@desplega.ai/agent-swarm 1.113.0 → 1.115.0

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "Agent Swarm API",
-    "version": "1.113.0",
+    "version": "1.115.0",
     "description": "Multi-agent orchestration API for Claude Code, Codex, and Gemini CLI. Enables task distribution, agent communication, and service discovery.\n\nMCP tools are documented separately in [MCP.md](./MCP.md)."
   },
   "servers": [
@@ -560,6 +560,7 @@
                       "medium",
                       "high",
                       "xhigh",
+                      "max",
                       null
                     ]
                   }
@@ -986,7 +987,8 @@
                               "low",
                               "medium",
                               "high",
-                              "xhigh"
+                              "xhigh",
+                              "max"
                             ]
                           }
                         },
@@ -1108,7 +1110,8 @@
                           "low",
                           "medium",
                           "high",
-                          "xhigh"
+                          "xhigh",
+                          "max"
                         ]
                       }
                     },
@@ -6378,6 +6381,77 @@
         }
       }
     },
+    "/api/oauth/{provider}/callback": {
+      "get": {
+        "operationId": "oauth_generic_callback",
+        "summary": "Generic OAuth redirect target for script credential bindings",
+        "tags": [
+          "OAuth"
+        ],
+        "parameters": [
+          {
+            "schema": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 255,
+              "pattern": "^[A-Za-z0-9_-]+$"
+            },
+            "required": true,
+            "name": "provider",
+            "in": "path"
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "required": false,
+            "name": "code",
+            "in": "query"
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "required": false,
+            "name": "state",
+            "in": "query"
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "required": false,
+            "name": "error",
+            "in": "query"
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "required": false,
+            "name": "error_description",
+            "in": "query"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OAuth authorization completed"
+          },
+          "400": {
+            "description": "Missing or invalid OAuth callback parameters"
+          },
+          "404": {
+            "description": "OAuth app not configured"
+          },
+          "409": {
+            "description": "Provider has a dedicated OAuth callback"
+          },
+          "502": {
+            "description": "Token exchange failed"
+          }
+        }
+      }
+    },
     "/@swarm/api/{path}": {
       "get": {
         "summary": "Cookie-gated proxy to the swarm API (used by db-backed page iframes)",
@@ -9360,26 +9434,965 @@
               }
             }
           }
-        },
+        },
+        "responses": {
+          "200": {
+            "description": "Schedule patched"
+          },
+          "400": {
+            "description": "Validation error"
+          },
+          "404": {
+            "description": "Schedule not found"
+          },
+          "409": {
+            "description": "Duplicate name"
+          }
+        }
+      },
+      "delete": {
+        "summary": "Delete a schedule",
+        "tags": [
+          "Schedules"
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "schema": {
+              "type": "string"
+            },
+            "required": true,
+            "name": "id",
+            "in": "path"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Schedule deleted"
+          },
+          "404": {
+            "description": "Schedule not found"
+          }
+        }
+      }
+    },
+    "/api/script-connections": {
+      "get": {
+        "operationId": "script_connections_list",
+        "summary": "List script connections",
+        "description": "Dashboard read of OpenAPI, GraphQL, and MCP script connections with credential summaries.",
+        "tags": [
+          "Script Connections"
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "schema": {
+              "type": "string",
+              "enum": [
+                "openapi",
+                "graphql",
+                "mcp"
+              ]
+            },
+            "required": false,
+            "name": "kind",
+            "in": "query"
+          },
+          {
+            "schema": {
+              "type": "string",
+              "enum": [
+                "global",
+                "agent",
+                "repo"
+              ]
+            },
+            "required": false,
+            "name": "scope",
+            "in": "query"
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "required": false,
+            "name": "scopeId",
+            "in": "query"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Script connections"
+          },
+          "400": {
+            "description": "Validation error"
+          }
+        }
+      },
+      "post": {
+        "operationId": "script_connections_upsert",
+        "summary": "Create or update a script connection",
+        "tags": [
+          "Script Connections"
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "oneOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "id": {
+                        "type": "string",
+                        "format": "uuid"
+                      },
+                      "slug": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 80
+                      },
+                      "displayName": {
+                        "type": "string",
+                        "maxLength": 160
+                      },
+                      "scope": {
+                        "type": "string",
+                        "enum": [
+                          "global",
+                          "agent",
+                          "repo"
+                        ]
+                      },
+                      "scopeId": {
+                        "type": [
+                          "string",
+                          "null"
+                        ],
+                        "minLength": 1,
+                        "maxLength": 255
+                      },
+                      "allowedHosts": {
+                        "type": "array",
