@labelbox/rl-sdk 0.0.0 → 0.0.144

package/dist/generated/types.gen.d.ts

@@ -7741,7 +7741,7 @@ export type ManagedAgentsApiError = {
     /**
      * Stable, machine-readable error identifier. This is the contract to branch on; the message is prose and may be reworded at any time.
      */
-    code: 'analytics' | 'analytics_not_ready' | 'artifact_fetch_unavailable' | 'artifact_generation_mismatch' | 'artifact_hash_mismatch' | 'artifact_invalid_events' | 'artifact_invalid_json' | 'artifact_not_allowlisted' | 'artifact_size_mismatch' | 'atomic_ingest_timeout' | 'auth_unavailable' | 'conflict' | 'consolidation_unstartable' | 'content_store_request_canceled' | 'content_store_unavailable' | 'content_store_upload_timeout' | 'credential_encryption_unconfigured' | 'entity_family_not_permitted' | 'environment_work_unconfigured' | 'environment_worker_auth_unavailable' | 'execution_unconfigured' | 'forbidden' | 'github_integration_unavailable' | 'github_rate_limited' | 'github_unavailable' | 'idempotency_conflict' | 'idempotency_in_progress' | 'idempotency_unavailable' | 'ingest_policy_changed' | 'ingest_policy_not_found' | 'ingest_policy_revoked' | 'integrations_unconfigured' | 'internal_error' | 'invalid_json' | 'invalid_pull_request_review_result' | 'invalid_request' | 'missing_dependency' | 'model_gateway_metadata_missing' | 'model_gateway_unconfigured' | 'model_gateway_unreachable' | 'mutation_transaction_budget_exceeded' | 'not_found' | 'page_token_expired' | 'payload_too_large' | 'rate_limited' | 'repository_automation_unconfigured' | 'request_too_large' | 'reserved_source_type' | 'revision_conflict' | 'run_log_store_unavailable' | 'session_cleanup_failed' | 'skill_storage_unconfigured' | 'source_ownership_mismatch' | 'source_revision_conflict' | 'spanner_unavailable' | 'streaming_unsupported' | 'submission_transaction_budget_exceeded' | 'task_version_number_conflict' | 'too_many_streams' | 'unauthorized' | 'version_content_conflict';
+    code: 'analytics' | 'analytics_not_ready' | 'artifact_fetch_unavailable' | 'artifact_generation_mismatch' | 'artifact_hash_mismatch' | 'artifact_invalid_events' | 'artifact_invalid_json' | 'artifact_not_allowlisted' | 'artifact_size_mismatch' | 'atomic_ingest_timeout' | 'auth_unavailable' | 'automations_unconfigured' | 'conflict' | 'consolidation_unstartable' | 'content_store_request_canceled' | 'content_store_unavailable' | 'content_store_upload_timeout' | 'credential_encryption_unconfigured' | 'entity_family_not_permitted' | 'environment_work_unconfigured' | 'environment_worker_auth_unavailable' | 'execution_unconfigured' | 'forbidden' | 'github_integration_unavailable' | 'github_rate_limited' | 'github_unavailable' | 'idempotency_conflict' | 'idempotency_in_progress' | 'idempotency_unavailable' | 'ingest_policy_changed' | 'ingest_policy_not_found' | 'ingest_policy_revoked' | 'integrations_unconfigured' | 'internal_error' | 'invalid_json' | 'invalid_pull_request_review_result' | 'invalid_request' | 'missing_dependency' | 'model_gateway_metadata_missing' | 'model_gateway_unconfigured' | 'model_gateway_unreachable' | 'mutation_transaction_budget_exceeded' | 'not_found' | 'page_token_expired' | 'payload_too_large' | 'rate_limited' | 'repository_automation_unconfigured' | 'request_too_large' | 'reserved_source_type' | 'revision_conflict' | 'run_log_store_unavailable' | 'session_cleanup_failed' | 'skill_storage_unconfigured' | 'source_ownership_mismatch' | 'source_revision_conflict' | 'spanner_unavailable' | 'streaming_unsupported' | 'submission_transaction_budget_exceeded' | 'task_version_number_conflict' | 'too_many_streams' | 'unauthorized' | 'version_content_conflict' | 'webhook_delivery_too_large';
     /**
      * Structured, code-specific context -- measured values and limits, for example -- so a client need not parse the message.
      */
@@ -7772,74 +7772,156 @@ export type ManagedAgentsApiErrorBody = {
     error: ManagedAgentsApiError;
 };
 /**
- * The trusted side effects one repository automation performed after its result passed validation: the patch it captured and the review it published. A session that completed before output finalization existed reads back zero-valued, meaning neither happened.
+ * A provider-neutral rule that starts or continues an ordinary managed-agent session from verified webhook events or structured manual input.
  */
-export type ManagedAgentsAutomationResult = {
-    patch?: ManagedAgentsPatchArtifact;
-    publication?: ManagedAgentsPublication;
+export type ManagedAgentsAutomation = {
+    /**
+     * Managed agent started for each new matching conversation.
+     */
+    agent_id?: string;
+    /**
+     * Server-assigned automation identifier.
+     */
+    automation_id?: string;
+    continue_filter?: ManagedAgentsWebhookFilter;
+    /**
+     * Ordered values joined into a stable external conversation identity; omit to start an independent session per matching delivery.
