become visible to the identified customer, and the anonymous sign-in ends at exchange.
+         */
+        anonymous_access_token?: string;
+    };
+    path: {
+        /**
+         * Service agent id (agent_…) or its short identity number, from agent creation or listing.
+         */
+        agent_id: string;
+    };
+    query?: never;
+    url: '/agent/v1/agents/{agent_id}/customers/auth/grant_codes';
+};
+export type CreateCustomerGrantCodeErrors = {
+    /**
+     * INVALID_PARAMS: an unknown field, a reserved or malformed customer_id, an origin outside the policy, a value outside its range, or an anonymous_access_token that is not a live anonymous token of this agent. The message names the field to correct.
+     */
+    400: unknown;
+    /**
+     * Authenticate with your backend API key or a console session.
+     */
+    401: unknown;
+    /**
+     * CUSTOMER_BLOCKED: the customer is on the agent's blocked list; unblock them in the console first.
+     */
+    403: unknown;
+    /**
+     * The agent is not an active service agent of your organization, or the caller is a customer access token.
+     */
+    404: unknown;
+};
+export type CreateCustomerGrantCodeResponses = {
+    /**
+     * The one-time grant code and its expiry. Only its hash is stored; it cannot be read again.
+     */
+    201: {
+        /**
+         * Object type, always customer_grant_code.
+         */
+        type: 'customer_grant_code';
+        /**
+         * One-time grant code (cgc_…). Hand it to Agent Kit in the browser, which exchanges it for an access token; it is never shown again.
+         */
+        code: string;
+        /**
+         * The customer_id that the code signs in.
+         */
+        customer_id: string;
+        /**
+         * RFC 3339 time after which the code can no longer be exchanged.
+         */
+        expires_at: string;
+    };
+};
+export type CreateCustomerGrantCodeResponse = CreateCustomerGrantCodeResponses[keyof CreateCustomerGrantCodeResponses];
+export type CreateCustomerAccessTokenData = {
+    /**
+     * Exactly one of grant_code (a signed-in customer) or publishable_key (an anonymous visitor).
+     */
+    body: {
+        /**
+         * The grant code your backend received from grant_codes. It works once.
+         */
+        grant_code: string;
+    } | {
+        /**
+         * The agent's publishable key, for a visitor who has not signed in. Creates a new anonymous customer.
+         */
+        publishable_key: string;
+    };
+    headers?: {
+        /**
+         * Browser page origin. Required for publishable_key and for a grant code bound to an origin; it must be in the agent's allowed_origins.
+         */
+        Origin?: string;
+    };
+    path: {
+        /**
+         * Service agent id (agent_…) or its short identity number, from agent creation or listing.
+         */
+        agent_id: string;
+    };
+    query?: never;
+    url: '/agent/v1/agents/{agent_id}/customers/auth/access_tokens';
+};
+export type CreateCustomerAccessTokenErrors = {
+    /**
+     * INVALID_PARAMS: send exactly one of grant_code or publishable_key, nothing else.
+     */
+    400: unknown;
+    /**
+     * GRANT_CODE_INVALID: the code is unknown, already used, expired or for another agent (one answer for all four); request a new grant code from your backend. UNAUTHENTICATED: the publishable key is unknown, disabled or for another agent.
+     */
+    401: unknown;
+    /**
+     * EMBED_BUDGET_EXHAUSTED: the publishable key's daily spending cap is reached; wait for the UTC reset or ask the owner to raise it.
+     */
+    402: unknown;
+    /**
+     * ORIGIN_NOT_ALLOWED or EMBED_ORIGIN_NOT_ALLOWED: call from the origin the code was issued for, or from one in the agent's allowed_origins. CUSTOMER_BLOCKED: the merchant blocked this customer.
+     */
+    403: unknown;
+    /**
+     * EMBED_RATE_LIMITED: the per-IP minute limit or the key's daily session cap is reached; wait for Retry-After or the UTC reset.
+     */
+    429: unknown;
+    /**
+     * Issuance or rate limiting is unavailable; retry later with a new grant code if this one expires.
+     */
+    503: unknown;
+};
+export type CreateCustomerAccessTokenResponses = {
+    /**
+     * A customer access token, its expiry and the end of the sign-in.
+     */
+    201: {
+        /**
+         * Object type, always customer_access_token.
+         */
+        type: 'customer_access_token';
+        /**
+         * Bearer credential for this agent's sessions on behalf of the customer. Renew it before expires_at.
+         */
+        access_token: string;
+        /**
+         * RFC 3339 expiry of this access token: at most two hours after issue and never after session_expires_at.
+         */
+        expires_at: string;
+        /**
+         * RFC 3339 end of the sign-in. Renewal stops working here; the customer signs in again with a new grant code.
+         */
+        session_expires_at: string;
+        /**
+         * The customer this token acts for.
+         */
+        customer: {
+            /**
+             * The customer id: your customer_id, or anon_ followed by 16 characters for an anonymous customer.
+             */
+            id: string;
+            /**
+             * identified: signed in through a grant code from your backend. anonymous: a visitor admitted with the publishable key.
+             */
+            type: 'identified' | 'anonymous';
+        };
+    };
+};
+export type CreateCustomerAccessTokenResponse = CreateCustomerAccessTokenResponses[keyof CreateCustomerAccessTokenResponses];
+export type RenewCustomerAccessTokenData = {
+    body?: never;
+    path: {
+        /**
+         * Service agent id (agent_…) or its short identity number, from agent creation or listing.
+         */
+        agent_id: string;
+    };
+    query?: never;
+    url: '/agent/v1/agents/{agent_id}/customers/auth/access_tokens/renew';
+};
+export type RenewCustomerAccessTokenErrors = {
+    /**
+     * ACCESS_TOKEN_REVOKED: the token or its sign-in was revoked (logout, merge, or revocation by the merchant); sign the customer in again with a new grant code. Other 401 responses mean the Bearer token is missing, invalid or expired; renew before expires_at. CUSTOMER_SESSION_EXPIRED: less than 60 seconds of the sign-in remain; sign in again: request a new grant code from your backend.
+     */
+    401: unknown;
+    /**
+     * CUSTOMER_BLOCKED: the merchant blocked this customer; unblock them before signing them in. ORIGIN_NOT_ALLOWED: the request Origin is not the origin this sign-in is bound to, or is not in the agent's allowed_origins; call from the page that signed in.
+     */
+    403: unknown;
+    /**
+     * The token belongs to another agent, is not a customer access token, or the agent is archived or absent; use the agent_id the token was issued for.
+     */
+    404: unknown;
+};
+export type RenewCustomerAccessTokenResponses = {
+    /**
+     * A new access token in the same sign-in. The presented token stays valid until its own expiry.
+     */
+    201: {
+        /**
+         * Object type, always customer_access_token.
+         */
+        type: 'customer_access_token';
+        /**
+         * Bearer credential for this agent's sessions on behalf of the customer. Renew it before expires_at.
+         */
+        access_token: string;
+        /**
+         * RFC 3339 expiry of this access token: at most two hours after issue and never after session_expires_at.
+         */
+        expires_at: string;
+        /**
+         * RFC 3339 end of the sign-in. Renewal stops working here; the customer signs in again with a new grant code.
+         */
+        session_expires_at: string;
+        /**
+         * The customer this token acts for.
+         */
+        customer: {
+            /**
+             * The customer id: your customer_id, or anon_ followed by 16 characters for an anonymous customer.
+             */
+            id: string;
+            /**
+             * identified: signed in through a grant code from your backend. anonymous: a visitor admitted with the publishable key.
+             */
+            type: 'identified' | 'anonymous';
+        };
+    };
+};
+export type RenewCustomerAccessTokenResponse = RenewCustomerAccessTokenResponses[keyof RenewCustomerAccessTokenResponses];
+export type DeleteCurrentCustomerAccessTokenData = {
+    body?: never;
+    path: {
+        /**
+         * Service agent id (agent_…) or its short identity number, from agent creation or listing.
+         */
+        agent_id: string;
+    };
+    query?: never;
+    url: '/agent/v1/agents/{agent_id}/customers/auth/access_tokens/current';
+};
+export type DeleteCurrentCustomerAccessTokenErrors = {
+    /**
+     * ACCESS_TOKEN_REVOKED: the token or its sign-in was revoked (logout, merge, or revocation by the merchant); sign the customer in again with a new grant code. Other 401 responses mean the Bearer token is missing, invalid or expired; renew before expires_at.
+     */
+    401: unknown;
+    /**
+     * CUSTOMER_BLOCKED: the merchant blocked this customer; unblock them before signing them in. ORIGIN_NOT_ALLOWED: the request Origin is not the origin this sign-in is bound to, or is not in the agent's allowed_origins; call from the page that signed in.
+     */
+    403: unknown;
+    /**
+     * The token belongs to another agent, is not a customer access token, or the agent is archived or absent; use the agent_id the token was issued for.
+     */
+    404: unknown;
+};
+export type DeleteCurrentCustomerAccessTokenResponses = {
+    /**
+     * Logged out: the sign-in and every access token in it are revoked, and their live event streams close.
+     */
+    204: void;
+};
+export type DeleteCurrentCustomerAccessTokenResponse = DeleteCurrentCustomerAccessTokenResponses[keyof DeleteCurrentCustomerAccessTokenResponses];
 export type ExchangeEmbedCodeData = {
     body: {
         /**
@@ -30149,6 +30538,14 @@ export type ExchangeEmbedCodeErrors = {
      * Expected a JSON object containing only code. Correct the request body.
      */
     400: unknown;
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
     /**
      * The code is expired, already used or unknown. Return to the host website for a new link; all three cases have the same response body.
      */
@@ -30277,6 +30674,10 @@ export type ListEmbedTokensErrors = {
      * Authenticate with a host credential.
      */
     401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
     /**
      * The grant is missing or belongs to another organization, or the caller is an end user.
      */
@@ -30481,6 +30882,10 @@ export type RevokeEmbedTokenErrors = {
      * Authenticate with a host credential.
      */
     401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
     /**
      * The grant is missing or belongs to another organization, or the caller is an end user.
      */
@@ -32323,6 +32728,10 @@ export type ListToolsetsErrors = {
      * Authentication required
      */
     401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
     /**
      * Toolset catalog unavailable
      */
@@ -32425,6 +32834,10 @@ export type GetSessionContextErrors = {
      * Authentication required
      */
     401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
     /**
      * Session not found
      */
@@ -32664,6 +33077,10 @@ export type ForkSessionErrors = {
      * Authentication required
      */
     401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
     /**
      * Session not found
      */
@@ -32785,12 +33202,9 @@ export type ForkSessionResponses = {
              */
             model: {
                 /**
-                 * The model that will power your agent.
-                 *
-                 * See [models](https://docs.anthropic.com/en/docs/models-overview) for additional
-                 * details and options.
+                 * A model id from the Praxis model catalog (`praxis.model.models.list`). Unlike Anthropic, Claude model ids other than those in the catalog are rejected.
                  */
-                id: 'claude-opus-5-5' | 'claude-fable-5-1' | 'claude-sonnet-5' | 'claude-fable-5' | 'claude-opus-5' | 'claude-opus-4-8' | 'claude-opus-4-7' | 'claude-opus-4-6' | 'claude-sonnet-4-6' | 'claude-haiku-4-5' | 'claude-haiku-4-5-20251001' | 'claude-opus-4-5' | 'claude-opus-4-5-20251101' | 'claude-sonnet-4-5' | 'claude-sonnet-4-5-20250929' | string;
+                id: string;
                 /**
                  * How hard Claude works on each turn. Sets `output_config.effort` on every
                  * Messages call the session makes.
@@ -32950,12 +33364,9 @@ export type ForkSessionResponses = {
                      */
                     model: {
                         /**
-                         * The model that will power your agent.
-                         *
-                         * See [models](https://docs.anthropic.com/en/docs/models-overview) for additional
-                         * details and options.
+                         * A model id from the Praxis model catalog (`praxis.model.models.list`). Unlike Anthropic, Claude model ids other than those in the catalog are rejected.
                          */
-                        id: 'claude-opus-5-5' | 'claude-fable-5-1' | 'claude-sonnet-5' | 'claude-fable-5' | 'claude-opus-5' | 'claude-opus-4-8' | 'claude-opus-4-7' | 'claude-opus-4-6' | 'claude-sonnet-4-6' | 'claude-haiku-4-5' | 'claude-haiku-4-5-20251001' | 'claude-opus-4-5' | 'claude-opus-4-5-20251101' | 'claude-sonnet-4-5' | 'claude-sonnet-4-5-20250929' | string;
+                        id: string;
                         /**
                          * How hard Claude works on each turn. Sets `output_config.effort` on every
                          * Messages call the session makes.
@@ -33003,7 +33414,7 @@ export type ForkSessionResponses = {
                      */
                     name: string;
                     /**
-                     * Skill attachments are not supported: a nonempty skills array returns 400. Omit this field or send an empty array. The native skill tool loads available runtime skills independently of this field.
+                     * Custom skills attached to the agent, each {type: "custom", skill_id, version?}: skill_id comes from skills.create or skills.list, at most 20 skills, no repeated skill_id. Omit version, or send "latest", to use the skill's newest version at the moment a session starts; a pinned version stays fixed. type anthropic returns 400: upload the skill and attach it as custom. On update, omit the field to keep the list, send an array to replace it, or send [] or null to clear it.
                      */
                     skills: Array<{
                         /**
@@ -33497,7 +33908,7 @@ export type ForkSessionResponses = {
              */
             name: string;
             /**
-             * Skill attachments are not supported: a nonempty skills array returns 400. Omit this field or send an empty array. The native skill tool loads available runtime skills independently of this field.
+             * Custom skills attached to the agent, each {type: "custom", skill_id, version?}: skill_id comes from skills.create or skills.list, at most 20 skills, no repeated skill_id. Omit version, or send "latest", to use the skill's newest version at the moment a session starts; a pinned version stays fixed. type anthropic returns 400: upload the skill and attach it as custom. On update, omit the field to keep the list, send an array to replace it, or send [] or null to clear it.
              */
             skills: Array<{
                 /**
@@ -34017,7 +34428,7 @@ export type ForkSessionResponses = {
          */
         created_at: string;
         /**
-         * Execution environment selected for this session. Service sessions return light when environment_id was omitted, or null when explicitly created without a machine; Computer sessions may omit this field.
+         * Execution environment of this session. A service session created without environment_id uses the default environment saved in the agent version (light for a new agent); null means it was created without a machine; Computer sessions may omit this field.
          */
         environment_id?: string;
         /**
@@ -34375,6 +34786,10 @@ export type ListSessionBackgroundTasksErrors = {
      * Authentication required
      */
     401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
     /**
      * Session not found
      */
@@ -34474,6 +34889,10 @@ export type GetSessionBackgroundTaskOutputErrors = {
      * Authentication required
      */
     401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
     /**
      * Session not found
      */
@@ -34535,6 +34954,10 @@ export type StopSessionBackgroundTaskErrors = {
      * Authentication required
      */
     401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
     /**
      * Session not found
      */
@@ -34631,6 +35054,10 @@ export type CompactSessionErrors = {
      * Authentication required
      */
     401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
     /**
      * Session not found
      */
@@ -34709,6 +35136,10 @@ export type GetSessionCompactionErrors = {
      * Authentication required
      */
     401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
     /**
      * Session or compaction operation not found
      */
@@ -34762,6 +35193,10 @@ export type ListSessionCompactionsErrors = {
      * Authentication required
      */
     401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
     /**
      * Session not found
      */
@@ -34857,6 +35292,10 @@ export type GetEmbedAppearanceErrors = {
      * Supply a valid embed token or an active publishable key; organization member credentials cannot read this surface.
      */
     401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
     /**
      * The credential's service agent is absent or archived; obtain credentials for an active service agent.