+                        "items": {
+                          "type": "string",
+                          "minLength": 1
+                        }
+                      },
+                      "credentialBindingId": {
+                        "type": [
+                          "string",
+                          "null"
+                        ],
+                        "format": "uuid"
+                      },
+                      "configKey": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 255
+                      },
+                      "headerTemplate": {
+                        "type": "string",
+                        "minLength": 1
+                      },
+                      "queryTemplate": {
+                        "type": "string",
+                        "minLength": 1
+                      },
+                      "authKind": {
+                        "type": "string",
+                        "enum": [
+                          "config",
+                          "oauth"
+                        ]
+                      },
+                      "oauthProvider": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 255,
+                        "pattern": "^[A-Za-z0-9_-]+$"
+                      },
+                      "enabled": {
+                        "type": "boolean"
+                      },
+                      "kind": {
+                        "type": "string",
+                        "enum": [
+                          "openapi"
+                        ]
+                      },
+                      "baseUrl": {
+                        "type": "string",
+                        "format": "uri"
+                      },
+                      "openapiSpecUrl": {
+                        "type": "string",
+                        "format": "uri"
+                      },
+                      "openapiSpecJson": {
+                        "type": "string"
+                      }
+                    },
+                    "required": [
+                      "slug",
+                      "kind",
+                      "baseUrl"
+                    ]
+                  },
+                  {
+                    "type": "object",
+                    "properties": {
+                      "id": {
+                        "type": "string",
+                        "format": "uuid"
+                      },
+                      "slug": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 80
+                      },
+                      "displayName": {
+                        "type": "string",
+                        "maxLength": 160
+                      },
+                      "scope": {
+                        "type": "string",
+                        "enum": [
+                          "global",
+                          "agent",
+                          "repo"
+                        ]
+                      },
+                      "scopeId": {
+                        "type": [
+                          "string",
+                          "null"
+                        ],
+                        "minLength": 1,
+                        "maxLength": 255
+                      },
+                      "allowedHosts": {
+                        "type": "array",
+                        "items": {
+                          "type": "string",
+                          "minLength": 1
+                        },
+                        "minItems": 1
+                      },
+                      "credentialBindingId": {
+                        "type": [
+                          "string",
+                          "null"
+                        ],
+                        "format": "uuid"
+                      },
+                      "configKey": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 255
+                      },
+                      "headerTemplate": {
+                        "type": "string",
+                        "minLength": 1
+                      },
+                      "queryTemplate": {
+                        "type": "string",
+                        "minLength": 1
+                      },
+                      "authKind": {
+                        "type": "string",
+                        "enum": [
+                          "config",
+                          "oauth"
+                        ]
+                      },
+                      "oauthProvider": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 255,
+                        "pattern": "^[A-Za-z0-9_-]+$"
+                      },
+                      "enabled": {
+                        "type": "boolean"
+                      },
+                      "kind": {
+                        "type": "string",
+                        "enum": [
+                          "graphql"
+                        ]
+                      },
+                      "baseUrl": {
+                        "type": "string",
+                        "format": "uri"
+                      }
+                    },
+                    "required": [
+                      "slug",
+                      "allowedHosts",
+                      "kind",
+                      "baseUrl"
+                    ]
+                  },
+                  {
+                    "type": "object",
+                    "properties": {
+                      "id": {
+                        "type": "string",
+                        "format": "uuid"
+                      },
+                      "slug": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 80
+                      },
+                      "displayName": {
+                        "type": "string",
+                        "maxLength": 160
+                      },
+                      "scope": {
+                        "type": "string",
+                        "enum": [
+                          "global",
+                          "agent",
+                          "repo"
+                        ]
+                      },
+                      "scopeId": {
+                        "type": [
+                          "string",
+                          "null"
+                        ],
+                        "minLength": 1,
+                        "maxLength": 255
+                      },
+                      "allowedHosts": {
+                        "type": "array",
+                        "items": {
+                          "type": "string",
+                          "minLength": 1