+     */
+    conversation_key?: Array<ManagedAgentsWebhookConversationPart>;
+    /**
+     * Server-assigned RFC 3339 creation timestamp.
+     */
+    created_at?: string;
+    /**
+     * Authenticated principal that created the automation.
+     */
+    created_by?: string;
+    /**
+     * Explicit credential grants made available to automation sessions.
+     */
+    credential_refs?: Array<ManagedAgentsVaultCredentialRef>;
+    /**
+     * Human-readable name shown in the automation catalog and session provenance.
+     */
+    display_name?: string;
+    /**
+     * Whether matching webhook deliveries may dispatch this automation.
+     */
+    enabled?: boolean;
+    /**
+     * Agent Service environment used to run sessions created by this automation.
+     */
+    environment_id?: string;
+    /**
+     * Task instructions given to the agent together with the triggering or manual payload.
+     */
+    instructions?: string;
+    /**
+     * Organization that owns the automation, resolved from the authenticated request scope.
+     */
+    organization_id?: string;
+    start_filter?: ManagedAgentsWebhookFilter;
+    /**
+     * Opaque client-owned template identifier used to select a guided editor; unknown identifiers remain valid custom automations.
+     */
+    template_id?: string;
+    /**
+     * Server-assigned RFC 3339 timestamp of the most recent configuration change.
+     */
+    updated_at?: string;
+    /**
+     * Vaults available to automation sessions, further narrowed by credential_refs when configured.
+     */
+    vault_ids?: Array<string>;
+    /**
+     * Webhook endpoint that supplies automatic events; omit for a manual-only automation.
+     */
+    webhook_endpoint_id?: string;
 };
 /**
- * Response body of POST /v1/sessions/{session_id}/cancel. Cancel is terminal for the run but not for the record: the workflow is stopped and the sandbox torn down, while the session, its events, and its outcomes remain readable. The session row itself is removed from reads only by the separate soft-delete endpoint.
+ * Automations available in the calling organization.
  */
-export type ManagedAgentsCancelledResponse = {
+export type ManagedAgentsAutomationListResponse = {
     /**
-     * Always true. The workflow was cancelled and the sandbox closed; failures are HTTP errors instead, so this field never reports false. It is also true when the session had already reached a terminal state, making cancel safe to retry.
+     * Automations owned by the calling organization.
      */
-    cancelled?: boolean;
+    automations?: unknown;
 };
 /**
- * Request body completing integration authorization after the provider redirects the user back. Sent from an authenticated session so the organization comes from the session and the state nonce rather than from the provider's forgeable callback parameters.
+ * Provider-neutral configuration for creating or replacing an automation.
  */
-export type ManagedAgentsCompleteIntegrationInstallRequest = {
+export type ManagedAgentsAutomationRequest = {
     /**
-     * Provider account selected before authorization. For GitHub, an organization or user login that must appear in the authorizing user's accessible installations.
+     * Managed agent started for each new matching conversation.
      */
-    account_login?: string;
+    agent_id: string;
+    continue_filter?: ManagedAgentsWebhookFilter;
     /**
-     * Provider authorization code, proving which user authorized this connection.
+     * Ordered values joined into the external conversation identity.
      */
-    code: string;
+    conversation_key?: Array<ManagedAgentsWebhookConversationPart>;
     /**
-     * Legacy provider installation identifier accepted for callbacks already in flight during rollout. Verified against the authorizing user before it is trusted.
+     * Explicit credential grants made available to automation sessions.
      */
-    installation_id?: string;
+    credential_refs?: Array<ManagedAgentsVaultCredentialRef>;
     /**
-     * Legacy provider setup action accepted only for an installation callback already in flight during rollout. Optional; omit when the provider sends none.
+     * Human-readable name shown in the automation catalog and session provenance.
      */
-    setup_action?: string;
+    display_name: string;
     /**
-     * The nonce returned when authorization was started. Single-use and short-lived.
+     * Whether matching webhook deliveries may dispatch this automation.
      */
-    state: string;
-};
-/**
- * Result of a live health check against one integration connection: its refreshed state at the provider, whether a token could be minted, and what is missing if not. A failed check is reported here rather than as an HTTP error.
- */
-export type ManagedAgentsConnectionProbe = {
+    enabled?: boolean;
     /**
-     * Human-readable reason the probe did not succeed, such as a suspended install or a rejected mint. Empty when ok is true.
+     * Agent Service environment used to execute automation sessions.
      */
-    failure?: string;
+    environment_id: string;
     /**
-     * Permissions this service requires that the install has not granted at the required level. Reported, not enforced: accept the provider's pending permission request to clear them.
+     * Task instructions given to the agent together with the event or manual input.
      */
-    missing_permissions?: Array<string>;
+    instructions: string;
+    start_filter?: ManagedAgentsWebhookFilter;
     /**
-     * True only when the connection is active at the provider and a scoped token was successfully minted during this probe. False means the connection cannot currently be used; read failure for why. A probe that fails this way is still an HTTP 200.
+     * Opaque client-owned template identifier used to select a guided editor; unknown identifiers remain valid custom automations.
      */
-    ok?: boolean;
+    template_id?: string;
+    /**
+     * Vaults available to automation sessions, narrowed by credential_refs when configured.
+     */
+    vault_ids?: Array<string>;
+    /**
+     * Webhook endpoint that supplies automatic events; omit for a manual-only automation.