      */
@@ -34893,13 +35332,63 @@ export type GetEmbedAppearanceResponses = {
          */
         launcher?: {
             /**
-             * Entry control: none hides the launcher, bubble shows a button, mascot shows the image.
+             * Entry control: none hides the launcher, bubble shows a button, mascot shows a character that reacts while the visitor types and the agent thinks and answers. A mascot needs pack.
              */
             type: 'none' | 'bubble' | 'mascot';
             /**
-             * Optional HTTPS mascot image URL.
+             * Mascot images: exactly one of preset or images. Send pack, not image.
+             */
+            pack?: {
+                /**
+                 * Built-in character: mint (mint support girl), cat (cat-eared girl) or bot (small robot).
+                 */
+                preset?: 'mint' | 'cat' | 'bot';
+                /**
+                 * One HTTPS image per slot; only idle is required and a missing slot shows idle. Use 2:3 canvases with the feet bottom-centered on a transparent background; PNG or WebP stay still, GIF, WebP and APNG play as they are.
+                 */
+                images?: {
+                    /**
+                     * Resting state.
+                     */
+                    idle: string;
+                    /**
+                     * Page open and while the greeting bubble shows.
+                     */
+                    greet?: string;
+                    /**
+                     * The visitor is typing in the composer.
+                     */
+                    listening?: string;
+                    /**
+                     * After the visitor sends, before the first reply text.
+                     */
+                    thinking?: string;
+                    /**
+                     * While the reply streams; alternates with talking-2 every 220 ms.
+                     */
+                    talking?: string;
+                    /**
+                     * Second mouth frame of talking, mouth closed; without it talking alternates with idle.
+                     */
+                    'talking-2'?: string;
+                    /**
+                     * The last turn failed or was refused.
+                     */
+                    sorry?: string;
+                    /**
+                     * No interaction for 60 seconds; hover or click wakes the mascot.
+                     */
+                    sleep?: string;
+                };
+            };
+            /**
+             * Legacy single mascot image, read as pack.images.idle. When pack is present, pack wins.
              */
             image?: string;
+            /**
+             * float (default) gently floats the mascot, bounces on hover and waves with the greeting; none keeps it still. Reduced-motion settings always win.
+             */
+            motion?: 'float' | 'none';
             /**
              * Launcher corner: bottom-right is the default; bottom-left uses the opposite corner.
              */
@@ -42606,6 +43095,24 @@ export type SessionsDeleteData = {
     query?: never;
     url: '/agent/v1/sessions/{session_id}';
 };
+export type SessionsDeleteErrors = {
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Session not found: the id does not exist in your organization. Take ids from sessions.list or sessions.create.
+     */
+    404: unknown;
+    /**
+     * INVALID_STATE: the session is running. Interrupt it or wait until it is idle or terminated, then delete.
+     */
+    409: unknown;
+};
 export type SessionsDeleteResponses = {
     /**
      * Successful response
@@ -42624,6 +43131,20 @@ export type SessionsRetrieveData = {
     query?: never;
     url: '/agent/v1/sessions/{session_id}';
 };
+export type SessionsRetrieveErrors = {
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Session not found: the id does not exist in your organization. Take ids from sessions.list or sessions.create.
+     */
+    404: unknown;
+};
 export type SessionsRetrieveResponses = {
     /**
      * Successful response
@@ -42655,12 +43176,9 @@ export type SessionsRetrieveResponses = {
              */
             model: {
                 /**
-                 * The model that will power your agent.
-                 *
-                 * See [models](https://docs.anthropic.com/en/docs/models-overview) for additional
-                 * details and options.
+                 * A model id from the Praxis model catalog (`praxis.model.models.list`). Unlike Anthropic, Claude model ids other than those in the catalog are rejected.
                  */
-                id: 'claude-opus-5-5' | 'claude-fable-5-1' | 'claude-sonnet-5' | 'claude-fable-5' | 'claude-opus-5' | 'claude-opus-4-8' | 'claude-opus-4-7' | 'claude-opus-4-6' | 'claude-sonnet-4-6' | 'claude-haiku-4-5' | 'claude-haiku-4-5-20251001' | 'claude-opus-4-5' | 'claude-opus-4-5-20251101' | 'claude-sonnet-4-5' | 'claude-sonnet-4-5-20250929' | string;
+                id: string;
                 /**
                  * How hard Claude works on each turn. Sets `output_config.effort` on every
                  * Messages call the session makes.
@@ -42697,7 +43215,7 @@ export type SessionsRetrieveResponses = {
              */
             name: string;
             /**
-             * Skill attachments are not supported: a nonempty skills array returns 400. Omit this field or send an empty array. The native skill tool loads available runtime skills independently of this field.
+             * Custom skills attached to the agent, each {type: "custom", skill_id, version?}: skill_id comes from skills.create or skills.list, at most 20 skills, no repeated skill_id. Omit version, or send "latest", to use the skill's newest version at the moment a session starts; a pinned version stays fixed. type anthropic returns 400: upload the skill and attach it as custom. On update, omit the field to keep the list, send an array to replace it, or send [] or null to clear it.
              */
             skills: Array<AgentManaged42 | AgentManaged43>;
             /**
@@ -42731,7 +43249,7 @@ export type SessionsRetrieveResponses = {
          */
         created_at: string;
         /**
-         * Execution environment selected for this session. Service sessions return light when environment_id was omitted, or null when explicitly created without a machine; Computer sessions may omit this field.
+         * Execution environment of this session. A service session created without environment_id uses the default environment saved in the agent version (light for a new agent); null means it was created without a machine; Computer sessions may omit this field.
          */
         environment_id?: string;
         metadata: AgentManaged173;
@@ -42853,13 +43371,6 @@ export type SessionsRetrieveResponses = {
 export type SessionsRetrieveResponse = SessionsRetrieveResponses[keyof SessionsRetrieveResponses];
 export type SessionsUpdateData = {
     body: {
-        /**
-         * Mid-session agent configuration update. Only `tools` and
-         * `mcp_servers` are updatable. Full replacement: the provided array becomes the
-         * new value. To preserve existing entries, GET the session, modify the array, and
-         * POST it back.
-         */
-        agent?: AgentManaged182;
         /**
          * A hard spend ceiling. The session stops issuing new model requests
          * once the tracked list cost reaches `max_list_cost`.
@@ -42902,6 +43413,28 @@ export type SessionsUpdateData = {
     query?: never;
     url: '/agent/v1/sessions/{session_id}';
 };
+export type SessionsUpdateErrors = {
+    /**
+     * The body failed validation and the message names the field: an unsupported agent override, a model or thinking selection the agent does not allow, a budget limit at or below the cost already consumed, or invalid vault_ids or metadata.
+     */
+    400: unknown;
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Session not found: the id does not exist in your organization. Take ids from sessions.list or sessions.create.
+     */
+    404: unknown;
+    /**
+     * Session is archived and cannot be updated.
+     */
+    409: unknown;
+};
 export type SessionsUpdateResponses = {
     /**
      * Successful response
@@ -42933,12 +43466,9 @@ export type SessionsUpdateResponses = {
              */
             model: {
                 /**
-                 * The model that will power your agent.
-                 *
-                 * See [models](https://docs.anthropic.com/en/docs/models-overview) for additional
-                 * details and options.
+                 * A model id from the Praxis model catalog (`praxis.model.models.list`). Unlike Anthropic, Claude model ids other than those in the catalog are rejected.
                  */
-                id: 'claude-opus-5-5' | 'claude-fable-5-1' | 'claude-sonnet-5' | 'claude-fable-5' | 'claude-opus-5' | 'claude-opus-4-8' | 'claude-opus-4-7' | 'claude-opus-4-6' | 'claude-sonnet-4-6' | 'claude-haiku-4-5' | 'claude-haiku-4-5-20251001' | 'claude-opus-4-5' | 'claude-opus-4-5-20251101' | 'claude-sonnet-4-5' | 'claude-sonnet-4-5-20250929' | string;
+                id: string;
                 /**
                  * How hard Claude works on each turn. Sets `output_config.effort` on every
                  * Messages call the session makes.
@@ -42975,7 +43505,7 @@ export type SessionsUpdateResponses = {
              */
             name: string;
             /**
-             * Skill attachments are not supported: a nonempty skills array returns 400. Omit this field or send an empty array. The native skill tool loads available runtime skills independently of this field.
+             * Custom skills attached to the agent, each {type: "custom", skill_id, version?}: skill_id comes from skills.create or skills.list, at most 20 skills, no repeated skill_id. Omit version, or send "latest", to use the skill's newest version at the moment a session starts; a pinned version stays fixed. type anthropic returns 400: upload the skill and attach it as custom. On update, omit the field to keep the list, send an array to replace it, or send [] or null to clear it.
              */
             skills: Array<AgentManaged42 | AgentManaged43>;
             /**
@@ -43009,7 +43539,7 @@ export type SessionsUpdateResponses = {
          */
         created_at: string;
         /**
-         * Execution environment selected for this session. Service sessions return light when environment_id was omitted, or null when explicitly created without a machine; Computer sessions may omit this field.
+         * Execution environment of this session. A service session created without environment_id uses the default environment saved in the agent version (light for a new agent); null means it was created without a machine; Computer sessions may omit this field.
          */
         environment_id?: string;
         metadata: AgentManaged173;
@@ -43157,6 +43687,20 @@ export type AgentsListData = {
     };
     url: '/agent/v1/agents';
 };
+export type AgentsListErrors = {
+    /**
+     * include_archived is not true or false, kind is not personal or service, a created_at bound is not an RFC 3339 timestamp, or limit is not an integer from 1 to 100, or page is not a cursor from this same query. Pass next_page unchanged, with the same filters, to continue.
+     */
+    400: unknown;
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+};
 export type AgentsListResponses = {
     /**
      * Successful response
@@ -43192,12 +43736,9 @@ export type AgentsListResponses = {
              */
             model: {
                 /**
-                 * The model that will power your agent.
-                 *
-                 * See [models](https://docs.anthropic.com/en/docs/models-overview) for additional
-                 * details and options.
+                 * A model id from the Praxis model catalog (`praxis.model.models.list`). Unlike Anthropic, Claude model ids other than those in the catalog are rejected.
                  */
-                id: 'claude-opus-5-5' | 'claude-fable-5-1' | 'claude-sonnet-5' | 'claude-fable-5' | 'claude-opus-5' | 'claude-opus-4-8' | 'claude-opus-4-7' | 'claude-opus-4-6' | 'claude-sonnet-4-6' | 'claude-haiku-4-5' | 'claude-haiku-4-5-20251001' | 'claude-opus-4-5' | 'claude-opus-4-5-20251101' | 'claude-sonnet-4-5' | 'claude-sonnet-4-5-20250929' | string;
+                id: string;
                 /**
                  * How hard Claude works on each turn. Sets `output_config.effort` on every
                  * Messages call the session makes.
@@ -43233,7 +43774,7 @@ export type AgentsListResponses = {
              */
             name: string;
             /**
-             * Skill attachments are not supported: a nonempty skills array returns 400. Omit this field or send an empty array. The native skill tool loads available runtime skills independently of this field.
+             * Custom skills attached to the agent, each {type: "custom", skill_id, version?}: skill_id comes from skills.create or skills.list, at most 20 skills, no repeated skill_id. Omit version, or send "latest", to use the skill's newest version at the moment a session starts; a pinned version stays fixed. type anthropic returns 400: upload the skill and attach it as custom. On update, omit the field to keep the list, send an array to replace it, or send [] or null to clear it.
              */
             skills: Array<AgentManaged42 | AgentManaged43>;
             /**
@@ -43292,38 +43833,21 @@ export type AgentsListResponses = {
              */
             note: string | null;
             /**
-             * Database allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
+             * Platform resources and services this service agent's codemode may reach, as one list of typed bindings. Only kind=service accepts a nonempty list; personal agents return 400. There are two kinds. A resource binding names one resource with id and access: database (id db_..., read_only or read_write), vector_store (id vs_..., read_only or read_write), file (id file- plus 24 letters or digits, as the File API returns it; read_only), media_library (any id without ':' or whitespace, read_only or read_write), model (a model catalog id, invoke), workflow and script (id <namespace>/<name>, invoke). A service binding opens a whole service and carries only enabled: search or browser. At most 20 bindings per type, no repeated type and id, and each service type at most once. A session is authorized by the agent version it runs: newly added bindings apply only to new sessions, and a version saved with apply=false changes no access until it is applied. Applying a version that disables, removes or downgrades a binding revokes it immediately in running sessions on older versions. A resource that is not bound returns 404, a service that is not opened returns 403, and a write to a resource bound read_only returns 403 BINDING_READ_ONLY. Unknown types, fields on the wrong kind (id, access or instructions on a service binding), wrong access and malformed ids return 400. The former databases, vector_stores and files fields are removed and return 400. Omit on create for no bindings.
              */
-            databases: Array<{
-                /**
-                 * Resource id from database.databases.list or database.databases.create; use the returned id, not its name. Must start with db_ and be unique within this binding array.
-                 */
-                id: string;
-                /**
-                 * read_only permits reads of the bound resource; read_write permits reads and writes.
-                 */
-                access: 'read_only' | 'read_write';
+            bindings: Array<{
                 /**
-                 * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+                 * Resource type. Decides the id format and the allowed access.
                  */
-                instructions?: string;
+                type: 'database' | 'vector_store' | 'file' | 'media_library' | 'model' | 'workflow' | 'script';
                 /**
-                 * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
-                 */
-                enabled?: boolean;
-            }>;
-            /**
-             * Knowledge vector store allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
-             */
-            vector_stores: Array<{
-                /**
-                 * Resource id from knowledge.vectorStores.list or knowledge.vectorStores.create; use the returned id, not its name. Must start with vs_ and be unique within this binding array.
+                 * Resource id, never its name. database db_..., vector_store vs_..., file file- plus 24 letters or digits; media_library and model ids must not contain ':' or whitespace; workflow and script use <namespace>/<name> with no '/', '@', ':' or whitespace inside a part.
                  */
                 id: string;
                 /**
-                 * read_only permits reads of the bound resource; read_write permits reads and writes.
+                 * database, vector_store and media_library accept read_only or read_write; file accepts read_only; model, workflow and script accept invoke. Any other combination returns 400.
                  */
-                access: 'read_only' | 'read_write';
+                access: 'read_only' | 'read_write' | 'invoke';
                 /**
                  * Optional guidance for using this resource, up to 4096 characters; does not expand access.
                  */
@@ -43332,25 +43856,13 @@ export type AgentsListResponses = {
                  * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
                  */
                 enabled?: boolean;
-            }>;
-            /**
-             * File allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
-             */
-            files: Array<{
-                /**
-                 * Resource id from file.files.list or file.files.create (upload); use the returned id, not its name. Must start with file_ and be unique within this binding array.
-                 */
-                id: string;
-                /**
-                 * read_only permits reading the bound file; files do not accept read_write.
-                 */
-                access: 'read_only';
+            } | {
                 /**
-                 * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+                 * Service type. Opens the whole service to codemode; there is no per-resource id.
                  */
-                instructions?: string;
+                type: 'search' | 'browser';
                 /**
-                 * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+                 * Whether the service is open. Defaults to true; false immediately closes it for running sessions.
                  */
                 enabled?: boolean;
             }>;
@@ -43692,7 +44204,7 @@ export type AgentsListResponses = {
                      */
                     commands?: Array<string>;
                     /**
-                     * Skill attachments are not supported: a nonempty array returns 400. Omit this field or send an empty array; the native skill tool is configured separately through tools.
+                     * Names of disabled skills declarations.
                      */
                     skills?: Array<string>;
                     /**
@@ -43714,6 +44226,26 @@ export type AgentsListResponses = {
                  */
                 allowed: Array<string>;
             };
+            /**
+             * Avatar image URL of this agent version (absolute https), shown in agent lists, the agent detail, the chat header and as the default avatar of embedded chat; null when none is set. Follows the version like other configuration: a version saved with apply=false does not change the avatar in effect. /agent/v1 only.