+                        }
+                      },
+                      "credentialBindingId": {
+                        "type": [
+                          "string",
+                          "null"
+                        ],
+                        "format": "uuid"
+                      },
+                      "configKey": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 255
+                      },
+                      "headerTemplate": {
+                        "type": "string",
+                        "minLength": 1
+                      },
+                      "queryTemplate": {
+                        "type": "string",
+                        "minLength": 1
+                      },
+                      "authKind": {
+                        "type": "string",
+                        "enum": [
+                          "config",
+                          "oauth"
+                        ]
+                      },
+                      "oauthProvider": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 255,
+                        "pattern": "^[A-Za-z0-9_-]+$"
+                      },
+                      "enabled": {
+                        "type": "boolean"
+                      },
+                      "kind": {
+                        "type": "string",
+                        "enum": [
+                          "mcp"
+                        ]
+                      },
+                      "mcpServerId": {
+                        "type": "string",
+                        "format": "uuid"
+                      }
+                    },
+                    "required": [
+                      "slug",
+                      "kind",
+                      "mcpServerId"
+                    ]
+                  }
+                ]
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Saved script connection"
+          },
+          "400": {
+            "description": "Validation or generation error"
+          },
+          "403": {
+            "description": "Only the lead agent can manage script connections"
+          }
+        }
+      }
+    },
+    "/api/script-connections/{id}": {
+      "get": {
+        "operationId": "script_connections_get",
+        "summary": "Get script connection detail",
+        "tags": [
+          "Script Connections"
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            },
+            "required": true,
+            "name": "id",
+            "in": "path"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Script connection detail"
+          },
+          "404": {
+            "description": "Script connection not found"
+          }
+        }
+      }
+    },
+    "/api/script-connections/{id}/refresh": {
+      "post": {
+        "operationId": "script_connections_refresh",
+        "summary": "Refresh a script connection",
+        "tags": [
+          "Script Connections"
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            },
+            "required": true,
+            "name": "id",
+            "in": "path"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Refreshed script connection"
+          },
+          "400": {
+            "description": "Connection cannot be refreshed"
+          },
+          "403": {
+            "description": "Only the lead agent can manage script connections"
+          },
+          "404": {
+            "description": "Script connection not found"
+          }
+        }
+      }
+    },
+    "/api/script-connections/{id}/disable": {
+      "post": {
+        "operationId": "script_connections_set_enabled",
+        "summary": "Enable or disable a script connection",
+        "tags": [
+          "Script Connections"
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            },
+            "required": true,
+            "name": "id",
+            "in": "path"
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "enabled": {
+                    "type": "boolean"
+                  }
+                },
+                "required": [
+                  "enabled"
+                ]
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Updated script connection"
+          },
+          "403": {
+            "description": "Only the lead agent can manage script connections"
+          },
+          "404": {
+            "description": "Script connection not found"
+          }
+        }
+      }
+    },
+    "/api/credential-bindings": {
+      "get": {
+        "operationId": "credential_bindings_list",
+        "summary": "List script credential bindings",
+        "tags": [
+          "Script Connections"
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Credential bindings"
+          }
+        }
+      },
+      "post": {
+        "operationId": "credential_bindings_upsert",
+        "summary": "Create or update a script credential binding",
+        "tags": [
+          "Script Connections"
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "id": {
+                    "type": "string",
+                    "format": "uuid"
+                  },
+                  "configKey": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 255
+                  },
+                  "allowedHosts": {
+                    "type": "array",
+                    "items": {
+                      "type": "string",
+                      "minLength": 1
+                    },
+                    "minItems": 1
+                  },
+                  "headerTemplate": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "queryTemplate": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "scope": {
+                    "type": "string",
+                    "enum": [
+                      "global",
+                      "agent",
+                      "repo"
+                    ],
+                    "default": "global"
+                  },
+                  "scopeId": {
+                    "type": [
+                      "string",
+                      "null"
+                    ],
+                    "minLength": 1,
+                    "maxLength": 255
+                  },
+                  "active": {
+                    "type": "boolean",
+                    "default": true
+                  },
+                  "authKind": {
+                    "type": "string",
+                    "enum": [
+                      "config",
+                      "oauth"
+                    ],
+                    "default": "config"
+                  },