+     */
+    webhook_endpoint_id?: string;
+};
+/**
+ * The trusted side effects one repository automation performed after its result passed validation: the patch it captured and the review it published. A session that completed before output finalization existed reads back zero-valued, meaning neither happened.
+ */
+export type ManagedAgentsAutomationResult = {
+    patch?: ManagedAgentsPatchArtifact;
+    publication?: ManagedAgentsPublication;
+};
+/**
+ * Reference to the asynchronously running managed-agent session created by a manual automation run.
+ */
+export type ManagedAgentsAutomationRunResponse = {
     /**
-     * Number of provider resources the connection can authorize, for example selected GitHub repositories. The live probe credential may be narrower when the provider cannot represent the entire connection scope in one token. Zero when no token could be minted.
+     * Managed-agent session created for this automation run.
      */
-    resource_count?: number;
+    session_id?: string;
     /**
-     * Lifecycle of the provider install as of this probe: active (usable), suspended (paused at the provider), or revoked (uninstalled or deleted). Refreshed from the provider here, so it can differ from the previously stored value.
+     * Relative API path used to read the session and follow its progress.
      */
-    state?: string;
+    status_path?: string;
+};
+/**
+ * Response body of POST /v1/sessions/{session_id}/cancel. Cancel is terminal for the run but not for the record: the workflow is stopped and the sandbox torn down, while the session, its events, and its outcomes remain readable. The session row itself is removed from reads only by the separate soft-delete endpoint.
+ */
+export type ManagedAgentsCancelledResponse = {
     /**
-     * Whether a scoped credential could actually be issued during this probe. This is the check that predicts whether a session using the connection will work.
+     * Always true. The workflow was cancelled and the sandbox closed; failures are HTTP errors instead, so this field never reports false. It is also true when the session had already reached a terminal state, making cancel safe to retry.
      */
-    token_minted?: boolean;
+    cancelled?: boolean;
 };
 /**
  * One block of message content, following the Anthropic content-block shape: text, image, tool_use, tool_result, thinking, or a provider passthrough. The type field says which fields apply, and provider-native payloads are carried through verbatim.
@@ -8223,7 +8305,7 @@ export type ManagedAgentsCreateTriggerBindingRequest = {
     wake_event?: string;
 };
 /**
- * Request body for adding one credential to a vault. Its shape depends on credential_type, and exactly one of secret_value or secret_ref is accepted; secret material is encrypted at rest and never returned.
+ * Request body for adding one credential to a vault. Its shape depends on credential_type. bearer_token and env_var accept exactly one of secret_value or secret_ref; webhook_secret requires secret_value; integration accepts neither. Secret material is encrypted at rest and never returned.
  */
 export type ManagedAgentsCreateVaultCredentialRequest = {
     /**
@@ -8231,9 +8313,9 @@ export type ManagedAgentsCreateVaultCredentialRequest = {
      */
     allowed_hosts?: Array<string>;
     /**
-     * mcp_oauth and bearer_token authenticate to an MCP server and require mcp_server_url. env_var is exposed to the sandbox as an environment variable and requires secret_name. integration grants a connected third-party account and requires integration_connection_id; it carries no secret of its own.
+     * bearer_token authenticates to an MCP server and requires mcp_server_url. env_var is exposed to the sandbox for CLIs and SDKs. webhook_secret is control-plane-only material used to verify inbound webhook signatures. integration references a connected provider account and carries no secret of its own.
      */
-    credential_type: 'mcp_oauth' | 'bearer_token' | 'env_var' | 'integration';
+    credential_type: 'bearer_token' | 'env_var' | 'webhook_secret' | 'integration';
     /**
      * Operator-facing label.
      */
@@ -8273,7 +8355,7 @@ export type ManagedAgentsCreateVaultCredentialRequest = {
      */
     secret_name?: string;
     /**
-     * Reference to material stored outside this service, carrying a provider prefix. Requests carrying obvious inline secret material are rejected.
+     * Reference to material stored outside this service, carrying a provider prefix. Not supported for webhook_secret because verification runs in this control plane. Requests carrying obvious inline secret material are rejected.
      */
     secret_ref?: string;
     /**
@@ -8326,23 +8408,6 @@ export type ManagedAgentsDeletedResponse = {
      */
     deleted?: boolean;
 };
-/**
- * Summary of what removing an integration connection retired. Returned when a connection is disconnected, so a caller can see how many vault grants it invalidated.
- */
-export type ManagedAgentsDisconnectResult = {
-    /**
-     * Connection that was disconnected (UUID). Reconnecting the same provider install produces a new connection id, so this value is not reusable afterwards.
-     */
-    connection_id?: string;
-    /**
-     * Always true on success: the connection row was soft-deleted and this service will no longer mint tokens for it. The app itself is deliberately left installed at the provider.
-     */
-    deleted?: boolean;
-    /**
-     * Number of vault grants that referenced this connection and have stopped working. They are not restored by reconnecting and must be recreated against the new connection.
-     */
-    grants_revoked?: number;
-};
 /**
  * A sandbox environment a session executes in: its provider, resources, mounts, setup steps and idle/delete lifecycle. Created and started independently of any session.
  */
@@ -8834,98 +8899,6 @@ export type ManagedAgentsInferenceConfig = {
  * One place a credential is applied to an outbound request. Headers alone is recommended; a secret in a request body is far easier to log by accident.