+             */
+            avatar: string | null;
+            /**
+             * Channel the agent was created through (for example api or console); null for historical agents whose channel is unknown. Display only. /agent/v1 only; /anthropic neither returns it.
+             */
+            creation_source: string | null;
+            /**
+             * Platform-wide identity number of the agent (8 characters), usable wherever an agent is addressed by identity_number; null when the agent has none. /agent/v1 only; /anthropic neither returns it.
+             */
+            identity_number: string | null;
+            /**
+             * Default environment of this service agent version: the environment_id new sessions get when they name none; null means no environment. Present for service agents only. Follows the version like other configuration: a version saved with apply=false does not change the environment in effect. Versions saved before this field existed read as light. /agent/v1 only.
+             */
+            environment_id?: string | null;
+            /**
+             * Default vaults of this service agent version: the vault_ids new sessions get when they name none. Present for service agents only. Follows the version like other configuration: a version saved with apply=false does not change the vaults in effect. Versions saved before this field existed read as []. /agent/v1 only.
+             */
+            vault_ids?: Array<string>;
             /**
              * Current agent lifecycle status; unarchive restores an archived agent to active.
              */
@@ -43729,19 +44261,13 @@ export type AgentsListResponse = AgentsListResponses[keyof AgentsListResponses];
 export type AgentsCreateData = {
     body: {
         /**
-         * Model identifier. Accepts the
-         * [model string](https://platform.claude.com/docs/en/about-claude/models/overview#latest-models-comparison),
-         * e.g. `claude-opus-5`, or a `model_config` object for additional configuration
-         * control
+         * A model id from the Praxis model catalog (`praxis.model.models.list`), or a `model_config` object for additional configuration control. Unlike Anthropic, Claude model ids other than those in the catalog are rejected.
          */
-        model: 'claude-opus-5-5' | 'claude-fable-5-1' | 'claude-sonnet-5' | 'claude-fable-5' | 'claude-opus-5' | 'claude-opus-4-8' | 'claude-opus-4-7' | 'claude-opus-4-6' | 'claude-sonnet-4-6' | 'claude-haiku-4-5' | 'claude-haiku-4-5-20251001' | 'claude-opus-4-5' | 'claude-opus-4-5-20251101' | 'claude-sonnet-4-5' | 'claude-sonnet-4-5-20250929' | string | {
+        model: string | {
             /**
-             * The model that will power your agent.
-             *
-             * See [models](https://docs.anthropic.com/en/docs/models-overview) for additional
-             * details and options.
+             * A model id from the Praxis model catalog (`praxis.model.models.list`). Unlike Anthropic, Claude model ids other than those in the catalog are rejected.
              */
-            id: 'claude-opus-5-5' | 'claude-fable-5-1' | 'claude-sonnet-5' | 'claude-fable-5' | 'claude-opus-5' | 'claude-opus-4-8' | 'claude-opus-4-7' | 'claude-opus-4-6' | 'claude-sonnet-4-6' | 'claude-haiku-4-5' | 'claude-haiku-4-5-20251001' | 'claude-opus-4-5' | 'claude-opus-4-5-20251101' | 'claude-sonnet-4-5' | 'claude-sonnet-4-5-20250929' | string;
+            id: string;
             /**
              * How hard Claude works on each inference call. Accepts a bare level string
              * (`"high"`) or `{"type": "high"}`. On create, omitting it resolves the per-model
@@ -43771,7 +44297,7 @@ export type AgentsCreateData = {
             };
         };
         /**
-         * Human-readable name for the agent.
+         * Display name of the agent, 1 to 256 characters after trimming, with no NUL or line breaks. A label, not a unique key: two agents may share a name.
          */
         name: string;
         /**
@@ -43794,7 +44320,7 @@ export type AgentsCreateData = {
          */
         multiagent?: null | AgentManaged9;
         /**
-         * Skill attachments are not supported: a nonempty array returns 400. Omit this field or send an empty array; the native skill tool is configured separately through tools.
+         * Custom skills attached to the agent, each {type: "custom", skill_id, version?}: skill_id comes from skills.create or skills.list, at most 20 skills, no repeated skill_id. Omit version, or send "latest", to use the skill's newest version at the moment a session starts; a pinned version stays fixed. type anthropic returns 400: upload the skill and attach it as custom. On update, omit the field to keep the list, send an array to replace it, or send [] or null to clear it.
          */
         skills?: Array<AgentManaged13 | AgentManaged14>;
         /**
@@ -43807,38 +44333,21 @@ export type AgentsCreateData = {
          */
         tools?: Array<AgentManaged15 | AgentManaged29 | AgentManaged32>;
         /**
-         * Database allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
+         * Platform resources and services this service agent's codemode may reach, as one list of typed bindings. Only kind=service accepts a nonempty list; personal agents return 400. There are two kinds. A resource binding names one resource with id and access: database (id db_..., read_only or read_write), vector_store (id vs_..., read_only or read_write), file (id file- plus 24 letters or digits, as the File API returns it; read_only), media_library (any id without ':' or whitespace, read_only or read_write), model (a model catalog id, invoke), workflow and script (id <namespace>/<name>, invoke). A service binding opens a whole service and carries only enabled: search or browser. At most 20 bindings per type, no repeated type and id, and each service type at most once. A session is authorized by the agent version it runs: newly added bindings apply only to new sessions, and a version saved with apply=false changes no access until it is applied. Applying a version that disables, removes or downgrades a binding revokes it immediately in running sessions on older versions. A resource that is not bound returns 404, a service that is not opened returns 403, and a write to a resource bound read_only returns 403 BINDING_READ_ONLY. Unknown types, fields on the wrong kind (id, access or instructions on a service binding), wrong access and malformed ids return 400. The former databases, vector_stores and files fields are removed and return 400. Omit on create for no bindings.
          */
-        databases?: Array<{
-            /**
-             * Resource id from database.databases.list or database.databases.create; use the returned id, not its name. Must start with db_ and be unique within this binding array.
-             */
-            id: string;
+        bindings?: Array<{
             /**
-             * read_only permits reads of the bound resource; read_write permits reads and writes.
+             * Resource type. Decides the id format and the allowed access.
              */
-            access: 'read_only' | 'read_write';
+            type: 'database' | 'vector_store' | 'file' | 'media_library' | 'model' | 'workflow' | 'script';
             /**
-             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
-             */
-            instructions?: string;
-            /**
-             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
-             */
-            enabled?: boolean;
-        }>;
-        /**
-         * Knowledge vector store allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
-         */
-        vector_stores?: Array<{
-            /**
-             * Resource id from knowledge.vectorStores.list or knowledge.vectorStores.create; use the returned id, not its name. Must start with vs_ and be unique within this binding array.
+             * Resource id, never its name. database db_..., vector_store vs_..., file file- plus 24 letters or digits; media_library and model ids must not contain ':' or whitespace; workflow and script use <namespace>/<name> with no '/', '@', ':' or whitespace inside a part.
              */
             id: string;
             /**
-             * read_only permits reads of the bound resource; read_write permits reads and writes.
+             * database, vector_store and media_library accept read_only or read_write; file accepts read_only; model, workflow and script accept invoke. Any other combination returns 400.
              */
-            access: 'read_only' | 'read_write';
+            access: 'read_only' | 'read_write' | 'invoke';
             /**
              * Optional guidance for using this resource, up to 4096 characters; does not expand access.
              */
@@ -43847,25 +44356,13 @@ export type AgentsCreateData = {
              * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
              */
             enabled?: boolean;
-        }>;
-        /**
-         * File allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
-         */
-        files?: Array<{
-            /**
-             * Resource id from file.files.list or file.files.create (upload); use the returned id, not its name. Must start with file_ and be unique within this binding array.
-             */
-            id: string;
-            /**
-             * read_only permits reading the bound file; files do not accept read_write.
-             */
-            access: 'read_only';
+        } | {
             /**
-             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+             * Service type. Opens the whole service to codemode; there is no per-resource id.
              */
-            instructions?: string;
+            type: 'search' | 'browser';
             /**
-             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+             * Whether the service is open. Defaults to true; false immediately closes it for running sessions.
              */
             enabled?: boolean;
         }>;
@@ -44207,7 +44704,7 @@ export type AgentsCreateData = {
                  */
                 commands?: Array<string>;
                 /**
-                 * Skill attachments are not supported: a nonempty array returns 400. Omit this field or send an empty array; the native skill tool is configured separately through tools.
+                 * Names of disabled skills declarations.
                  */
                 skills?: Array<string>;
                 /**
@@ -44229,6 +44726,18 @@ export type AgentsCreateData = {
              */
             allowed: Array<string>;
         };
+        /**
+         * Avatar image of the agent: an absolute https URL of at most 2048 characters, without credentials; any other value returns 400 avatar must be an https URL. It is the default picture in agent lists, the agent detail, the chat header and embedded chat when the embed appearance sets none. Saved with the agent version like other configuration, so apply=false keeps the previous avatar in effect until that version is applied. Omit on create for no avatar; on update, omit to keep it and send null to clear it. Both personal and service agents accept it. /agent/v1 only; /anthropic neither accepts nor returns it.
+         */
+        avatar?: string | null;
+        /**
+         * Default environment of a service agent: the environment_id a new session gets when it names none. Use light, node22 or the env_ id of an active environment of your organization; any other value returns 400 environment_id <id> was not found. null means no environment, so sessions are plain conversation without codemode or bash. Saved with the agent version like other configuration, so apply=false keeps the previous environment in effect for new sessions until that version is applied; a session that sets environment_id itself, null included, overrides it. Omit on create for light; on update, omit to keep it. Versions saved before this field existed read as light. Personal agents use a Computer: a non-null value returns 400 and the field is not returned. /agent/v1 only; /anthropic neither accepts nor returns it.
+         */
+        environment_id?: string | null;
+        /**
+         * Default vaults of a service agent: the vault_ids a new session gets when it names none, so the agent's credentials follow the version. At most 50 ids without duplicates; each must be a vault of your organization that is not archived, otherwise 400 vault_ids[<index>] <id> was not found. Saved with the agent version like other configuration, so apply=false keeps the previous vaults in effect for new sessions until that version is applied; a session that sets vault_ids itself, [] included, overrides it. Omit on create for []; on update, omit to keep the list and send an array to replace it as a whole. Versions saved before this field existed read as []. Embed tokens use the vault_ids of the version they pin; vault_ids on the embed policy is deprecated, still accepted and ignored. Personal agents get no default vaults: a non-empty value returns 400 and the field is not returned. /agent/v1 only; /anthropic neither accepts nor returns it.
+         */
+        vault_ids?: Array<string>;
         /**
          * Optional tool preset. minimal enables read, glob, grep and ask_user_question; data-editor also enables write and edit; full uses the default toolset with always_allow. Explicit tools override matching preset entries. codemode requires bash and is absent from data-editor.
          */
@@ -44238,6 +44747,24 @@ export type AgentsCreateData = {
     query?: never;
     url: '/agent/v1/agents';
 };
+export type AgentsCreateErrors = {
+    /**
+     * The body failed validation and the message names the field: an unknown field, name outside 1 to 256 characters, a model that is not in the catalog or cannot run an agent, invalid tools or tools: null, a skill that is anthropic, repeated or not found, invalid bindings or vault_ids, or an environment_id that does not exist. Correct the field and retry.
+     */
+    400: unknown;
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * The vault availability check for vault_ids failed upstream; nothing was saved. Retry later.
+     */
+    502: unknown;
+};
 export type AgentsCreateResponses = {
     /**
      * Successful response
@@ -44269,12 +44796,9 @@ export type AgentsCreateResponses = {
          */
         model: {
             /**
-             * The model that will power your agent.
-             *
-             * See [models](https://docs.anthropic.com/en/docs/models-overview) for additional
-             * details and options.
+             * A model id from the Praxis model catalog (`praxis.model.models.list`). Unlike Anthropic, Claude model ids other than those in the catalog are rejected.
              */
-            id: 'claude-opus-5-5' | 'claude-fable-5-1' | 'claude-sonnet-5' | 'claude-fable-5' | 'claude-opus-5' | 'claude-opus-4-8' | 'claude-opus-4-7' | 'claude-opus-4-6' | 'claude-sonnet-4-6' | 'claude-haiku-4-5' | 'claude-haiku-4-5-20251001' | 'claude-opus-4-5' | 'claude-opus-4-5-20251101' | 'claude-sonnet-4-5' | 'claude-sonnet-4-5-20250929' | string;
+            id: string;
             /**
              * How hard Claude works on each turn. Sets `output_config.effort` on every
              * Messages call the session makes.
@@ -44310,7 +44834,7 @@ export type AgentsCreateResponses = {
          */
         name: string;
         /**
-         * Skill attachments are not supported: a nonempty skills array returns 400. Omit this field or send an empty array. The native skill tool loads available runtime skills independently of this field.
+         * Custom skills attached to the agent, each {type: "custom", skill_id, version?}: skill_id comes from skills.create or skills.list, at most 20 skills, no repeated skill_id. Omit version, or send "latest", to use the skill's newest version at the moment a session starts; a pinned version stays fixed. type anthropic returns 400: upload the skill and attach it as custom. On update, omit the field to keep the list, send an array to replace it, or send [] or null to clear it.
          */
         skills: Array<AgentManaged42 | AgentManaged43>;
         /**
@@ -44369,38 +44893,21 @@ export type AgentsCreateResponses = {
          */
         note: string | null;
         /**
-         * Database allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
+         * Platform resources and services this service agent's codemode may reach, as one list of typed bindings. Only kind=service accepts a nonempty list; personal agents return 400. There are two kinds. A resource binding names one resource with id and access: database (id db_..., read_only or read_write), vector_store (id vs_..., read_only or read_write), file (id file- plus 24 letters or digits, as the File API returns it; read_only), media_library (any id without ':' or whitespace, read_only or read_write), model (a model catalog id, invoke), workflow and script (id <namespace>/<name>, invoke). A service binding opens a whole service and carries only enabled: search or browser. At most 20 bindings per type, no repeated type and id, and each service type at most once. A session is authorized by the agent version it runs: newly added bindings apply only to new sessions, and a version saved with apply=false changes no access until it is applied. Applying a version that disables, removes or downgrades a binding revokes it immediately in running sessions on older versions. A resource that is not bound returns 404, a service that is not opened returns 403, and a write to a resource bound read_only returns 403 BINDING_READ_ONLY. Unknown types, fields on the wrong kind (id, access or instructions on a service binding), wrong access and malformed ids return 400. The former databases, vector_stores and files fields are removed and return 400. Omit on create for no bindings.
          */
-        databases: Array<{
-            /**
-             * Resource id from database.databases.list or database.databases.create; use the returned id, not its name. Must start with db_ and be unique within this binding array.
-             */
-            id: string;
-            /**
-             * read_only permits reads of the bound resource; read_write permits reads and writes.
-             */
-            access: 'read_only' | 'read_write';
+        bindings: Array<{
             /**
-             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
-             */
-            instructions?: string;
-            /**
-             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+             * Resource type. Decides the id format and the allowed access.
              */
-            enabled?: boolean;
-        }>;
-        /**
-         * Knowledge vector store allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
-         */
-        vector_stores: Array<{
+            type: 'database' | 'vector_store' | 'file' | 'media_library' | 'model' | 'workflow' | 'script';
             /**
-             * Resource id from knowledge.vectorStores.list or knowledge.vectorStores.create; use the returned id, not its name. Must start with vs_ and be unique within this binding array.
+             * Resource id, never its name. database db_..., vector_store vs_..., file file- plus 24 letters or digits; media_library and model ids must not contain ':' or whitespace; workflow and script use <namespace>/<name> with no '/', '@', ':' or whitespace inside a part.