+                  "oauthProvider": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 255,
+                    "pattern": "^[A-Za-z0-9_-]+$"
+                  }
+                },
+                "required": [
+                  "configKey",
+                  "allowedHosts"
+                ]
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Saved credential binding"
+          },
+          "400": {
+            "description": "Validation error"
+          },
+          "403": {
+            "description": "Only the lead agent can manage script connections"
+          }
+        }
+      }
+    },
+    "/api/oauth-apps": {
+      "get": {
+        "operationId": "oauth_apps_list",
+        "summary": "List OAuth apps for script credential bindings",
+        "tags": [
+          "Script Connections"
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OAuth apps without client secrets"
+          }
+        }
+      },
+      "post": {
+        "operationId": "oauth_apps_upsert",
+        "summary": "Create or update an OAuth app for script credential bindings",
+        "tags": [
+          "Script Connections"
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "provider": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 255,
+                    "pattern": "^[A-Za-z0-9_-]+$"
+                  },
+                  "clientId": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "clientSecret": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "authorizeUrl": {
+                    "type": "string",
+                    "format": "uri"
+                  },
+                  "tokenUrl": {
+                    "type": "string",
+                    "format": "uri"
+                  },
+                  "scopes": {
+                    "type": "array",
+                    "items": {
+                      "type": "string",
+                      "minLength": 1
+                    },
+                    "default": []
+                  },
+                  "extraParams": {
+                    "type": "object",
+                    "additionalProperties": {
+                      "type": "string"
+                    }
+                  },
+                  "tokenAuthStyle": {
+                    "type": "string",
+                    "enum": [
+                      "body",
+                      "basic"
+                    ]
+                  },
+                  "tokenBodyFormat": {
+                    "type": "string",
+                    "enum": [
+                      "form",
+                      "json"
+                    ]
+                  }
+                },
+                "required": [
+                  "provider",
+                  "clientId",
+                  "authorizeUrl",
+                  "tokenUrl"
+                ]
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Saved OAuth app without client secret"
+          },
+          "400": {
+            "description": "Validation error"
+          },
+          "403": {
+            "description": "Only the lead agent can manage script connections"
+          }
+        }
+      }
+    },
+    "/api/oauth-apps/discover": {
+      "post": {
+        "operationId": "oauth_apps_discover",
+        "summary": "Discover OAuth endpoints from provider metadata",
+        "tags": [
+          "Script Connections"
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "url": {
+                    "type": "string",
+                    "format": "uri"
+                  }
+                },
+                "required": [
+                  "url"
+                ]
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Discovered OAuth metadata"
+          },
+          "400": {
+            "description": "Discovery failed"
+          },
+          "403": {
+            "description": "Only the lead agent can manage script connections"
+          }
+        }
+      }
+    },
+    "/api/oauth-apps/{provider}": {
+      "delete": {
+        "operationId": "oauth_apps_delete",
+        "summary": "Delete an OAuth app and its tokens",
+        "tags": [
+          "Script Connections"
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "schema": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 255,
+              "pattern": "^[A-Za-z0-9_-]+$"
+            },
+            "required": true,
+            "name": "provider",
+            "in": "path"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OAuth app deleted"
+          },
+          "403": {
+            "description": "Only the lead agent can manage script connections"
+          },
+          "404": {
+            "description": "OAuth app not found"
+          }
+        }
+      }
+    },
+    "/api/oauth-apps/{provider}/authorize-url": {
+      "post": {
+        "operationId": "oauth_apps_authorize_url",
+        "summary": "Build an OAuth authorization URL",
+        "tags": [
+          "Script Connections"
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "schema": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 255,
+              "pattern": "^[A-Za-z0-9_-]+$"
+            },
+            "required": true,
+            "name": "provider",
+            "in": "path"
+          }
+        ],
         "responses": {
           "200": {
-            "description": "Schedule patched"
+            "description": "OAuth authorization URL"
           },
-          "400": {
-            "description": "Validation error"
+          "403": {
+            "description": "Only the lead agent can manage script connections"
           },
           "404": {
-            "description": "Schedule not found"
+            "description": "OAuth app not found"
+          }
+        }
+      }
+    },
+    "/api/integrations-catalog": {
+      "get": {
+        "operationId": "integrations_catalog_list",
+        "summary": "Proxy integrations.sh catalog entries",
+        "tags": [
+          "Script Connections"
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Integrations catalog entries"
           },
-          "409": {
-            "description": "Duplicate name"
+          "502": {
+            "description": "Catalog upstream unavailable"
           }
         }
-      },
+      }
+    },
+    "/api/integrations-catalog/{domain}/surface": {
+      "get": {
+        "operationId": "integrations_catalog_surface",
+        "summary": "Proxy integrations.sh per-domain surface details (trimmed for the Add Connection flow)",
+        "tags": [
+          "Script Connections"