  */
 export type ManagedAgentsInjectionLocation = 'headers' | 'body';
-/**
- * Where to send a user to authorize an integration, plus the one-time state nonce that ties the provider's callback back to this attempt. Returned when an authorization flow is started.
- */
-export type ManagedAgentsInstallStart = {
-    /**
-     * Single-use CSRF nonce identifying this install attempt, not a lifecycle status. Retain it, compare it to the state on the provider callback, and echo it back when completing the install; the organization is resolved from this nonce, so a mismatched or already-consumed value is rejected.
-     */
-    state?: string;
-    /**
-     * Absolute provider-hosted authorization page to redirect the user to. Carries the state nonce as a query parameter; send the user here rather than fetching it server-side.
-     */
-    url?: string;
-};
-/**
- * An organization's link to a third-party account, created by installing an integration such as the GitHub App. It holds no secret itself; grant it to an agent so sessions can mint short-lived provider credentials from it.
- */
-export type ManagedAgentsIntegrationConnection = {
-    /**
-     * Name of the connected third-party account, e.g. the GitHub org or user login. Cached at install time for display, so no provider call is needed to show it.
-     */
-    account_login?: string;
-    /**
-     * Kind of account that was connected, as the provider reports it, e.g. Organization or User for GitHub and workspace for Slack.
-     */
-    account_type?: string;
-    /**
-     * User who completed the install, recorded for audit. Empty for connections created by an internal admin route.
-     */
-    connected_by?: string;
-    /**
-     * Identifier for this connection (UUID). Server-assigned. Cite it when granting an agent access to the integration.
-     */
-    connection_id?: string;
-    /**
-     * RFC 3339 timestamp of when this record was created. Server-assigned.
-     */
-    created_at?: string;
-    /**
-     * The provider's own identifier for the link, which token minting addresses. The installation id for GitHub; the composite {api_app_id}:{team_id} for Slack.
-     */
-    external_id?: string;
-    /**
-     * Provider-specific non-secret connection facts recorded by the service, such as external account identifiers or an authorization ceiling.
-     */
-    metadata?: {
-        [key: string]: unknown;
-    };
-    /**
-     * Labelbox organization that owns this record. Resolved from the API key; never accepted from the caller.
-     */
-    organization_id?: string;
-    /**
-     * What the provider granted the install, as permission name to access level (e.g. contents: write). Used to narrow a minted token without a provider round trip and to explain why a permission preset is unavailable.
-     */
-    permissions?: {
-        [key: string]: string;
-    };
-    /**
-     * Third-party integration this connection links to: github or slack.
-     */
-    provider?: string;
-    /**
-     * Whether the install covers all of the account's resources or only chosen ones: all or selected. Informational only; the authoritative list stays at the provider.
-     */
-    resource_selection?: string;
-    /**
-     * Lifecycle of the connection: active can mint tokens, suspended is restorable at the provider and resolves to no credential, revoked was uninstalled and must be installed again.
-     */
-    state?: string;
-    /**
-     * RFC 3339 timestamp of the last change to this record. Server-assigned.
-     */
-    updated_at?: string;
-};
-/**
- * The integration connections belonging to the calling organization, as resolved from the API key. Returned when listing connections.
- */
-export type ManagedAgentsIntegrationConnectionListResponse = {
-    /**
-     * The organization's integration connections, including suspended and revoked ones. Disconnected connections are omitted.
-     */
-    connections?: unknown;
-};
-/**
- * The integration providers this deployment can connect to. Returned by the provider list a console reads before offering a connect action.
- */
-export type ManagedAgentsIntegrationProviderListResponse = {
-    /**
-     * Every integration provider this build supports, configured or not. Unconfigured entries are included so a caller can distinguish "not set up in this deployment" from "not offered".
-     */
-    providers?: unknown;
-};
 /**
  * Request body for interrupting a running session, optionally injecting a message the agent sees at the interruption point.
  */
@@ -10169,35 +10142,6 @@ export type ManagedAgentsProbeMcpServerRequest = {
      */
     vault_ids?: Array<string>;
 };
-/**
- * One integration provider this build supports, together with whether this deployment is configured for it. Returned by the provider list a console reads before offering a connect action.
- */
-export type ManagedAgentsProviderInfo = {
-    /**
-     * Whether this deployment has credentials for the provider. Unconfigured providers are still listed so a caller can tell "not set up here" from "not offered"; starting an install against one fails.
-     */
-    configured?: boolean;
-    /**
-     * Human-readable provider name for the connect UI, for example "GitHub".
-     */
-    display_name?: string;
-    /**
-     * Hostnames a sandbox must be allowed to reach for this provider's in-container tooling. Empty when the provider needs no sandbox egress.
-     */
-    egress_hosts?: Array<string>;
-    /**
-     * Stable provider slug to pass wherever an integration provider is named, such as starting an install. Currently "github" is the only one listed.
-     */
-    id?: string;
-    /**
-     * MCP server URL that sessions granted this provider get bound to. Empty when the provider is not configured here or exposes no MCP surface.
-     */
-    mcp_endpoint?: string;
-    /**
-     * Named permission presets a vault grant may request for this provider, ordered least privileged first. Empty when the provider is not configured here.
-     */
-    permissions?: Array<string>;
-};
 /**
  * The GitHub-side outcome of one repository automation. Publication is idempotent: a retry finds the review this session already posted and returns it rather than duplicating comments.