              */
             id: string;
             /**
-             * read_only permits reads of the bound resource; read_write permits reads and writes.
+             * database, vector_store and media_library accept read_only or read_write; file accepts read_only; model, workflow and script accept invoke. Any other combination returns 400.
              */
-            access: 'read_only' | 'read_write';
+            access: 'read_only' | 'read_write' | 'invoke';
             /**
              * Optional guidance for using this resource, up to 4096 characters; does not expand access.
              */
@@ -44409,25 +44916,13 @@ export type AgentsCreateResponses = {
              * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
              */
             enabled?: boolean;
-        }>;
-        /**
-         * File allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
-         */
-        files: Array<{
-            /**
-             * Resource id from file.files.list or file.files.create (upload); use the returned id, not its name. Must start with file_ and be unique within this binding array.
-             */
-            id: string;
-            /**
-             * read_only permits reading the bound file; files do not accept read_write.
-             */
-            access: 'read_only';
+        } | {
             /**
-             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+             * Service type. Opens the whole service to codemode; there is no per-resource id.
              */
-            instructions?: string;
+            type: 'search' | 'browser';
             /**
-             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+             * Whether the service is open. Defaults to true; false immediately closes it for running sessions.
              */
             enabled?: boolean;
         }>;
@@ -44769,7 +45264,7 @@ export type AgentsCreateResponses = {
                  */
                 commands?: Array<string>;
                 /**
-                 * Skill attachments are not supported: a nonempty array returns 400. Omit this field or send an empty array; the native skill tool is configured separately through tools.
+                 * Names of disabled skills declarations.
                  */
                 skills?: Array<string>;
                 /**
@@ -44791,6 +45286,26 @@ export type AgentsCreateResponses = {
              */
             allowed: Array<string>;
         };
+        /**
+         * Avatar image URL of this agent version (absolute https), shown in agent lists, the agent detail, the chat header and as the default avatar of embedded chat; null when none is set. Follows the version like other configuration: a version saved with apply=false does not change the avatar in effect. /agent/v1 only.
+         */
+        avatar: string | null;
+        /**
+         * Channel the agent was created through (for example api or console); null for historical agents whose channel is unknown. Display only. /agent/v1 only; /anthropic neither returns it.
+         */
+        creation_source: string | null;
+        /**
+         * Platform-wide identity number of the agent (8 characters), usable wherever an agent is addressed by identity_number; null when the agent has none. /agent/v1 only; /anthropic neither returns it.
+         */
+        identity_number: string | null;
+        /**
+         * Default environment of this service agent version: the environment_id new sessions get when they name none; null means no environment. Present for service agents only. Follows the version like other configuration: a version saved with apply=false does not change the environment in effect. Versions saved before this field existed read as light. /agent/v1 only.
+         */
+        environment_id?: string | null;
+        /**
+         * Default vaults of this service agent version: the vault_ids new sessions get when they name none. Present for service agents only. Follows the version like other configuration: a version saved with apply=false does not change the vaults in effect. Versions saved before this field existed read as []. /agent/v1 only.
+         */
+        vault_ids?: Array<string>;
         /**
          * Current agent lifecycle status; unarchive restores an archived agent to active.
          */
@@ -44815,6 +45330,24 @@ export type AgentsRetrieveData = {
     };
     url: '/agent/v1/agents/{agent_id}';
 };
+export type AgentsRetrieveErrors = {
+    /**
+     * version is not a positive integer. Take versions from agents.versions.list.
+     */
+    400: unknown;
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Agent not found, or the requested version does not exist for it. Take ids from agents.list and versions from agents.versions.list.
+     */
+    404: unknown;
+};
 export type AgentsRetrieveResponses = {
     /**
      * Successful response
@@ -44846,12 +45379,9 @@ export type AgentsRetrieveResponses = {
          */
         model: {
             /**
-             * The model that will power your agent.
-             *
-             * See [models](https://docs.anthropic.com/en/docs/models-overview) for additional
-             * details and options.
+             * A model id from the Praxis model catalog (`praxis.model.models.list`). Unlike Anthropic, Claude model ids other than those in the catalog are rejected.
              */
-            id: 'claude-opus-5-5' | 'claude-fable-5-1' | 'claude-sonnet-5' | 'claude-fable-5' | 'claude-opus-5' | 'claude-opus-4-8' | 'claude-opus-4-7' | 'claude-opus-4-6' | 'claude-sonnet-4-6' | 'claude-haiku-4-5' | 'claude-haiku-4-5-20251001' | 'claude-opus-4-5' | 'claude-opus-4-5-20251101' | 'claude-sonnet-4-5' | 'claude-sonnet-4-5-20250929' | string;
+            id: string;
             /**
              * How hard Claude works on each turn. Sets `output_config.effort` on every
              * Messages call the session makes.
@@ -44887,7 +45417,7 @@ export type AgentsRetrieveResponses = {
          */
         name: string;
         /**
-         * Skill attachments are not supported: a nonempty skills array returns 400. Omit this field or send an empty array. The native skill tool loads available runtime skills independently of this field.
+         * Custom skills attached to the agent, each {type: "custom", skill_id, version?}: skill_id comes from skills.create or skills.list, at most 20 skills, no repeated skill_id. Omit version, or send "latest", to use the skill's newest version at the moment a session starts; a pinned version stays fixed. type anthropic returns 400: upload the skill and attach it as custom. On update, omit the field to keep the list, send an array to replace it, or send [] or null to clear it.
          */
         skills: Array<AgentManaged42 | AgentManaged43>;
         /**
@@ -44946,38 +45476,21 @@ export type AgentsRetrieveResponses = {
          */
         note: string | null;
         /**
-         * Database allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
+         * Platform resources and services this service agent's codemode may reach, as one list of typed bindings. Only kind=service accepts a nonempty list; personal agents return 400. There are two kinds. A resource binding names one resource with id and access: database (id db_..., read_only or read_write), vector_store (id vs_..., read_only or read_write), file (id file- plus 24 letters or digits, as the File API returns it; read_only), media_library (any id without ':' or whitespace, read_only or read_write), model (a model catalog id, invoke), workflow and script (id <namespace>/<name>, invoke). A service binding opens a whole service and carries only enabled: search or browser. At most 20 bindings per type, no repeated type and id, and each service type at most once. A session is authorized by the agent version it runs: newly added bindings apply only to new sessions, and a version saved with apply=false changes no access until it is applied. Applying a version that disables, removes or downgrades a binding revokes it immediately in running sessions on older versions. A resource that is not bound returns 404, a service that is not opened returns 403, and a write to a resource bound read_only returns 403 BINDING_READ_ONLY. Unknown types, fields on the wrong kind (id, access or instructions on a service binding), wrong access and malformed ids return 400. The former databases, vector_stores and files fields are removed and return 400. Omit on create for no bindings.
          */
-        databases: Array<{
+        bindings: Array<{
             /**
-             * Resource id from database.databases.list or database.databases.create; use the returned id, not its name. Must start with db_ and be unique within this binding array.
+             * Resource type. Decides the id format and the allowed access.
              */
-            id: string;
-            /**
-             * read_only permits reads of the bound resource; read_write permits reads and writes.
-             */
-            access: 'read_only' | 'read_write';
-            /**
-             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
-             */
-            instructions?: string;
-            /**
-             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
-             */
-            enabled?: boolean;
-        }>;
-        /**
-         * Knowledge vector store allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
-         */
-        vector_stores: Array<{
+            type: 'database' | 'vector_store' | 'file' | 'media_library' | 'model' | 'workflow' | 'script';
             /**
-             * Resource id from knowledge.vectorStores.list or knowledge.vectorStores.create; use the returned id, not its name. Must start with vs_ and be unique within this binding array.
+             * Resource id, never its name. database db_..., vector_store vs_..., file file- plus 24 letters or digits; media_library and model ids must not contain ':' or whitespace; workflow and script use <namespace>/<name> with no '/', '@', ':' or whitespace inside a part.
              */
             id: string;
             /**
-             * read_only permits reads of the bound resource; read_write permits reads and writes.
+             * database, vector_store and media_library accept read_only or read_write; file accepts read_only; model, workflow and script accept invoke. Any other combination returns 400.
              */
-            access: 'read_only' | 'read_write';
+            access: 'read_only' | 'read_write' | 'invoke';
             /**
              * Optional guidance for using this resource, up to 4096 characters; does not expand access.
              */
@@ -44986,25 +45499,13 @@ export type AgentsRetrieveResponses = {
              * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
              */
             enabled?: boolean;
-        }>;
-        /**
-         * File allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
-         */
-        files: Array<{
-            /**
-             * Resource id from file.files.list or file.files.create (upload); use the returned id, not its name. Must start with file_ and be unique within this binding array.
-             */
-            id: string;
+        } | {
             /**
-             * read_only permits reading the bound file; files do not accept read_write.
+             * Service type. Opens the whole service to codemode; there is no per-resource id.
              */
-            access: 'read_only';
+            type: 'search' | 'browser';
             /**
-             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
-             */
-            instructions?: string;
-            /**
-             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+             * Whether the service is open. Defaults to true; false immediately closes it for running sessions.
              */
             enabled?: boolean;
         }>;
@@ -45346,7 +45847,7 @@ export type AgentsRetrieveResponses = {
                  */
                 commands?: Array<string>;
                 /**
-                 * Skill attachments are not supported: a nonempty array returns 400. Omit this field or send an empty array; the native skill tool is configured separately through tools.
+                 * Names of disabled skills declarations.
                  */
                 skills?: Array<string>;
                 /**
@@ -45368,6 +45869,26 @@ export type AgentsRetrieveResponses = {
              */
             allowed: Array<string>;
         };
+        /**
+         * Avatar image URL of this agent version (absolute https), shown in agent lists, the agent detail, the chat header and as the default avatar of embedded chat; null when none is set. Follows the version like other configuration: a version saved with apply=false does not change the avatar in effect. /agent/v1 only.
+         */
+        avatar: string | null;
+        /**
+         * Channel the agent was created through (for example api or console); null for historical agents whose channel is unknown. Display only. /agent/v1 only; /anthropic neither returns it.
+         */
+        creation_source: string | null;
+        /**
+         * Platform-wide identity number of the agent (8 characters), usable wherever an agent is addressed by identity_number; null when the agent has none. /agent/v1 only; /anthropic neither returns it.
+         */
+        identity_number: string | null;
+        /**
+         * Default environment of this service agent version: the environment_id new sessions get when they name none; null means no environment. Present for service agents only. Follows the version like other configuration: a version saved with apply=false does not change the environment in effect. Versions saved before this field existed read as light. /agent/v1 only.
+         */
+        environment_id?: string | null;
+        /**
+         * Default vaults of this service agent version: the vault_ids new sessions get when they name none. Present for service agents only. Follows the version like other configuration: a version saved with apply=false does not change the vaults in effect. Versions saved before this field existed read as []. /agent/v1 only.
+         */
+        vault_ids?: Array<string>;
         /**
          * Current agent lifecycle status; unarchive restores an archived agent to active.
          */
@@ -45392,19 +45913,13 @@ export type AgentsUpdateData = {
          */
         metadata?: null | AgentManaged58Writable;
         /**
-         * Model identifier. Accepts the
-         * [model string](https://platform.claude.com/docs/en/about-claude/models/overview#latest-models-comparison),
-         * e.g. `claude-opus-5`, or a `model_config` object for additional configuration
-         * control. Omit to preserve. Cannot be cleared.
+         * A model id from the Praxis model catalog (`praxis.model.models.list`), or a `model_config` object for additional configuration control. Unlike Anthropic, Claude model ids other than those in the catalog are rejected.
          */
-        model?: 'claude-opus-5-5' | 'claude-fable-5-1' | 'claude-sonnet-5' | 'claude-fable-5' | 'claude-opus-5' | 'claude-opus-4-8' | 'claude-opus-4-7' | 'claude-opus-4-6' | 'claude-sonnet-4-6' | 'claude-haiku-4-5' | 'claude-haiku-4-5-20251001' | 'claude-opus-4-5' | 'claude-opus-4-5-20251101' | 'claude-sonnet-4-5' | 'claude-sonnet-4-5-20250929' | string | {
+        model?: string | {
             /**
-             * The model that will power your agent.
-             *
-             * See [models](https://docs.anthropic.com/en/docs/models-overview) for additional
-             * details and options.
+             * A model id from the Praxis model catalog (`praxis.model.models.list`). Unlike Anthropic, Claude model ids other than those in the catalog are rejected.
              */
-            id: 'claude-opus-5-5' | 'claude-fable-5-1' | 'claude-sonnet-5' | 'claude-fable-5' | 'claude-opus-5' | 'claude-opus-4-8' | 'claude-opus-4-7' | 'claude-opus-4-6' | 'claude-sonnet-4-6' | 'claude-haiku-4-5' | 'claude-haiku-4-5-20251001' | 'claude-opus-4-5' | 'claude-opus-4-5-20251101' | 'claude-sonnet-4-5' | 'claude-sonnet-4-5-20250929' | string;
+            id: string;
             /**
              * How hard Claude works on each inference call. Accepts a bare level string
              * (`"high"`) or `{"type": "high"}`. On create, omitting it resolves the per-model
@@ -45440,12 +45955,11 @@ export type AgentsUpdateData = {
          */
         multiagent?: null | AgentManaged9;
         /**
-         * Human-readable name. Must be non-empty. Omit to preserve. Cannot be
-         * cleared.
+         * New display name, 1 to 256 characters after trimming, with no NUL or line breaks. A label, not a unique key; omit to keep the current name.
          */
         name?: string;
         /**
-         * Skill attachments are not supported: a nonempty array returns 400. Omit this field or send an empty array; the native skill tool is configured separately through tools.
+         * Custom skills attached to the agent, each {type: "custom", skill_id, version?}: skill_id comes from skills.create or skills.list, at most 20 skills, no repeated skill_id. Omit version, or send "latest", to use the skill's newest version at the moment a session starts; a pinned version stays fixed. type anthropic returns 400: upload the skill and attach it as custom. On update, omit the field to keep the list, send an array to replace it, or send [] or null to clear it.
          */
         skills?: null | Array<AgentManaged13 | AgentManaged14>;
         /**
@@ -45474,38 +45988,21 @@ export type AgentsUpdateData = {
          */
         version_note?: string;
         /**
-         * Replace this resource allowlist; omission preserves it, and null or [] clears it. Additions apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Only service agents accept nonempty bindings.
+         * Replace the whole bindings list; omission preserves it, and null or [] clears it. Additions apply only to new sessions; once this version is applied, disabling, removing or downgrading a binding revokes it immediately in running sessions on older versions, while apply=false changes no access. Only service agents accept a nonempty list.
          */
-        databases?: Array<{
-            /**
-             * Resource id from database.databases.list or database.databases.create; use the returned id, not its name. Must start with db_ and be unique within this binding array.
-             */
-            id: string;
+        bindings?: Array<{
             /**
-             * read_only permits reads of the bound resource; read_write permits reads and writes.
+             * Resource type. Decides the id format and the allowed access.
              */
-            access: 'read_only' | 'read_write';
+            type: 'database' | 'vector_store' | 'file' | 'media_library' | 'model' | 'workflow' | 'script';
             /**
-             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
-             */
-            instructions?: string;
-            /**
-             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
-             */
-            enabled?: boolean;
-        }> | null;
-        /**
-         * Replace this resource allowlist; omission preserves it, and null or [] clears it. Additions apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Only service agents accept nonempty bindings.
-         */
-        vector_stores?: Array<{
-            /**
-             * Resource id from knowledge.vectorStores.list or knowledge.vectorStores.create; use the returned id, not its name. Must start with vs_ and be unique within this binding array.