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "schema": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 255,
+              "pattern": "^[a-z0-9.-]+$/i"
+            },
+            "required": true,
+            "name": "domain",
+            "in": "path"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Trimmed integration surface details for a domain"
+          },
+          "404": {
+            "description": "No surface data for this domain"
+          },
+          "502": {
+            "description": "Surface upstream unavailable"
+          }
+        }
+      }
+    },
+    "/api/oauth-apps/{provider}/tokens": {
       "delete": {
-        "summary": "Delete a schedule",
+        "operationId": "oauth_app_disconnect",
+        "summary": "Disconnect an OAuth app: delete stored tokens (best-effort remote revocation when a revocation endpoint is known)",
         "tags": [
-          "Schedules"
+          "Script Connections"
         ],
         "security": [
           {
@@ -9389,19 +10402,69 @@
         "parameters": [
           {
             "schema": {
-              "type": "string"
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 255,
+              "pattern": "^[A-Za-z0-9_-]+$"
             },
             "required": true,
-            "name": "id",
+            "name": "provider",
             "in": "path"
           }
         ],
         "responses": {
           "200": {
-            "description": "Schedule deleted"
+            "description": "Disconnect result"
+          },
+          "403": {
+            "description": "Only the lead agent can manage script connections"
           },
           "404": {
-            "description": "Schedule not found"
+            "description": "OAuth app not found"
+          }
+        }
+      }
+    },
+    "/api/oauth-apps/{provider}/refresh": {
+      "post": {
+        "operationId": "oauth_app_refresh_tokens",
+        "summary": "Force-refresh the stored OAuth tokens for a provider (never returns token values)",
+        "tags": [
+          "Script Connections"
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "schema": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 255,
+              "pattern": "^[A-Za-z0-9_-]+$"
+            },
+            "required": true,
+            "name": "provider",
+            "in": "path"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Refresh result with token status and new expiry"
+          },
+          "400": {
+            "description": "No stored tokens or provider does not support refresh"
+          },
+          "403": {
+            "description": "Only the lead agent can manage script connections"
+          },
+          "404": {
+            "description": "OAuth app not found"
+          },
+          "502": {
+            "description": "Provider token endpoint rejected the refresh"
           }
         }
       }
@@ -9995,6 +11058,66 @@
         }
       }
     },
+    "/api/script-connections/{id}/mcp-call": {
+      "post": {
+        "summary": "Invoke a tool on an MCP script connection",
+        "tags": [
+          "Script Connections"
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            },
+            "required": true,
+            "name": "id",
+            "in": "path"
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "tool": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "arguments": {
+                    "type": "object",
+                    "additionalProperties": {}
+                  }
+                },
+                "required": [
+                  "tool"
+                ]
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "MCP call result"
+          },
+          "400": {
+            "description": "Invalid MCP connection or request"
+          },
+          "403": {
+            "description": "Not allowed to invoke this MCP connection"
+          },
+          "404": {
+            "description": "Script connection or agent not found"
+          }
+        }
+      }
+    },
     "/api/session-logs": {
       "post": {
         "summary": "Store session logs",
@@ -13290,6 +14413,15 @@
             "name": "createdAfter",
             "in": "query"
           },
+          {
+            "schema": {
+              "type": "string",
+              "format": "date-time"
+            },
+            "required": false,
+            "name": "createdBefore",
+            "in": "query"
+          },
           {
             "schema": {
               "type": "string"
@@ -13298,6 +14430,18 @@
             "name": "source",
             "in": "query"
           },
+          {
+            "schema": {
+              "type": "string",
+              "enum": [
+                "lastUpdatedAt",
+                "createdAt"
+              ]
+            },
+            "required": false,
+            "name": "orderBy",
+            "in": "query"
+          },
           {
             "schema": {
               "type": [
@@ -13438,7 +14582,8 @@
                       "low",
                       "medium",
                       "high",
-                      "xhigh"
+                      "xhigh",
+                      "max"
                     ]
                   }
                 },
@@ -15597,7 +16742,88 @@
                             },
                             "hmacHeader": {
                               "type": "string",
-                              "default": "X-Hub-Signature-256"
+                              "default": "X-Hub-Signature-256",
+                              "description": "Legacy HMAC header for webhook verification. Prefer verification.header for new workflows."
+                            },
+                            "verification": {
+                              "oneOf": [
+                                {
+                                  "type": "object",
+                                  "properties": {
+                                    "format": {
+                                      "type": "string",
+                                      "enum": [
+                                        "hmac-sha256"
+                                      ]
+                                    },
+                                    "header": {
+                                      "type": "string",
+                                      "default": "X-Hub-Signature-256",
+                                      "description": "Header containing HMAC-SHA256 over the raw request body. Accepts sha256=<hex> or bare hex."