  */
@@ -10270,27 +10214,6 @@ export type ManagedAgentsPullRequestReviewStartedResponse = {
      */
     status_path?: string;
 };
-/**
- * The picker-safe identity and immutable head of one GitHub pull request reachable through an integration connection.
- */
-export type ManagedAgentsPullRequestSummary = {
-    /**
-     * Whether GitHub currently marks this pull request as a draft.
-     */
-    draft?: boolean;
-    /**
-     * Immutable head commit SHA observed when this pull request was listed.
-     */
-    head_sha?: string;
-    /**
-     * GitHub pull request number within the repository.
-     */
-    number?: number;
-    /**
-     * GitHub pull request title to display in a picker.
-     */
-    title?: string;
-};
 /**
  * The exact, immutable identity of one GitHub pull request under automation: the repository, the number, and the two commits that bound the reviewed diff.
  */
@@ -10320,19 +10243,6 @@ export type ManagedAgentsPullRequestTarget = {
      */
     repository_id?: number;
 };
-/**
- * One page of pull requests in a GitHub repository reachable through an integration connection. Returned to populate a pull request picker.
- */
-export type ManagedAgentsPullRequests = {
-    /**
-     * 1-based page this response covers. Defaults to 1 when the request omits or under-specifies it.
-     */
-    page?: number;
-    /**
-     * Pull requests reachable on this page, up to 100 per page.
-     */
-    pull_requests?: unknown;
-};
 /**
  * One memory consolidation: session reports in, a candidate memory store out. It runs as an ordinary observable session, so the whole run is inspectable through driver_session_id.
  */
@@ -10424,50 +10334,17 @@ export type ManagedAgentsReflectionListResponse = {
     reflections?: unknown;
 };
 /**
- * One page of the repositories a GitHub integration connection can reach. Returned to populate a repository picker when scoping a vault grant.
+ * Structured input for manually starting an automation without a webhook delivery.
  */
-export type ManagedAgentsRepositories = {
-    /**
-     * 1-based page this response covers. Defaults to 1 when the request omits or under-specifies it.
-     */
-    page?: number;
-    /**
-     * Repositories reachable on this page, up to 100 per page.
-     */
-    repositories?: unknown;
-    /**
-     * Total repositories the connection can reach across all pages, as reported by GitHub.
-     */
-    total_count?: number;
-};
-/**
- * One GitHub repository an integration connection's install can reach, as reported by GitHub. Returned when listing a connection's repositories to scope a grant.
- */
-export type ManagedAgentsRepository = {
-    /**
-     * Whether the repository is archived on GitHub and therefore read-only there.
-     */
-    archived?: boolean;
-    /**
-     * Branch GitHub reports as the repository default, for example "main". Absent when GitHub reports none, as for an empty repository.
-     */
-    default_branch?: string;
-    /**
-     * Owner-qualified repository name, for example "Labelbox/platform". This is the form a vault grant's repository selection uses.
-     */
-    full_name?: string;
+export type ManagedAgentsRunAutomationRequest = {
     /**
-     * Stable numeric GitHub repository id used to bind automation to an immutable repository identity.
+     * Caller-chosen key that makes retrying the same manual run safe.
      */
-    id?: number;
-    /**
-     * Repository name without its owner, for example "platform".
-     */
-    name?: string;
+    idempotency_key?: string;
     /**
-     * Whether the repository is private on GitHub.
+     * Structured event or task input supplied to the agent for this manual run.
      */
-    private?: boolean;
+    payload: unknown;
 };
 /**
  * One sandbox runtime this deployment can provision compute on. Listed so a caller can pick a sandbox_provider when creating an environment; this is static service capability, not organization data.
@@ -11490,7 +11367,7 @@ export type ManagedAgentsUpdateVaultCredentialRequest = {
      */
     secret_name?: string;
     /**
-     * New secret-manager reference, for material stored elsewhere. Omit to keep the current secret.
+     * New secret-manager reference, for material stored elsewhere. Not supported for webhook_secret. Omit to keep the current secret.
      */
     secret_ref?: string;
     /**
@@ -11590,7 +11467,7 @@ export type ManagedAgentsVaultCredential = {
      */
     credential_id?: string;
     /**
-     * How the credential is presented to the service it unlocks: mcp_oauth, bearer_token, env_var, or integration. Not a closed enum, because older rows may carry other values.
+     * How the credential is used: bearer_token, env_var, or webhook_secret. Legacy rows may report mcp_oauth or integration, so this remains a string rather than a closed response enum.
      */
     credential_type?: string;
     /**
@@ -11614,70 +11491,279 @@ export type ManagedAgentsVaultCredential = {
      */
     integration_resources?: Array<string>;
     /**
-     * MCP server this credential may be sent to. Required for the mcp_oauth and bearer_token kinds and immutable afterwards, so a stored secret cannot be repointed at a different service.
+     * MCP server this credential may be sent to. Required for bearer_token and immutable afterwards, so a stored secret cannot be repointed at a different service.
+     */
+    mcp_server_url?: string;
+    /**
+     * Free-form caller-supplied key/value labels. Stored verbatim and never interpreted by the service.
+     */
+    metadata?: {
+        [key: string]: unknown;
+    };
+    /**
+     * How far the credential may travel: limited confines it to allowed_hosts, unrestricted permits any host. limited is the safe default.
+     */
+    network_mode?: 'limited' | 'unrestricted';
+    /**
+     * Labelbox organization that owns this record. Resolved from the API key; never accepted from the caller.