+             * Resource id, never its name. database db_..., vector_store vs_..., file file- plus 24 letters or digits; media_library and model ids must not contain ':' or whitespace; workflow and script use <namespace>/<name> with no '/', '@', ':' or whitespace inside a part.
              */
             id: string;
             /**
-             * read_only permits reads of the bound resource; read_write permits reads and writes.
+             * database, vector_store and media_library accept read_only or read_write; file accepts read_only; model, workflow and script accept invoke. Any other combination returns 400.
              */
-            access: 'read_only' | 'read_write';
+            access: 'read_only' | 'read_write' | 'invoke';
             /**
              * Optional guidance for using this resource, up to 4096 characters; does not expand access.
              */
@@ -45514,25 +46011,13 @@ export type AgentsUpdateData = {
              * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
              */
             enabled?: boolean;
-        }> | null;
-        /**
-         * Replace this resource allowlist; omission preserves it, and null or [] clears it. Additions apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Only service agents accept nonempty bindings.
-         */
-        files?: Array<{
-            /**
-             * Resource id from file.files.list or file.files.create (upload); use the returned id, not its name. Must start with file_ and be unique within this binding array.
-             */
-            id: string;
-            /**
-             * read_only permits reading the bound file; files do not accept read_write.
-             */
-            access: 'read_only';
+        } | {
             /**
-             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+             * Service type. Opens the whole service to codemode; there is no per-resource id.
              */
-            instructions?: string;
+            type: 'search' | 'browser';
             /**
-             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+             * Whether the service is open. Defaults to true; false immediately closes it for running sessions.
              */
             enabled?: boolean;
         }> | null;
@@ -45874,7 +46359,7 @@ export type AgentsUpdateData = {
                  */
                 commands?: Array<string>;
                 /**
-                 * Skill attachments are not supported: a nonempty array returns 400. Omit this field or send an empty array; the native skill tool is configured separately through tools.
+                 * Names of disabled skills declarations.
                  */
                 skills?: Array<string>;
                 /**
@@ -45896,6 +46381,18 @@ export type AgentsUpdateData = {
              */
             allowed: Array<string>;
         };
+        /**
+         * Avatar image of the agent: an absolute https URL of at most 2048 characters, without credentials; any other value returns 400 avatar must be an https URL. It is the default picture in agent lists, the agent detail, the chat header and embedded chat when the embed appearance sets none. Saved with the agent version like other configuration, so apply=false keeps the previous avatar in effect until that version is applied. Omit on create for no avatar; on update, omit to keep it and send null to clear it. Both personal and service agents accept it. /agent/v1 only; /anthropic neither accepts nor returns it.
+         */
+        avatar?: string | null;
+        /**
+         * Default environment of a service agent: the environment_id a new session gets when it names none. Use light, node22 or the env_ id of an active environment of your organization; any other value returns 400 environment_id <id> was not found. null means no environment, so sessions are plain conversation without codemode or bash. Saved with the agent version like other configuration, so apply=false keeps the previous environment in effect for new sessions until that version is applied; a session that sets environment_id itself, null included, overrides it. Omit on create for light; on update, omit to keep it. Versions saved before this field existed read as light. Personal agents use a Computer: a non-null value returns 400 and the field is not returned. /agent/v1 only; /anthropic neither accepts nor returns it.
+         */
+        environment_id?: string | null;
+        /**
+         * Default vaults of a service agent: the vault_ids a new session gets when it names none, so the agent's credentials follow the version. At most 50 ids without duplicates; each must be a vault of your organization that is not archived, otherwise 400 vault_ids[<index>] <id> was not found. Saved with the agent version like other configuration, so apply=false keeps the previous vaults in effect for new sessions until that version is applied; a session that sets vault_ids itself, [] included, overrides it. Omit on create for []; on update, omit to keep the list and send an array to replace it as a whole. Versions saved before this field existed read as []. Embed tokens use the vault_ids of the version they pin; vault_ids on the embed policy is deprecated, still accepted and ignored. Personal agents get no default vaults: a non-empty value returns 400 and the field is not returned. /agent/v1 only; /anthropic neither accepts nor returns it.
+         */
+        vault_ids?: Array<string>;
         /**
          * Optional tool preset. minimal enables read, glob, grep and ask_user_question; data-editor also enables write and edit; full uses the default toolset with always_allow. Explicit tools override matching preset entries. codemode requires bash and is absent from data-editor.
          */
@@ -45910,6 +46407,28 @@ export type AgentsUpdateData = {
     query?: never;
     url: '/agent/v1/agents/{agent_id}';
 };
+export type AgentsUpdateErrors = {
+    /**
+     * The body failed validation and the message names the field (same rules as agents.create, including tools: null).
+     */
+    400: unknown;
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Agent not found: the id does not exist in your organization. Take ids from agents.list or agents.create.
+     */
+    404: unknown;
+    /**
+     * Agent is archived (unarchive it first), or version does not match the agent's current version (retrieve it again and resend with that version), or a newer version saved with apply false is waiting (apply it or save over it).
+     */
+    409: unknown;
+};
 export type AgentsUpdateResponses = {
     /**
      * Successful response
@@ -45941,12 +46460,9 @@ export type AgentsUpdateResponses = {
          */
         model: {
             /**
-             * The model that will power your agent.
-             *
-             * See [models](https://docs.anthropic.com/en/docs/models-overview) for additional
-             * details and options.
+             * A model id from the Praxis model catalog (`praxis.model.models.list`). Unlike Anthropic, Claude model ids other than those in the catalog are rejected.
              */
-            id: 'claude-opus-5-5' | 'claude-fable-5-1' | 'claude-sonnet-5' | 'claude-fable-5' | 'claude-opus-5' | 'claude-opus-4-8' | 'claude-opus-4-7' | 'claude-opus-4-6' | 'claude-sonnet-4-6' | 'claude-haiku-4-5' | 'claude-haiku-4-5-20251001' | 'claude-opus-4-5' | 'claude-opus-4-5-20251101' | 'claude-sonnet-4-5' | 'claude-sonnet-4-5-20250929' | string;
+            id: string;
             /**
              * How hard Claude works on each turn. Sets `output_config.effort` on every
              * Messages call the session makes.
@@ -45982,7 +46498,7 @@ export type AgentsUpdateResponses = {
          */
         name: string;
         /**
-         * Skill attachments are not supported: a nonempty skills array returns 400. Omit this field or send an empty array. The native skill tool loads available runtime skills independently of this field.
+         * Custom skills attached to the agent, each {type: "custom", skill_id, version?}: skill_id comes from skills.create or skills.list, at most 20 skills, no repeated skill_id. Omit version, or send "latest", to use the skill's newest version at the moment a session starts; a pinned version stays fixed. type anthropic returns 400: upload the skill and attach it as custom. On update, omit the field to keep the list, send an array to replace it, or send [] or null to clear it.
          */
         skills: Array<AgentManaged42 | AgentManaged43>;
         /**
@@ -46041,38 +46557,21 @@ export type AgentsUpdateResponses = {
          */
         note: string | null;
         /**
-         * Database allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
+         * Platform resources and services this service agent's codemode may reach, as one list of typed bindings. Only kind=service accepts a nonempty list; personal agents return 400. There are two kinds. A resource binding names one resource with id and access: database (id db_..., read_only or read_write), vector_store (id vs_..., read_only or read_write), file (id file- plus 24 letters or digits, as the File API returns it; read_only), media_library (any id without ':' or whitespace, read_only or read_write), model (a model catalog id, invoke), workflow and script (id <namespace>/<name>, invoke). A service binding opens a whole service and carries only enabled: search or browser. At most 20 bindings per type, no repeated type and id, and each service type at most once. A session is authorized by the agent version it runs: newly added bindings apply only to new sessions, and a version saved with apply=false changes no access until it is applied. Applying a version that disables, removes or downgrades a binding revokes it immediately in running sessions on older versions. A resource that is not bound returns 404, a service that is not opened returns 403, and a write to a resource bound read_only returns 403 BINDING_READ_ONLY. Unknown types, fields on the wrong kind (id, access or instructions on a service binding), wrong access and malformed ids return 400. The former databases, vector_stores and files fields are removed and return 400. Omit on create for no bindings.
          */
-        databases: Array<{
+        bindings: Array<{
             /**
-             * Resource id from database.databases.list or database.databases.create; use the returned id, not its name. Must start with db_ and be unique within this binding array.
+             * Resource type. Decides the id format and the allowed access.
              */
-            id: string;
+            type: 'database' | 'vector_store' | 'file' | 'media_library' | 'model' | 'workflow' | 'script';
             /**
-             * read_only permits reads of the bound resource; read_write permits reads and writes.
-             */
-            access: 'read_only' | 'read_write';
-            /**
-             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
-             */
-            instructions?: string;
-            /**
-             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
-             */
-            enabled?: boolean;
-        }>;
-        /**
-         * Knowledge vector store allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
-         */
-        vector_stores: Array<{
-            /**
-             * Resource id from knowledge.vectorStores.list or knowledge.vectorStores.create; use the returned id, not its name. Must start with vs_ and be unique within this binding array.
+             * Resource id, never its name. database db_..., vector_store vs_..., file file- plus 24 letters or digits; media_library and model ids must not contain ':' or whitespace; workflow and script use <namespace>/<name> with no '/', '@', ':' or whitespace inside a part.
              */
             id: string;
             /**
-             * read_only permits reads of the bound resource; read_write permits reads and writes.
+             * database, vector_store and media_library accept read_only or read_write; file accepts read_only; model, workflow and script accept invoke. Any other combination returns 400.
              */
-            access: 'read_only' | 'read_write';
+            access: 'read_only' | 'read_write' | 'invoke';
             /**
              * Optional guidance for using this resource, up to 4096 characters; does not expand access.
              */
@@ -46081,25 +46580,13 @@ export type AgentsUpdateResponses = {
              * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
              */
             enabled?: boolean;
-        }>;
-        /**
-         * File allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
-         */
-        files: Array<{
-            /**
-             * Resource id from file.files.list or file.files.create (upload); use the returned id, not its name. Must start with file_ and be unique within this binding array.
-             */
-            id: string;
-            /**
-             * read_only permits reading the bound file; files do not accept read_write.
-             */
-            access: 'read_only';
+        } | {
             /**
-             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+             * Service type. Opens the whole service to codemode; there is no per-resource id.
              */
-            instructions?: string;
+            type: 'search' | 'browser';
             /**
-             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+             * Whether the service is open. Defaults to true; false immediately closes it for running sessions.
              */
             enabled?: boolean;
         }>;
@@ -46441,7 +46928,7 @@ export type AgentsUpdateResponses = {
                  */
                 commands?: Array<string>;
                 /**
-                 * Skill attachments are not supported: a nonempty array returns 400. Omit this field or send an empty array; the native skill tool is configured separately through tools.
+                 * Names of disabled skills declarations.
                  */
                 skills?: Array<string>;
                 /**
@@ -46463,6 +46950,26 @@ export type AgentsUpdateResponses = {
              */
             allowed: Array<string>;
         };
+        /**
+         * Avatar image URL of this agent version (absolute https), shown in agent lists, the agent detail, the chat header and as the default avatar of embedded chat; null when none is set. Follows the version like other configuration: a version saved with apply=false does not change the avatar in effect. /agent/v1 only.
+         */
+        avatar: string | null;
+        /**
+         * Channel the agent was created through (for example api or console); null for historical agents whose channel is unknown. Display only. /agent/v1 only; /anthropic neither returns it.
+         */
+        creation_source: string | null;
+        /**
+         * Platform-wide identity number of the agent (8 characters), usable wherever an agent is addressed by identity_number; null when the agent has none. /agent/v1 only; /anthropic neither returns it.
+         */
+        identity_number: string | null;
+        /**
+         * Default environment of this service agent version: the environment_id new sessions get when they name none; null means no environment. Present for service agents only. Follows the version like other configuration: a version saved with apply=false does not change the environment in effect. Versions saved before this field existed read as light. /agent/v1 only.
+         */
+        environment_id?: string | null;
+        /**
+         * Default vaults of this service agent version: the vault_ids new sessions get when they name none. Present for service agents only. Follows the version like other configuration: a version saved with apply=false does not change the vaults in effect. Versions saved before this field existed read as []. /agent/v1 only.
+         */
+        vault_ids?: Array<string>;
         /**
          * Current agent lifecycle status; unarchive restores an archived agent to active.
          */
@@ -46481,6 +46988,20 @@ export type AgentsArchiveData = {
     query?: never;
     url: '/agent/v1/agents/{agent_id}/archive';
 };
+export type AgentsArchiveErrors = {
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Agent not found: the id does not exist in your organization. Take ids from agents.list or agents.create.
+     */
+    404: unknown;
+};
 export type AgentsArchiveResponses = {
     /**
      * Successful response
@@ -46512,12 +47033,9 @@ export type AgentsArchiveResponses = {
          */
         model: {
             /**
-             * The model that will power your agent.
-             *
-             * See [models](https://docs.anthropic.com/en/docs/models-overview) for additional
-             * details and options.
+             * A model id from the Praxis model catalog (`praxis.model.models.list`). Unlike Anthropic, Claude model ids other than those in the catalog are rejected.
              */
-            id: 'claude-opus-5-5' | 'claude-fable-5-1' | 'claude-sonnet-5' | 'claude-fable-5' | 'claude-opus-5' | 'claude-opus-4-8' | 'claude-opus-4-7' | 'claude-opus-4-6' | 'claude-sonnet-4-6' | 'claude-haiku-4-5' | 'claude-haiku-4-5-20251001' | 'claude-opus-4-5' | 'claude-opus-4-5-20251101' | 'claude-sonnet-4-5' | 'claude-sonnet-4-5-20250929' | string;
+            id: string;
             /**
              * How hard Claude works on each turn. Sets `output_config.effort` on every
              * Messages call the session makes.
@@ -46553,7 +47071,7 @@ export type AgentsArchiveResponses = {
          */
         name: string;
         /**
-         * Skill attachments are not supported: a nonempty skills array returns 400. Omit this field or send an empty array. The native skill tool loads available runtime skills independently of this field.
+         * Custom skills attached to the agent, each {type: "custom", skill_id, version?}: skill_id comes from skills.create or skills.list, at most 20 skills, no repeated skill_id. Omit version, or send "latest", to use the skill's newest version at the moment a session starts; a pinned version stays fixed. type anthropic returns 400: upload the skill and attach it as custom. On update, omit the field to keep the list, send an array to replace it, or send [] or null to clear it.
          */
         skills: Array<AgentManaged42 | AgentManaged43>;
         /**
@@ -46612,38 +47130,21 @@ export type AgentsArchiveResponses = {
          */
         note: string | null;
         /**
-         * Database allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
+         * Platform resources and services this service agent's codemode may reach, as one list of typed bindings. Only kind=service accepts a nonempty list; personal agents return 400. There are two kinds. A resource binding names one resource with id and access: database (id db_..., read_only or read_write), vector_store (id vs_..., read_only or read_write), file (id file- plus 24 letters or digits, as the File API returns it; read_only), media_library (any id without ':' or whitespace, read_only or read_write), model (a model catalog id, invoke), workflow and script (id <namespace>/<name>, invoke). A service binding opens a whole service and carries only enabled: search or browser. At most 20 bindings per type, no repeated type and id, and each service type at most once. A session is authorized by the agent version it runs: newly added bindings apply only to new sessions, and a version saved with apply=false changes no access until it is applied. Applying a version that disables, removes or downgrades a binding revokes it immediately in running sessions on older versions. A resource that is not bound returns 404, a service that is not opened returns 403, and a write to a resource bound read_only returns 403 BINDING_READ_ONLY. Unknown types, fields on the wrong kind (id, access or instructions on a service binding), wrong access and malformed ids return 400. The former databases, vector_stores and files fields are removed and return 400. Omit on create for no bindings.