+                                    }
+                                  },
+                                  "required": [
+                                    "format"
+                                  ]
+                                },
+                                {
+                                  "type": "object",
+                                  "properties": {
+                                    "format": {
+                                      "type": "string",
+                                      "enum": [
+                                        "timestamped-hmac-sha256"
+                                      ]
+                                    },
+                                    "header": {
+                                      "type": "string",
+                                      "minLength": 1,
+                                      "description": "Header containing comma-separated timestamp/signature pairs such as t=<timestamp>,v1=<hex>."
+                                    },
+                                    "timestampKey": {
+                                      "type": "string",
+                                      "default": "t",
+                                      "description": "Timestamp field key in the signature header"
+                                    },
+                                    "signatureKey": {
+                                      "type": "string",
+                                      "default": "v1",
+                                      "description": "Signature field key in the signature header; multiple entries are allowed"
+                                    },
+                                    "toleranceSeconds": {
+                                      "type": "integer",
+                                      "exclusiveMinimum": 0,
+                                      "default": 300,
+                                      "description": "Maximum allowed clock skew, in seconds, for replay protection"
+                                    }
+                                  },
+                                  "required": [
+                                    "format",
+                                    "header"
+                                  ]
+                                },
+                                {
+                                  "type": "object",
+                                  "properties": {
+                                    "format": {
+                                      "type": "string",
+                                      "enum": [
+                                        "token-equality"
+                                      ]
+                                    },
+                                    "header": {
+                                      "type": "string",
+                                      "minLength": 1,
+                                      "description": "Header containing the shared token to compare"
+                                    }
+                                  },
+                                  "required": [
+                                    "format",
+                                    "header"
+                                  ]
+                                }
+                              ],
+                              "description": "Optional webhook verification format. Omit to keep legacy HMAC-SHA256 behavior with fallback header scanning."
                             }
                           },
                           "required": [
@@ -15935,7 +17161,88 @@
                             },
                             "hmacHeader": {
                               "type": "string",
-                              "default": "X-Hub-Signature-256"
+                              "default": "X-Hub-Signature-256",
+                              "description": "Legacy HMAC header for webhook verification. Prefer verification.header for new workflows."
+                            },
+                            "verification": {
+                              "oneOf": [
+                                {
+                                  "type": "object",
+                                  "properties": {
+                                    "format": {
+                                      "type": "string",
+                                      "enum": [
+                                        "hmac-sha256"
+                                      ]
+                                    },
+                                    "header": {
+                                      "type": "string",
+                                      "default": "X-Hub-Signature-256",
+                                      "description": "Header containing HMAC-SHA256 over the raw request body. Accepts sha256=<hex> or bare hex."
+                                    }
+                                  },
+                                  "required": [
+                                    "format"
+                                  ]
+                                },
+                                {
+                                  "type": "object",
+                                  "properties": {
+                                    "format": {
+                                      "type": "string",
+                                      "enum": [
+                                        "timestamped-hmac-sha256"
+                                      ]
+                                    },
+                                    "header": {
+                                      "type": "string",
+                                      "minLength": 1,
+                                      "description": "Header containing comma-separated timestamp/signature pairs such as t=<timestamp>,v1=<hex>."
+                                    },
+                                    "timestampKey": {
+                                      "type": "string",
+                                      "default": "t",
+                                      "description": "Timestamp field key in the signature header"
+                                    },
+                                    "signatureKey": {
+                                      "type": "string",
+                                      "default": "v1",
+                                      "description": "Signature field key in the signature header; multiple entries are allowed"
+                                    },
+                                    "toleranceSeconds": {
+                                      "type": "integer",
+                                      "exclusiveMinimum": 0,
+                                      "default": 300,
+                                      "description": "Maximum allowed clock skew, in seconds, for replay protection"
+                                    }
+                                  },
+                                  "required": [
+                                    "format",
+                                    "header"
+                                  ]
+                                },
+                                {
+                                  "type": "object",
+                                  "properties": {
+                                    "format": {
+                                      "type": "string",
+                                      "enum": [
+                                        "token-equality"
+                                      ]
+                                    },
+                                    "header": {
+                                      "type": "string",
+                                      "minLength": 1,
+                                      "description": "Header containing the shared token to compare"
+                                    }
+                                  },
+                                  "required": [
+                                    "format",
+                                    "header"
+                                  ]
+                                }
+                              ],
+                              "description": "Optional webhook verification format. Omit to keep legacy HMAC-SHA256 behavior with fallback header scanning."
                             }
                           },
                           "required": [