+     */
+    organization_id?: string;
+    /**
+     * Environment variable or header name the secret binds to inside the sandbox. Required for the env_var kind.
+     */
+    secret_name?: string;
+    /**
+     * Pointer to material stored in an external secret manager, carrying a provider prefix such as kms: or vault:. Opaque to this service, and empty on the normal path where the value is sealed into the credential itself.
+     */
+    secret_ref?: string;
+    /**
+     * RFC 3339 timestamp of the last change to this record. Server-assigned.
+     */
+    updated_at?: string;
+    /**
+     * Vault this credential belongs to (UUID).
+     */
+    vault_id?: string;
+};
+/**
+ * Response body of GET /v1/vaults/{vault_id}/credentials. Unlike the other list envelopes this one is deliberately lossy: each row describes a credential and points at its secret-manager reference, and the secret material is never returned by any read endpoint. To learn whether a credential actually works, probe with POST /v1/mcp/probe.
+ */
+export type ManagedAgentsVaultCredentialListResponse = {
+    /**
+     * Credentials held by the vault named in the path, newest first. Null rather than an empty array when the vault is empty. Soft-deleted credentials are omitted, and no row carries a secret value.
+     */
+    vault_credentials?: unknown;
+};
+/**
+ * A pointer to one credential inside one vault. Used to grant a session specific credentials rather than every credential in a vault.
+ */
+export type ManagedAgentsVaultCredentialRef = {
+    /**
+     * Credential to select inside vault_id.
+     */
+    credential_id?: string;
+    /**
+     * Vault holding the credential. Required, because credential ids are unique only within a vault.
+     */
+    vault_id?: string;
+};
+/**
+ * Response body of GET /v1/vaults. A vault is the grantable unit of credential access: the vault_ids passed when starting a session decide which credentials that session may use. This lists the containers only; use GET /v1/vaults/{vault_id}/credentials for contents.
+ */
+export type ManagedAgentsVaultListResponse = {
+    /**
+     * Every vault in the caller's organization, newest first. Null rather than an empty array when the organization has no vaults. Soft-deleted vaults are omitted.
+     */
+    vaults?: unknown;
+};
+/**
+ * Configures the immediate HTTP response sent after a webhook delivery is verified and accepted.
+ */
+export type ManagedAgentsWebhookAcknowledgement = {
+    /**
+     * Static JSON object returned to the webhook sender after acceptance.
+     */
+    body?: {
+        [key: string]: unknown;
+    };
+    /**
+     * Response property populated with the selected challenge value during endpoint verification.
+     */
+    challenge_response_field?: string;
+    challenge_selector?: ManagedAgentsWebhookValueSelector;
+    /**
+     * HTTP status returned after a verified delivery is durably accepted; defaults to 200.
+     */
+    status_code?: number;
+};
+/**
+ * One component of a stable automation conversation key, with ordered fallback selectors.
+ */
+export type ManagedAgentsWebhookConversationPart = {
+    /**
+     * Fallback selectors checked in order; the first present value contributes this part of the conversation key.
+     */
+    selectors?: unknown;
+};
+/**
+ * Selects a stable provider delivery identity, optionally composed from multiple verified values.
+ */
+export type ManagedAgentsWebhookDeliveryKey = {
+    /**
+     * RFC 6901 JSON pointer for a single-value body key.
+     */
+    body_pointer?: string;
+    /**
+     * Case-insensitive header name for a single-value header key.
+     */
+    header?: string;
+    /**
+     * Ordered values canonically hashed into a collision-resistant composite delivery key.
+     */
+    selectors?: Array<ManagedAgentsWebhookValueSelector>;
+    /**
+     * Delivery location for a single-value key; omit when selectors is used.
+     */
+    source?: 'body' | 'header';
+};
+/**
+ * An organization-owned, provider-neutral webhook ingress endpoint with configurable verification and acknowledgement.
+ */
+export type ManagedAgentsWebhookEndpoint = {
+    acknowledgement?: ManagedAgentsWebhookAcknowledgement;
+    /**
+     * Server-assigned RFC 3339 creation timestamp.
+     */
+    created_at?: string;
+    /**
+     * Authenticated principal that created the endpoint.
+     */
+    created_by?: string;
+    delivery_key?: ManagedAgentsWebhookDeliveryKey;
+    /**
+     * Human-readable name shown when configuring automations.
+     */
+    display_name?: string;
+    /**
+     * Whether the endpoint currently accepts deliveries.
+     */
+    enabled?: boolean;
+    /**
+     * Server-assigned endpoint identifier used in the public webhook URL.
+     */
+    endpoint_id?: string;
+    /**
+     * Organization that owns the endpoint, resolved from the authenticated request scope.
+     */
+    organization_id?: string;
+    /**
+     * Server-assigned RFC 3339 timestamp of the most recent configuration change.
+     */
+    updated_at?: string;
+    verification?: ManagedAgentsWebhookVerification;
+};
+/**
+ * Webhook endpoints available to automations in the calling organization.
+ */
+export type ManagedAgentsWebhookEndpointListResponse = {
+    /**
+     * Webhook endpoints owned by the calling organization.
+     */
+    webhook_endpoints?: unknown;
+};
+/**
+ * Provider-neutral configuration for creating or replacing a webhook endpoint.