          */
-        databases: Array<{
-            /**
-             * Resource id from database.databases.list or database.databases.create; use the returned id, not its name. Must start with db_ and be unique within this binding array.
-             */
-            id: string;
-            /**
-             * read_only permits reads of the bound resource; read_write permits reads and writes.
-             */
-            access: 'read_only' | 'read_write';
+        bindings: Array<{
             /**
-             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+             * Resource type. Decides the id format and the allowed access.
              */
-            instructions?: string;
+            type: 'database' | 'vector_store' | 'file' | 'media_library' | 'model' | 'workflow' | 'script';
             /**
-             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
-             */
-            enabled?: boolean;
-        }>;
-        /**
-         * Knowledge vector store allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
-         */
-        vector_stores: Array<{
-            /**
-             * Resource id from knowledge.vectorStores.list or knowledge.vectorStores.create; use the returned id, not its name. Must start with vs_ and be unique within this binding array.
+             * Resource id, never its name. database db_..., vector_store vs_..., file file- plus 24 letters or digits; media_library and model ids must not contain ':' or whitespace; workflow and script use <namespace>/<name> with no '/', '@', ':' or whitespace inside a part.
              */
             id: string;
             /**
-             * read_only permits reads of the bound resource; read_write permits reads and writes.
+             * database, vector_store and media_library accept read_only or read_write; file accepts read_only; model, workflow and script accept invoke. Any other combination returns 400.
              */
-            access: 'read_only' | 'read_write';
+            access: 'read_only' | 'read_write' | 'invoke';
             /**
              * Optional guidance for using this resource, up to 4096 characters; does not expand access.
              */
@@ -46652,25 +47153,13 @@ export type AgentsArchiveResponses = {
              * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
              */
             enabled?: boolean;
-        }>;
-        /**
-         * File allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
-         */
-        files: Array<{
-            /**
-             * Resource id from file.files.list or file.files.create (upload); use the returned id, not its name. Must start with file_ and be unique within this binding array.
-             */
-            id: string;
-            /**
-             * read_only permits reading the bound file; files do not accept read_write.
-             */
-            access: 'read_only';
+        } | {
             /**
-             * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+             * Service type. Opens the whole service to codemode; there is no per-resource id.
              */
-            instructions?: string;
+            type: 'search' | 'browser';
             /**
-             * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+             * Whether the service is open. Defaults to true; false immediately closes it for running sessions.
              */
             enabled?: boolean;
         }>;
@@ -47012,7 +47501,7 @@ export type AgentsArchiveResponses = {
                  */
                 commands?: Array<string>;
                 /**
-                 * Skill attachments are not supported: a nonempty array returns 400. Omit this field or send an empty array; the native skill tool is configured separately through tools.
+                 * Names of disabled skills declarations.
                  */
                 skills?: Array<string>;
                 /**
@@ -47034,6 +47523,26 @@ export type AgentsArchiveResponses = {
              */
             allowed: Array<string>;
         };
+        /**
+         * Avatar image URL of this agent version (absolute https), shown in agent lists, the agent detail, the chat header and as the default avatar of embedded chat; null when none is set. Follows the version like other configuration: a version saved with apply=false does not change the avatar in effect. /agent/v1 only.
+         */
+        avatar: string | null;
+        /**
+         * Channel the agent was created through (for example api or console); null for historical agents whose channel is unknown. Display only. /agent/v1 only; /anthropic neither returns it.
+         */
+        creation_source: string | null;
+        /**
+         * Platform-wide identity number of the agent (8 characters), usable wherever an agent is addressed by identity_number; null when the agent has none. /agent/v1 only; /anthropic neither returns it.
+         */
+        identity_number: string | null;
+        /**
+         * Default environment of this service agent version: the environment_id new sessions get when they name none; null means no environment. Present for service agents only. Follows the version like other configuration: a version saved with apply=false does not change the environment in effect. Versions saved before this field existed read as light. /agent/v1 only.
+         */
+        environment_id?: string | null;
+        /**
+         * Default vaults of this service agent version: the vault_ids new sessions get when they name none. Present for service agents only. Follows the version like other configuration: a version saved with apply=false does not change the vaults in effect. Versions saved before this field existed read as []. /agent/v1 only.
+         */
+        vault_ids?: Array<string>;
         /**
          * Current agent lifecycle status; unarchive restores an archived agent to active.
          */
@@ -47058,6 +47567,24 @@ export type AgentsVersionsListData = {
     };
     url: '/agent/v1/agents/{agent_id}/versions';
 };
+export type AgentsVersionsListErrors = {
+    /**
+     * limit is not an integer from 1 to 100, or page is not a cursor from this same query. Pass next_page unchanged, with the same filters, to continue.
+     */
+    400: unknown;
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Agent not found: the id does not exist in your organization. Take ids from agents.list or agents.create.
+     */
+    404: unknown;
+};
 export type AgentsVersionsListResponses = {
     /**
      * Successful response
@@ -47093,12 +47620,9 @@ export type AgentsVersionsListResponses = {
              */
             model: {
                 /**
-                 * The model that will power your agent.
-                 *
-                 * See [models](https://docs.anthropic.com/en/docs/models-overview) for additional
-                 * details and options.
+                 * A model id from the Praxis model catalog (`praxis.model.models.list`). Unlike Anthropic, Claude model ids other than those in the catalog are rejected.
                  */
-                id: 'claude-opus-5-5' | 'claude-fable-5-1' | 'claude-sonnet-5' | 'claude-fable-5' | 'claude-opus-5' | 'claude-opus-4-8' | 'claude-opus-4-7' | 'claude-opus-4-6' | 'claude-sonnet-4-6' | 'claude-haiku-4-5' | 'claude-haiku-4-5-20251001' | 'claude-opus-4-5' | 'claude-opus-4-5-20251101' | 'claude-sonnet-4-5' | 'claude-sonnet-4-5-20250929' | string;
+                id: string;
                 /**
                  * How hard Claude works on each turn. Sets `output_config.effort` on every
                  * Messages call the session makes.
@@ -47134,7 +47658,7 @@ export type AgentsVersionsListResponses = {
              */
             name: string;
             /**
-             * Skill attachments are not supported: a nonempty skills array returns 400. Omit this field or send an empty array. The native skill tool loads available runtime skills independently of this field.
+             * Custom skills attached to the agent, each {type: "custom", skill_id, version?}: skill_id comes from skills.create or skills.list, at most 20 skills, no repeated skill_id. Omit version, or send "latest", to use the skill's newest version at the moment a session starts; a pinned version stays fixed. type anthropic returns 400: upload the skill and attach it as custom. On update, omit the field to keep the list, send an array to replace it, or send [] or null to clear it.
              */
             skills: Array<AgentManaged42 | AgentManaged43>;
             /**
@@ -47193,38 +47717,21 @@ export type AgentsVersionsListResponses = {
              */
             note: string | null;
             /**
-             * Database allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
+             * Platform resources and services this service agent's codemode may reach, as one list of typed bindings. Only kind=service accepts a nonempty list; personal agents return 400. There are two kinds. A resource binding names one resource with id and access: database (id db_..., read_only or read_write), vector_store (id vs_..., read_only or read_write), file (id file- plus 24 letters or digits, as the File API returns it; read_only), media_library (any id without ':' or whitespace, read_only or read_write), model (a model catalog id, invoke), workflow and script (id <namespace>/<name>, invoke). A service binding opens a whole service and carries only enabled: search or browser. At most 20 bindings per type, no repeated type and id, and each service type at most once. A session is authorized by the agent version it runs: newly added bindings apply only to new sessions, and a version saved with apply=false changes no access until it is applied. Applying a version that disables, removes or downgrades a binding revokes it immediately in running sessions on older versions. A resource that is not bound returns 404, a service that is not opened returns 403, and a write to a resource bound read_only returns 403 BINDING_READ_ONLY. Unknown types, fields on the wrong kind (id, access or instructions on a service binding), wrong access and malformed ids return 400. The former databases, vector_stores and files fields are removed and return 400. Omit on create for no bindings.
              */
-            databases: Array<{
+            bindings: Array<{
                 /**
-                 * Resource id from database.databases.list or database.databases.create; use the returned id, not its name. Must start with db_ and be unique within this binding array.
+                 * Resource type. Decides the id format and the allowed access.
                  */
-                id: string;
-                /**
-                 * read_only permits reads of the bound resource; read_write permits reads and writes.
-                 */
-                access: 'read_only' | 'read_write';
+                type: 'database' | 'vector_store' | 'file' | 'media_library' | 'model' | 'workflow' | 'script';
                 /**
-                 * Optional guidance for using this resource, up to 4096 characters; does not expand access.
-                 */
-                instructions?: string;
-                /**
-                 * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
-                 */
-                enabled?: boolean;
-            }>;
-            /**
-             * Knowledge vector store allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
-             */
-            vector_stores: Array<{
-                /**
-                 * Resource id from knowledge.vectorStores.list or knowledge.vectorStores.create; use the returned id, not its name. Must start with vs_ and be unique within this binding array.
+                 * Resource id, never its name. database db_..., vector_store vs_..., file file- plus 24 letters or digits; media_library and model ids must not contain ':' or whitespace; workflow and script use <namespace>/<name> with no '/', '@', ':' or whitespace inside a part.
                  */
                 id: string;
                 /**
-                 * read_only permits reads of the bound resource; read_write permits reads and writes.
+                 * database, vector_store and media_library accept read_only or read_write; file accepts read_only; model, workflow and script accept invoke. Any other combination returns 400.
                  */
-                access: 'read_only' | 'read_write';
+                access: 'read_only' | 'read_write' | 'invoke';
                 /**
                  * Optional guidance for using this resource, up to 4096 characters; does not expand access.
                  */
@@ -47233,25 +47740,13 @@ export type AgentsVersionsListResponses = {
                  * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
                  */
                 enabled?: boolean;
-            }>;
-            /**
-             * File allowlist for platform resources accessible through service-agent codemode. Only kind=service accepts nonempty bindings; personal agents return 400. At most 20 bindings per resource type, with no duplicate ids. Newly added bindings apply only to new sessions; disabling or removing a binding immediately revokes access in running sessions. Unbound resources return 404; writes to read_only resources are refused. Other platform APIs return 403, except public API discovery. Invalid bindings and unknown item fields return 400. Omit on create for no bindings.
-             */
-            files: Array<{
-                /**
-                 * Resource id from file.files.list or file.files.create (upload); use the returned id, not its name. Must start with file_ and be unique within this binding array.
-                 */
-                id: string;
-                /**
-                 * read_only permits reading the bound file; files do not accept read_write.
-                 */
-                access: 'read_only';
+            } | {
                 /**
-                 * Optional guidance for using this resource, up to 4096 characters; does not expand access.
+                 * Service type. Opens the whole service to codemode; there is no per-resource id.
                  */
-                instructions?: string;
+                type: 'search' | 'browser';
                 /**
-                 * Whether this binding grants access. Defaults to true; false immediately disables it for running sessions.
+                 * Whether the service is open. Defaults to true; false immediately closes it for running sessions.
                  */
                 enabled?: boolean;
             }>;
@@ -47593,7 +48088,7 @@ export type AgentsVersionsListResponses = {
                      */
                     commands?: Array<string>;
                     /**
-                     * Skill attachments are not supported: a nonempty array returns 400. Omit this field or send an empty array; the native skill tool is configured separately through tools.
+                     * Names of disabled skills declarations.
                      */
                     skills?: Array<string>;
                     /**
@@ -47615,6 +48110,26 @@ export type AgentsVersionsListResponses = {
                  */
                 allowed: Array<string>;
             };
+            /**
+             * Avatar image URL of this agent version (absolute https), shown in agent lists, the agent detail, the chat header and as the default avatar of embedded chat; null when none is set. Follows the version like other configuration: a version saved with apply=false does not change the avatar in effect. /agent/v1 only.
+             */
+            avatar: string | null;
+            /**
+             * Channel the agent was created through (for example api or console); null for historical agents whose channel is unknown. Display only. /agent/v1 only; /anthropic neither returns it.
+             */
+            creation_source: string | null;
+            /**
+             * Platform-wide identity number of the agent (8 characters), usable wherever an agent is addressed by identity_number; null when the agent has none. /agent/v1 only; /anthropic neither returns it.
+             */
+            identity_number: string | null;
+            /**
+             * Default environment of this service agent version: the environment_id new sessions get when they name none; null means no environment. Present for service agents only. Follows the version like other configuration: a version saved with apply=false does not change the environment in effect. Versions saved before this field existed read as light. /agent/v1 only.
+             */
+            environment_id?: string | null;
+            /**
+             * Default vaults of this service agent version: the vault_ids new sessions get when they name none. Present for service agents only. Follows the version like other configuration: a version saved with apply=false does not change the vaults in effect. Versions saved before this field existed read as []. /agent/v1 only.
+             */
+            vault_ids?: Array<string>;
             /**
              * Current agent lifecycle status; unarchive restores an archived agent to active.
              */
@@ -47695,6 +48210,20 @@ export type SessionsListData = {
     };
     url: '/agent/v1/sessions';
 };
+export type SessionsListErrors = {
+    /**
+     * An unsupported or repeated query parameter, include_archived that is not true or false, an external_user_id or source value outside its range, an agent_id or deployment_id of the wrong form, or limit is not an integer from 1 to 100, or page is not a cursor from this same query. Pass next_page unchanged, with the same filters, to continue.
+     */
+    400: unknown;
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+};
 export type SessionsListResponses = {
     /**
      * Successful response
@@ -47730,12 +48259,9 @@ export type SessionsListResponses = {
                  */
                 model: {
                     /**
-                     * The model that will power your agent.
-                     *
-                     * See [models](https://docs.anthropic.com/en/docs/models-overview) for additional
-                     * details and options.
+                     * A model id from the Praxis model catalog (`praxis.model.models.list`). Unlike Anthropic, Claude model ids other than those in the catalog are rejected.
                      */
-                    id: 'claude-opus-5-5' | 'claude-fable-5-1' | 'claude-sonnet-5' | 'claude-fable-5' | 'claude-opus-5' | 'claude-opus-4-8' | 'claude-opus-4-7' | 'claude-opus-4-6' | 'claude-sonnet-4-6' | 'claude-haiku-4-5' | 'claude-haiku-4-5-20251001' | 'claude-opus-4-5' | 'claude-opus-4-5-20251101' | 'claude-sonnet-4-5' | 'claude-sonnet-4-5-20250929' | string;
+                    id: string;
                     /**
                      * How hard Claude works on each turn. Sets `output_config.effort` on every
                      * Messages call the session makes.
@@ -47772,7 +48298,7 @@ export type SessionsListResponses = {
                  */
                 name: string;
                 /**
-                 * Skill attachments are not supported: a nonempty skills array returns 400. Omit this field or send an empty array. The native skill tool loads available runtime skills independently of this field.
+                 * Custom skills attached to the agent, each {type: "custom", skill_id, version?}: skill_id comes from skills.create or skills.list, at most 20 skills, no repeated skill_id. Omit version, or send "latest", to use the skill's newest version at the moment a session starts; a pinned version stays fixed. type anthropic returns 400: upload the skill and attach it as custom. On update, omit the field to keep the list, send an array to replace it, or send [] or null to clear it.
                  */
                 skills: Array<AgentManaged42 | AgentManaged43>;
                 /**
@@ -47806,7 +48332,7 @@ export type SessionsListResponses = {
              */
             created_at: string;
             /**
-             * Execution environment selected for this session. Service sessions return light when environment_id was omitted, or null when explicitly created without a machine; Computer sessions may omit this field.
+             * Execution environment of this session. A service session created without environment_id uses the default environment saved in the agent version (light for a new agent); null means it was created without a machine; Computer sessions may omit this field.