+ */
+export type ManagedAgentsWebhookEndpointRequest = {
+    acknowledgement: ManagedAgentsWebhookAcknowledgement;
+    delivery_key?: ManagedAgentsWebhookDeliveryKey;
+    /**
+     * Human-readable endpoint name shown when configuring automations.
+     */
+    display_name: string;
+    /**
+     * Whether the endpoint accepts inbound webhook deliveries.
+     */
+    enabled?: boolean;
+    verification: ManagedAgentsWebhookVerification;
+};
+/**
+ * A conjunction of conditions that decides whether a webhook delivery starts or continues an automation conversation.
+ */
+export type ManagedAgentsWebhookFilter = {
+    /**
+     * Conditions that must all match; an empty list matches every verified delivery.
+     */
+    all?: Array<ManagedAgentsWebhookMatchCondition>;
+};
+/**
+ * One provider-neutral condition evaluated against a verified webhook delivery.
+ */
+export type ManagedAgentsWebhookMatchCondition = {
+    /**
+     * Comparison applied to the selected value.
+     */
+    operator?: 'equals' | 'one_of' | 'exists' | 'not_exists';
+    selector?: ManagedAgentsWebhookValueSelector;
+    /**
+     * Expected value for the equals operator.
+     */
+    value?: string;
+    /**
+     * Accepted values for the one_of operator.
+     */
+    values?: Array<string>;
+};
+/**
+ * One ordered input included in the byte sequence verified by an HMAC webhook signature.
+ */
+export type ManagedAgentsWebhookSignedPart = {
+    /**
+     * Input source: the raw body, one header value, or a fixed literal string.
+     */
+    kind?: 'body' | 'header' | 'literal';
+    /**
+     * Header name for header parts or fixed text for literal parts; omitted for the raw body.
+     */
+    value?: string;
+};
+/**
+ * Selects one value from a verified webhook delivery body or headers.
+ */
+export type ManagedAgentsWebhookValueSelector = {
+    /**
+     * RFC 6901 JSON pointer evaluated against the delivery body when source is body.
      */
-    mcp_server_url?: string;
+    body_pointer?: string;
     /**
-     * Free-form caller-supplied key/value labels. Stored verbatim and never interpreted by the service.
+     * HTTP header name read case-insensitively when source is header.
      */
-    metadata?: {
-        [key: string]: unknown;
-    };
+    header?: string;
     /**
-     * How far the credential may travel: limited confines it to allowed_hosts, unrestricted permits any host. limited is the safe default.
+     * Delivery location to read: body for a JSON pointer or header for a case-insensitive header name.
      */
-    network_mode?: 'limited' | 'unrestricted';
+    source?: 'body' | 'header';
+};
+/**
+ * Provider-neutral rules for authenticating an inbound webhook before its payload can trigger automations.
+ */
+export type ManagedAgentsWebhookVerification = {
     /**
-     * Labelbox organization that owns this record. Resolved from the API key; never accepted from the caller.
+     * HTTP status returned for failed verification; defaults to 401.
      */
-    organization_id?: string;
+    invalid_signature_status?: number;
     /**
-     * Environment variable or header name the secret binds to inside the sandbox. Required for the env_var kind.
+     * Maximum accepted age of the timestamp in seconds; requires timestamp_header.
      */
-    secret_name?: string;
+    maximum_age_seconds?: number;
     /**
-     * Pointer to material stored in an external secret manager, carrying a provider prefix such as kms: or vault:. Opaque to this service, and empty on the normal path where the value is sealed into the credential itself.
+     * Credential whose secret value verifies the HMAC when type is hmac_sha256.
      */
-    secret_ref?: string;
+    secret_credential_id?: string;
     /**
-     * RFC 3339 timestamp of the last change to this record. Server-assigned.
+     * Vault containing the HMAC secret credential when type is hmac_sha256.
      */
-    updated_at?: string;
+    secret_vault_id?: string;
     /**
-     * Vault this credential belongs to (UUID).
+     * HTTP header carrying the hexadecimal HMAC signature.
      */
-    vault_id?: string;
-};
-/**
- * Response body of GET /v1/vaults/{vault_id}/credentials. Unlike the other list envelopes this one is deliberately lossy: each row describes a credential and points at its secret-manager reference, and the secret material is never returned by any read endpoint. To learn whether a credential actually works, probe with POST /v1/mcp/probe.
- */
-export type ManagedAgentsVaultCredentialListResponse = {
+    signature_header?: string;
     /**
-     * Credentials held by the vault named in the path, newest first. Null rather than an empty array when the vault is empty. Soft-deleted credentials are omitted, and no row carries a secret value.
+     * Optional prefix removed from the signature header before hexadecimal decoding, for example sha256=.
      */
-    vault_credentials?: unknown;
-};
-/**
- * A pointer to one credential inside one vault. Used to grant a session specific credentials rather than every credential in a vault.
- */
-export type ManagedAgentsVaultCredentialRef = {
+    signature_prefix?: string;
     /**
-     * Credential to select inside vault_id.
+     * Ordered inputs concatenated before HMAC verification; must include the raw request body.
      */
-    credential_id?: string;
+    signed_parts?: Array<ManagedAgentsWebhookSignedPart>;
     /**
-     * Vault holding the credential. Required, because credential ids are unique only within a vault.
+     * Optional header containing a Unix timestamp used to reject replayed deliveries.