              */
             environment_id?: string;
             metadata: AgentManaged173;
@@ -47934,13 +48460,11 @@ export type SessionsListResponse = SessionsListResponses[keyof SessionsListRespo
 export type SessionsCreateData = {
     body: {
         /**
-         * Agent identifier. Accepts the `agent` ID string, which pins the
-         * latest version for the session, or an `agent` object with both id and version
-         * specified.
+         * The agent to run: an agent id string, or {type: "agent", id, version?}. An id alone, or an object without version, pins the agent's active_version at the moment the session is created (the version chosen with agents.versions.apply, not necessarily the newest saved one); version pins that exact version. Unlike Managed Agents, the only inline override is a system prompt ({type: "agent_with_overrides", id, system}); to change the model, tools, MCP servers or skills, save a version instead.
          */
         agent: string | AgentManaged10 | AgentManaged167;
         /**
-         * Execution environment id from agent.environments.list or agent.environments.create. For a service agent, omission selects the built-in light environment and returns session.environment_id=light; explicit null allocates no machine and makes machine tools, including codemode and bash, unavailable. Personal agents use their selected Computer.
+         * Execution environment id from agent.environments.list or agent.environments.create. For a service agent, omission uses the default environment saved in the agent version (light for a new agent) and returns it as session.environment_id; explicit null allocates no machine and makes machine tools, including codemode and bash, unavailable. Personal agents use their selected Computer.
          */
         environment_id?: string | null;
         /**
@@ -48007,6 +48531,32 @@ export type SessionsCreateData = {
     query?: never;
     url: '/agent/v1/sessions';
 };
+export type SessionsCreateErrors = {
+    /**
+     * The body failed validation and the message names the field: an unknown field, environment_id together with computer_id, a model or thinking selection the agent does not allow, an invalid budget or vault_ids, invalid initial_events, or an agent reference with an unsupported override.
+     */
+    400: unknown;
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Agent not found, or the pinned agent version does not exist. Take agent ids from agents.list and versions from agents.versions.list.
+     */
+    404: unknown;
+    /**
+     * Agent is archived; unarchive it to start new sessions. Existing sessions keep working.
+     */
+    409: unknown;
+    /**
+     * The session could not be established (machine, vault or resource synchronization failed). Nothing usable was created; retry.
+     */
+    502: unknown;
+};
 export type SessionsCreateResponses = {
     /**
      * Successful response
@@ -48038,12 +48588,9 @@ export type SessionsCreateResponses = {
              */
             model: {
                 /**
-                 * The model that will power your agent.
-                 *
-                 * See [models](https://docs.anthropic.com/en/docs/models-overview) for additional
-                 * details and options.
+                 * A model id from the Praxis model catalog (`praxis.model.models.list`). Unlike Anthropic, Claude model ids other than those in the catalog are rejected.
                  */
-                id: 'claude-opus-5-5' | 'claude-fable-5-1' | 'claude-sonnet-5' | 'claude-fable-5' | 'claude-opus-5' | 'claude-opus-4-8' | 'claude-opus-4-7' | 'claude-opus-4-6' | 'claude-sonnet-4-6' | 'claude-haiku-4-5' | 'claude-haiku-4-5-20251001' | 'claude-opus-4-5' | 'claude-opus-4-5-20251101' | 'claude-sonnet-4-5' | 'claude-sonnet-4-5-20250929' | string;
+                id: string;
                 /**
                  * How hard Claude works on each turn. Sets `output_config.effort` on every
                  * Messages call the session makes.
@@ -48080,7 +48627,7 @@ export type SessionsCreateResponses = {
              */
             name: string;
             /**
-             * Skill attachments are not supported: a nonempty skills array returns 400. Omit this field or send an empty array. The native skill tool loads available runtime skills independently of this field.
+             * Custom skills attached to the agent, each {type: "custom", skill_id, version?}: skill_id comes from skills.create or skills.list, at most 20 skills, no repeated skill_id. Omit version, or send "latest", to use the skill's newest version at the moment a session starts; a pinned version stays fixed. type anthropic returns 400: upload the skill and attach it as custom. On update, omit the field to keep the list, send an array to replace it, or send [] or null to clear it.
              */
             skills: Array<AgentManaged42 | AgentManaged43>;
             /**
@@ -48114,7 +48661,7 @@ export type SessionsCreateResponses = {
          */
         created_at: string;
         /**
-         * Execution environment selected for this session. Service sessions return light when environment_id was omitted, or null when explicitly created without a machine; Computer sessions may omit this field.
+         * Execution environment of this session. A service session created without environment_id uses the default environment saved in the agent version (light for a new agent); null means it was created without a machine; Computer sessions may omit this field.
          */
         environment_id?: string;
         metadata: AgentManaged173;
@@ -48245,6 +48792,20 @@ export type SessionsArchiveData = {
     query?: never;
     url: '/agent/v1/sessions/{session_id}/archive';
 };
+export type SessionsArchiveErrors = {
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Session not found: the id does not exist in your organization. Take ids from sessions.list or sessions.create.
+     */
+    404: unknown;
+};
 export type SessionsArchiveResponses = {
     /**
      * Successful response
@@ -48276,12 +48837,9 @@ export type SessionsArchiveResponses = {
              */
             model: {
                 /**
-                 * The model that will power your agent.
-                 *
-                 * See [models](https://docs.anthropic.com/en/docs/models-overview) for additional
-                 * details and options.
+                 * A model id from the Praxis model catalog (`praxis.model.models.list`). Unlike Anthropic, Claude model ids other than those in the catalog are rejected.
                  */
-                id: 'claude-opus-5-5' | 'claude-fable-5-1' | 'claude-sonnet-5' | 'claude-fable-5' | 'claude-opus-5' | 'claude-opus-4-8' | 'claude-opus-4-7' | 'claude-opus-4-6' | 'claude-sonnet-4-6' | 'claude-haiku-4-5' | 'claude-haiku-4-5-20251001' | 'claude-opus-4-5' | 'claude-opus-4-5-20251101' | 'claude-sonnet-4-5' | 'claude-sonnet-4-5-20250929' | string;
+                id: string;
                 /**
                  * How hard Claude works on each turn. Sets `output_config.effort` on every
                  * Messages call the session makes.
@@ -48318,7 +48876,7 @@ export type SessionsArchiveResponses = {
              */
             name: string;
             /**
-             * Skill attachments are not supported: a nonempty skills array returns 400. Omit this field or send an empty array. The native skill tool loads available runtime skills independently of this field.
+             * Custom skills attached to the agent, each {type: "custom", skill_id, version?}: skill_id comes from skills.create or skills.list, at most 20 skills, no repeated skill_id. Omit version, or send "latest", to use the skill's newest version at the moment a session starts; a pinned version stays fixed. type anthropic returns 400: upload the skill and attach it as custom. On update, omit the field to keep the list, send an array to replace it, or send [] or null to clear it.
              */
             skills: Array<AgentManaged42 | AgentManaged43>;
             /**
@@ -48352,7 +48910,7 @@ export type SessionsArchiveResponses = {
          */
         created_at: string;
         /**
-         * Execution environment selected for this session. Service sessions return light when environment_id was omitted, or null when explicitly created without a machine; Computer sessions may omit this field.
+         * Execution environment of this session. A service session created without environment_id uses the default environment saved in the agent version (light for a new agent); null means it was created without a machine; Computer sessions may omit this field.
          */
         environment_id?: string;
         metadata: AgentManaged173;
@@ -48520,6 +49078,24 @@ export type SessionsEventsListData = {
     };
     url: '/agent/v1/sessions/{session_id}/events';
 };
+export type SessionsEventsListErrors = {
+    /**
+     * order is not asc or desc, types contains an unsupported event type, or limit is not an integer from 1 to 100, or page is not a cursor from this same query. Pass next_page unchanged, with the same filters, to continue.
+     */
+    400: unknown;
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Session not found: the id does not exist in your organization. Take ids from sessions.list or sessions.create.
+     */
+    404: unknown;
+};
 export type SessionsEventsListResponses = {
     /**
      * Successful response
@@ -49277,6 +49853,28 @@ export type SessionsEventsSendData = {
     query?: never;
     url: '/agent/v1/sessions/{session_id}/events';
 };
+export type SessionsEventsSendErrors = {
+    /**
+     * The event failed validation and the message names the problem: an unsupported event type or content block, more than one text block, a missing tool_use_id or custom_tool_use_id, an unknown call id, or a session that is archived.
+     */
+    400: unknown;
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Session not found: the id does not exist in your organization. Take ids from sessions.list or sessions.create. A user.steer or user.withdraw that names a missing event also returns 404.
+     */
+    404: unknown;
+    /**
+     * A duplicate result, a call that is no longer waiting, or a user.steer on an input that is already processing or withdrawn. Read the events to see the current state before retrying.
+     */
+    409: unknown;
+};
 export type SessionsEventsSendResponses = {
     /**
      * Successful response
@@ -49408,6 +50006,24 @@ export type SessionsEventsStreamData = {
     };
     url: '/agent/v1/sessions/{session_id}/events/stream';
 };
+export type SessionsEventsStreamErrors = {
+    /**
+     * event_deltas contains a value other than the supported event types.
+     */
+    400: unknown;
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Session not found: the id does not exist in your organization. Take ids from sessions.list or sessions.create.
+     */
+    404: unknown;
+};
 export type SessionsEventsStreamResponses = {
     /**
      * Server-sent events
@@ -49432,6 +50048,24 @@ export type SessionsThreadsListData = {
     };
     url: '/agent/v1/sessions/{session_id}/threads';
 };
+export type SessionsThreadsListErrors = {
+    /**
+     * limit is not an integer from 1 to 100, or page is not a cursor from this same query. Pass next_page unchanged, with the same filters, to continue.
+     */
+    400: unknown;
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Session not found: the id does not exist in your organization. Take ids from sessions.list or sessions.create.
+     */
+    404: unknown;
+};
 export type SessionsThreadsListResponses = {
     /**
      * Successful response
@@ -49468,6 +50102,20 @@ export type SessionsThreadsRetrieveData = {
     };
     url: '/agent/v1/sessions/{session_id}/threads/{thread_id}';
 };
+export type SessionsThreadsRetrieveErrors = {
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Session or thread not found. A malformed id and another session's thread answer the same way. Take thread ids from sessions.threads.list.
+     */
+    404: unknown;
+};
 export type SessionsThreadsRetrieveResponses = {
     /**
      * Successful response
@@ -49495,6 +50143,20 @@ export type SessionsThreadsArchiveData = {
     };
     url: '/agent/v1/sessions/{session_id}/threads/{thread_id}/archive';
 };
+export type SessionsThreadsArchiveErrors = {
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Session or thread not found. A malformed id and another session's thread answer the same way. Take thread ids from sessions.threads.list.
+     */
+    404: unknown;
+};
 export type SessionsThreadsArchiveResponses = {
     /**
      * Successful response
@@ -49527,6 +50189,24 @@ export type SessionsThreadsEventsListData = {
     };
     url: '/agent/v1/sessions/{session_id}/threads/{thread_id}/events';
 };
+export type SessionsThreadsEventsListErrors = {
+    /**
+     * order is not asc or desc, types contains an unsupported event type, or limit is not an integer from 1 to 100, or page is not a cursor from this same query. Pass next_page unchanged, with the same filters, to continue.
+     */
+    400: unknown;
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Session or thread not found. A malformed id and another session's thread answer the same way. Take thread ids from sessions.threads.list.
+     */
+    404: unknown;
+};
 export type SessionsThreadsEventsListResponses = {
     /**
      * Successful response
@@ -50189,6 +50869,24 @@ export type SessionsThreadsEventsStreamData = {
     };
     url: '/agent/v1/sessions/{session_id}/threads/{thread_id}/stream';
 };
+export type SessionsThreadsEventsStreamErrors = {
+    /**
+     * event_deltas contains a value other than the supported event types.
+     */
+    400: unknown;
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Session or thread not found. A malformed id and another session's thread answer the same way. Take thread ids from sessions.threads.list.
+     */
+    404: unknown;
+};
 export type SessionsThreadsEventsStreamResponses = {
     /**
      * Server-sent events
@@ -50207,6 +50905,20 @@ export type EnvironmentsRetrieveData = {
     query?: never;
     url: '/agent/v1/environments/{environment_id}';
 };
+export type EnvironmentsRetrieveErrors = {
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Environment not found. Take ids from environments.list or environments.create.
+     */
+    404: unknown;
+};
 export type EnvironmentsRetrieveResponses = {
     /**
      * Successful response
@@ -50234,12 +50946,6 @@ export type EnvironmentsUpdateData = {
          * Updated name for the environment
          */
         name?: null | string;
-        /**
-         * The visibility scope for this environment. 'organization' makes the
-         * environment visible to all accounts. 'account' restricts visibility to the
-         * owning account only.
-         */
-        scope?: null | 'organization' | 'account';
     };
     path: {
         /**
@@ -50250,6 +50956,28 @@ export type EnvironmentsUpdateData = {
     query?: never;
     url: '/agent/v1/environments/{environment_id}';
 };
+export type EnvironmentsUpdateErrors = {
+    /**
+     * The body failed validation and the message names the field (same rules as environments.create).
+     */
+    400: unknown;
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Environment not found. Take ids from environments.list or environments.create.
+     */
+    404: unknown;
+    /**
+     * The environment is built in (read-only), is archived, or changed since you read it (retrieve it again and retry).
+     */
+    409: unknown;
+};
 export type EnvironmentsUpdateResponses = {
     /**
      * Successful response
@@ -50268,6 +50996,24 @@ export type EnvironmentsArchiveData = {
     query?: never;
     url: '/agent/v1/environments/{environment_id}/archive';
 };
+export type EnvironmentsArchiveErrors = {
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Environment not found. Take ids from environments.list or environments.create.
+     */
+    404: unknown;
+    /**
+     * The environment is built in (read-only), or RESOURCE_IN_USE: the active version of a non-archived agent uses it as environment_id; the message names the agents. Point them at another environment first.
+     */
+    409: unknown;
+};
 export type EnvironmentsArchiveResponses = {
     /**
      * Successful response
@@ -50291,6 +51037,20 @@ export type EnvironmentsListData = {
     };
     url: '/agent/v1/environments';
 };
+export type EnvironmentsListErrors = {
+    /**
+     * include_archived is not true or false, or limit or page is invalid.
+     */
+    400: unknown;
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+};
 export type EnvironmentsListResponses = {
     /**
      * Successful response
@@ -50325,18 +51085,25 @@ export type EnvironmentsCreateData = {
          * User-provided metadata key-value pairs
          */
         metadata?: AgentManaged137Writable;
-        /**
-         * The visibility scope for this environment. 'organization' makes the
-         * environment visible to all accounts. 'account' restricts visibility to the
-         * owning account only. API organizations support only 'organization'; 'account' is
-         * rejected. If not specified, defaults based on organization type.
-         */
-        scope?: null | 'organization' | 'account';
     };
     path?: never;
     query?: never;
     url: '/agent/v1/environments';
 };
+export type EnvironmentsCreateErrors = {
+    /**
+     * The body failed validation and the message names the field: an unknown field (including scope), a self_hosted config, a config.template that is not available (the message lists the available ones), or invalid packages or networking.
+     */
+    400: unknown;
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+};
 export type EnvironmentsCreateResponses = {
     /**
      * Successful response
@@ -50361,6 +51128,24 @@ export type SessionsResourcesListData = {
     };
     url: '/agent/v1/sessions/{session_id}/resources';
 };
+export type SessionsResourcesListErrors = {
+    /**
+     * limit is not an integer from 1 to 1000, or page is not a cursor from this list.
+     */
+    400: unknown;
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Session not found: the id does not exist in your organization. Take ids from sessions.list or sessions.create.
+     */
+    404: unknown;
+};
 export type SessionsResourcesListResponses = {
     /**
      * Successful response
@@ -50403,6 +51188,32 @@ export type SessionsResourcesAddData = {
     };
     url: '/agent/v1/sessions/{session_id}/resources';
 };
+export type SessionsResourcesAddErrors = {
+    /**
+     * Only file resources are supported; file_id or mount_path is invalid, or the session already holds 500 resources.
+     */
+    400: unknown;
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Session not found, or the file does not exist in your organization. Upload it first and pass its id.
+     */
+    404: unknown;
+    /**
+     * The file is not ready yet, or another request is allocating the same mount path. Retry shortly.
+     */
+    409: unknown;
+    /**
+     * File metadata could not be read. Retry later.
+     */
+    502: unknown;
+};
 export type SessionsResourcesAddResponses = {
     /**
      * Successful response
@@ -50430,6 +51241,20 @@ export type SessionsResourcesDeleteData = {
     };
     url: '/agent/v1/sessions/{session_id}/resources/{resource_id}';
 };
+export type SessionsResourcesDeleteErrors = {
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Session or resource not found. Take resource ids from sessions.resources.list.
+     */
+    404: unknown;
+};
 export type SessionsResourcesDeleteResponses = {
     /**
      * Successful response
@@ -50457,6 +51282,20 @@ export type SessionsResourcesRetrieveData = {
     };
     url: '/agent/v1/sessions/{session_id}/resources/{resource_id}';
 };
+export type SessionsResourcesRetrieveErrors = {
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Session or resource not found. Take resource ids from sessions.resources.list.
+     */
+    404: unknown;
+};
 export type SessionsResourcesRetrieveResponses = {
     /**
      * Successful response
@@ -50499,6 +51338,20 @@ export type DeploymentsListData = {
     };
     url: '/agent/v1/deployments';
 };
+export type DeploymentsListErrors = {
+    /**
+     * status and include_archived were combined, a filter value is invalid, or limit or page is invalid.
+     */
+    400: unknown;
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+};
 export type DeploymentsListResponses = {
     /**
      * Successful response
@@ -50758,6 +51611,20 @@ export type DeploymentsCreateData = {
     query?: never;
     url: '/agent/v1/deployments';
 };
+export type DeploymentsCreateErrors = {
+    /**
+     * The body failed validation and the message names the field: an unknown field, a missing environment_id, initial_events other than user.message, an invalid schedule, or an extension used where it is not available.
+     */
+    400: unknown;
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+};
 export type DeploymentsCreateResponses = {
     /**
      * Successful response
@@ -50912,6 +51779,20 @@ export type DeploymentsRetrieveData = {
     query?: never;
     url: '/agent/v1/deployments/{deployment_id}';
 };
+export type DeploymentsRetrieveErrors = {
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Deployment not found. Take ids from deployments.create or deployments.list.
+     */
+    404: unknown;
+};
 export type DeploymentsRetrieveResponses = {
     /**
      * Successful response
@@ -51169,6 +52050,28 @@ export type DeploymentsUpdateData = {
     query?: never;
     url: '/agent/v1/deployments/{deployment_id}';
 };
+export type DeploymentsUpdateErrors = {
+    /**
+     * The body failed validation and the message names the field.
+     */
+    400: unknown;
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Deployment not found. Take ids from deployments.create or deployments.list.
+     */
+    404: unknown;
+    /**
+     * The deployment is archived and cannot be updated.
+     */
+    409: unknown;
+};
 export type DeploymentsUpdateResponses = {
     /**
      * Successful response
@@ -51323,6 +52226,20 @@ export type DeploymentsArchiveData = {
     query?: never;
     url: '/agent/v1/deployments/{deployment_id}/archive';
 };
+export type DeploymentsArchiveErrors = {
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Deployment not found. Take ids from deployments.create or deployments.list.
+     */
+    404: unknown;
+};
 export type DeploymentsArchiveResponses = {
     /**
      * Successful response
@@ -51477,6 +52394,24 @@ export type DeploymentsPauseData = {
     query?: never;
     url: '/agent/v1/deployments/{deployment_id}/pause';
 };
+export type DeploymentsPauseErrors = {
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Deployment not found. Take ids from deployments.create or deployments.list.
+     */
+    404: unknown;
+    /**
+     * The deployment is archived.
+     */
+    409: unknown;
+};
 export type DeploymentsPauseResponses = {
     /**
      * Successful response
@@ -51631,6 +52566,24 @@ export type DeploymentsUnpauseData = {
     query?: never;
     url: '/agent/v1/deployments/{deployment_id}/unpause';
 };
+export type DeploymentsUnpauseErrors = {
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Deployment not found. Take ids from deployments.create or deployments.list.
+     */
+    404: unknown;
+    /**
+     * The deployment is archived.
+     */
+    409: unknown;
+};
 export type DeploymentsUnpauseResponses = {
     /**
      * Successful response
@@ -51817,6 +52770,20 @@ export type DeploymentRunsListData = {
     };
     url: '/agent/v1/deployment_runs';
 };
+export type DeploymentRunsListErrors = {
+    /**
+     * A filter value is invalid, or limit or page is invalid.
+     */
+    400: unknown;
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+};
 export type DeploymentRunsListResponses = {
     /**
      * Successful response
@@ -51844,6 +52811,20 @@ export type DeploymentRunsRetrieveData = {
     query?: never;
     url: '/agent/v1/deployment_runs/{deployment_run_id}';
 };
+export type DeploymentRunsRetrieveErrors = {
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Deployment run not found. Take ids from deployments.run or deployment_runs.list.
+     */
+    404: unknown;
+};
 export type DeploymentRunsRetrieveResponses = {
     /**
      * Successful response
@@ -51862,6 +52843,24 @@ export type DeploymentsRunData = {
     query?: never;
     url: '/agent/v1/deployments/{deployment_id}/run';
 };
+export type DeploymentsRunErrors = {
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Deployment not found. Take ids from deployments.create or deployments.list.
+     */
+    404: unknown;
+    /**
+     * The deployment is paused or archived; unpause it first. No run was recorded.
+     */
+    409: unknown;
+};
 export type DeploymentsRunResponses = {
     /**
      * Successful response
@@ -51869,6 +52868,381 @@ export type DeploymentsRunResponses = {
     200: AgentManaged113;
 };
 export type DeploymentsRunResponse = DeploymentsRunResponses[keyof DeploymentsRunResponses];
+export type SkillsListData = {
+    body?: never;
+    path?: never;
+    query?: {
+        /**
+         * Filter skills by source.
+         *
+         * If provided, only skills from the specified source will be returned:
+         *
+         * - `"custom"`: only return user-created skills
+         * - `"anthropic"`: only return Anthropic-created skills
+         */
+        source?: null | string;
+        /**
+         * Number of items per page.
+         */
+        limit?: number;
+        page?: null | string;
+    };
+    url: '/agent/v1/skills';
+};
+export type SkillsListErrors = {
+    /**
+     * source is not custom or anthropic, or limit is not an integer from 1 to 100, or page is not a cursor from this same query. Pass next_page unchanged, with the same filters, to continue.
+     */
+    400: unknown;
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+};
+export type SkillsListResponses = {
+    /**
+     * Successful response
+     */
+    200: {
+        /**
+         * Items of this page, in the order requested by the call.
+         */
+        data: Array<AgentManaged308>;
+        /**
+         * Opaque cursor for the next page: pass it unchanged as page to continue. Null when this is the last page.
+         */
+        next_page: string | null;
+    };
+};
+export type SkillsListResponse = SkillsListResponses[keyof SkillsListResponses];
+export type SkillsCreateData = {
+    body: {
+        /**
+         * Files to upload for the skill.
+         *
+         * All files must be in the same top-level directory and must include a SKILL.md
+         * file at the root of that directory.
+         */
+        files: Array<Blob | File>;
+        /**
+         * Human-readable, single-line label for the Skill. Maximum 255
+         * characters. Always set: derived from the SKILL.md frontmatter `name` when
+         * omitted at creation. Not unique.
+         */
+        display_name?: null | string;
+    };
+    path?: never;
+    query?: never;
+    url: '/agent/v1/skills';
+};
+export type SkillsCreateErrors = {
+    /**
+     * Not multipart/form-data, or a file part is invalid: no top-level directory, no SKILL.md, no description in its frontmatter, a path with .. or an absolute path, more than 200 files, or more than 8 MB in total. The message names the path or field.
+     */
+    400: unknown;
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Skill storage is unavailable. Retry later.
+     */
+    502: unknown;
+};
+export type SkillsCreateResponses = {
+    /**
+     * Successful response
+     */
+    200: AgentManaged308;
+};
+export type SkillsCreateResponse = SkillsCreateResponses[keyof SkillsCreateResponses];
+export type SkillsDeleteData = {
+    body?: never;
+    path: {
+        /**
+         * Skill id (skill_...), as returned by skills.create or skills.list. A skill of another organization returns 404.
+         */
+        skill_id: string;
+    };
+    query?: never;
+    url: '/agent/v1/skills/{skill_id}';
+};
+export type SkillsDeleteErrors = {
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Skill not found, deleted, or owned by another organization. Take ids from skills.list.
+     */
+    404: unknown;
+    /**
+     * Delete all versions first, or RESOURCE_IN_USE: a non-archived agent still attaches the skill; the message names up to 10 agent ids.
+     */
+    409: unknown;
+};
+export type SkillsDeleteResponses = {
+    /**
+     * Successful response
+     */
+    200: AgentManaged310;
+};
+export type SkillsDeleteResponse = SkillsDeleteResponses[keyof SkillsDeleteResponses];
+export type SkillsRetrieveData = {
+    body?: never;
+    path: {
+        /**
+         * Skill id (skill_...), as returned by skills.create or skills.list. A skill of another organization returns 404.
+         */
+        skill_id: string;
+    };
+    query?: never;
+    url: '/agent/v1/skills/{skill_id}';
+};
+export type SkillsRetrieveErrors = {
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Skill not found, deleted, or owned by another organization. Take ids from skills.list.
+     */
+    404: unknown;
+};
+export type SkillsRetrieveResponses = {
+    /**
+     * Successful response
+     */
+    200: AgentManaged308;
+};
+export type SkillsRetrieveResponse = SkillsRetrieveResponses[keyof SkillsRetrieveResponses];
+export type SkillsVersionsListData = {
+    body?: never;
+    path: {
+        /**
+         * Skill id (skill_...), as returned by skills.create or skills.list. A skill of another organization returns 404.
+         */
+        skill_id: string;
+    };
+    query?: {
+        /**
+         * Number of items per page.
+         */
+        limit?: number;
+        page?: null | string;
+    };
+    url: '/agent/v1/skills/{skill_id}/versions';
+};
+export type SkillsVersionsListErrors = {
+    /**
+     * limit is not an integer from 1 to 100, or page is not a cursor from this same query. Pass next_page unchanged, with the same filters, to continue.
+     */
+    400: unknown;
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Skill not found, deleted, or owned by another organization. Take ids from skills.list.
+     */
+    404: unknown;
+};
+export type SkillsVersionsListResponses = {
+    /**
+     * Successful response
+     */
+    200: {
+        /**
+         * Items of this page, in the order requested by the call.
+         */
+        data: Array<AgentManaged311>;
+        /**
+         * Opaque cursor for the next page: pass it unchanged as page to continue. Null when this is the last page.
+         */
+        next_page: string | null;
+    };
+};
+export type SkillsVersionsListResponse = SkillsVersionsListResponses[keyof SkillsVersionsListResponses];
+export type SkillsVersionsCreateData = {
+    body: {
+        /**
+         * Files to upload for the skill.
+         *
+         * All files must be in the same top-level directory and must include a SKILL.md
+         * file at the root of that directory.
+         */
+        files: Array<Blob | File>;
+    };
+    path: {
+        /**
+         * Skill id (skill_...), as returned by skills.create or skills.list. A skill of another organization returns 404.
+         */
+        skill_id: string;
+    };
+    query?: never;
+    url: '/agent/v1/skills/{skill_id}/versions';
+};
+export type SkillsVersionsCreateErrors = {
+    /**
+     * The upload is invalid (same rules as skills.create), or the SKILL.md name differs from the skill's name.
+     */
+    400: unknown;
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Skill not found, deleted, or owned by another organization. Take ids from skills.list.
+     */
+    404: unknown;
+    /**
+     * Skill storage is unavailable. Retry later.
+     */
+    502: unknown;
+};
+export type SkillsVersionsCreateResponses = {
+    /**
+     * Successful response
+     */
+    200: AgentManaged311;
+};
+export type SkillsVersionsCreateResponse = SkillsVersionsCreateResponses[keyof SkillsVersionsCreateResponses];
+export type SkillsVersionsDeleteData = {
+    body?: never;
+    path: {
+        /**
+         * Skill id (skill_...), as returned by skills.create or skills.list. A skill of another organization returns 404.
+         */
+        skill_id: string;
+        /**
+         * Skill version id, as returned by skills.versions.create or skills.versions.list; an opaque string that increases with each upload.
+         */
+        version: string;
+    };
+    query?: never;
+    url: '/agent/v1/skills/{skill_id}/versions/{version}';
+};
+export type SkillsVersionsDeleteErrors = {
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Skill or version not found. Take version ids from skills.versions.list.
+     */
+    404: unknown;
+    /**
+     * RESOURCE_IN_USE: a non-archived agent pins this version, or attaches the skill without a pin and this is its last version; the message names the agents.
+     */
+    409: unknown;
+};
+export type SkillsVersionsDeleteResponses = {
+    /**
+     * Successful response
+     */
+    200: AgentManaged312;
+};
+export type SkillsVersionsDeleteResponse = SkillsVersionsDeleteResponses[keyof SkillsVersionsDeleteResponses];
+export type SkillsVersionsRetrieveData = {
+    body?: never;
+    path: {
+        /**
+         * Skill id (skill_...), as returned by skills.create or skills.list. A skill of another organization returns 404.
+         */
+        skill_id: string;
+        /**
+         * Skill version id, as returned by skills.versions.create or skills.versions.list; an opaque string that increases with each upload.
+         */
+        version: string;
+    };
+    query?: never;
+    url: '/agent/v1/skills/{skill_id}/versions/{version}';
+};
+export type SkillsVersionsRetrieveErrors = {
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Skill or version not found. Take version ids from skills.versions.list.
+     */
+    404: unknown;
+};
+export type SkillsVersionsRetrieveResponses = {
+    /**
+     * Successful response
+     */
+    200: AgentManaged311;
+};
+export type SkillsVersionsRetrieveResponse = SkillsVersionsRetrieveResponses[keyof SkillsVersionsRetrieveResponses];
+export type SkillsVersionsDownloadData = {
+    body?: never;
+    path: {
+        /**
+         * Skill id (skill_...), as returned by skills.create or skills.list. A skill of another organization returns 404.
+         */
+        skill_id: string;
+        /**
+         * Skill version id, as returned by skills.versions.create or skills.versions.list; an opaque string that increases with each upload.
+         */
+        version: string;
+    };
+    query?: never;
+    url: '/agent/v1/skills/{skill_id}/versions/{version}/content';
+};
+export type SkillsVersionsDownloadErrors = {
+    /**
+     * The API key is missing, invalid or revoked. Send a valid key as X-API-Key or as a Bearer token.
+     */
+    401: unknown;
+    /**
+     * permission_error: the credential's role or bound resources do not allow this operation. Use a key with access to the agent domain and its resources.
+     */
+    403: unknown;
+    /**
+     * Skill or version not found, or the version was deleted. Take version ids from skills.versions.list.
+     */
+    404: unknown;
+};
+export type SkillsVersionsDownloadResponses = {
+    /**
+     * Binary response body
+     */
+    200: Blob | File;
+};
+export type SkillsVersionsDownloadResponse = SkillsVersionsDownloadResponses[keyof SkillsVersionsDownloadResponses];
 export type ApplicationGetSubdomainData = {
     body?: never;
     path?: never;