      */
-    vault_id?: string;
-};
-/**
- * Response body of GET /v1/vaults. A vault is the grantable unit of credential access: the vault_ids passed when starting a session decide which credentials that session may use. This lists the containers only; use GET /v1/vaults/{vault_id}/credentials for contents.
- */
-export type ManagedAgentsVaultListResponse = {
+    timestamp_header?: string;
     /**
-     * Every vault in the caller's organization, newest first. Null rather than an empty array when the organization has no vaults. Soft-deleted vaults are omitted.
+     * Verification algorithm. Use hmac_sha256 for signed webhooks; none accepts unsigned deliveries.
      */
-    vaults?: unknown;
+    type?: 'hmac_sha256' | 'none';
 };
 /**
  * A Docker image published in the marketplace for reuse across environments.
@@ -23333,13 +23419,13 @@ export type GetManagedAgentsV1AnalyticsByFamilyResponses = {
     200: ManagedAgentsAnalyticsResponse;
 };
 export type GetManagedAgentsV1AnalyticsByFamilyResponse = GetManagedAgentsV1AnalyticsByFamilyResponses[keyof GetManagedAgentsV1AnalyticsByFamilyResponses];
-export type GetManagedAgentsV1EnvironmentsData = {
+export type GetManagedAgentsV1AutomationsData = {
     body?: never;
     path?: never;
     query?: never;
-    url: '/managed-agents/v1/environments';
+    url: '/managed-agents/v1/automations';
 };
-export type GetManagedAgentsV1EnvironmentsErrors = {
+export type GetManagedAgentsV1AutomationsErrors = {
     /**
      * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
      */
@@ -23365,21 +23451,21 @@ export type GetManagedAgentsV1EnvironmentsErrors = {
      */
     503: ManagedAgentsApiErrorBody | ApiErrorResponse;
 };
-export type GetManagedAgentsV1EnvironmentsError = GetManagedAgentsV1EnvironmentsErrors[keyof GetManagedAgentsV1EnvironmentsErrors];
-export type GetManagedAgentsV1EnvironmentsResponses = {
+export type GetManagedAgentsV1AutomationsError = GetManagedAgentsV1AutomationsErrors[keyof GetManagedAgentsV1AutomationsErrors];
+export type GetManagedAgentsV1AutomationsResponses = {
     /**
-     * Response body of GET /v1/environments. An environment is the sandbox recipe a session runs inside; pick an environment_id from here when starting a session with POST /v1/sessions.
+     * Automations available in the calling organization.
      */
-    200: ManagedAgentsEnvironmentListResponse;
+    200: ManagedAgentsAutomationListResponse;
 };
-export type GetManagedAgentsV1EnvironmentsResponse = GetManagedAgentsV1EnvironmentsResponses[keyof GetManagedAgentsV1EnvironmentsResponses];
-export type PostManagedAgentsV1EnvironmentsData = {
-    body?: ManagedAgentsCreateEnvironmentRequest;
+export type GetManagedAgentsV1AutomationsResponse = GetManagedAgentsV1AutomationsResponses[keyof GetManagedAgentsV1AutomationsResponses];
+export type PostManagedAgentsV1AutomationsData = {
+    body?: ManagedAgentsAutomationRequest;
     path?: never;
     query?: never;
-    url: '/managed-agents/v1/environments';
+    url: '/managed-agents/v1/automations';
 };
-export type PostManagedAgentsV1EnvironmentsErrors = {
+export type PostManagedAgentsV1AutomationsErrors = {
     /**
      * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
      */
@@ -23413,26 +23499,26 @@ export type PostManagedAgentsV1EnvironmentsErrors = {
      */
     503: ManagedAgentsApiErrorBody | ApiErrorResponse;
 };
-export type PostManagedAgentsV1EnvironmentsError = PostManagedAgentsV1EnvironmentsErrors[keyof PostManagedAgentsV1EnvironmentsErrors];
-export type PostManagedAgentsV1EnvironmentsResponses = {
+export type PostManagedAgentsV1AutomationsError = PostManagedAgentsV1AutomationsErrors[keyof PostManagedAgentsV1AutomationsErrors];
+export type PostManagedAgentsV1AutomationsResponses = {
     /**
-     * A sandbox environment a session executes in: its provider, resources, mounts, setup steps and idle/delete lifecycle. Created and started independently of any session.
+     * A provider-neutral rule that starts or continues an ordinary managed-agent session from verified webhook events or structured manual input.
      */
-    200: ManagedAgentsEnvironment;
+    201: ManagedAgentsAutomation;
 };
-export type PostManagedAgentsV1EnvironmentsResponse = PostManagedAgentsV1EnvironmentsResponses[keyof PostManagedAgentsV1EnvironmentsResponses];
-export type DeleteManagedAgentsV1EnvironmentsByEnvironmentIdData = {
+export type PostManagedAgentsV1AutomationsResponse = PostManagedAgentsV1AutomationsResponses[keyof PostManagedAgentsV1AutomationsResponses];
+export type DeleteManagedAgentsV1AutomationsByAutomationIdData = {
     body?: never;
     path: {
         /**
-         * Environment id (UUID) as returned by createEnvironment or listEnvironments.
+         * Automation id (UUID) as returned by createAutomation or listAutomations.
          */
-        environment_id: string;
+        automation_id: string;
     };
     query?: never;
-    url: '/managed-agents/v1/environments/{environment_id}';
+    url: '/managed-agents/v1/automations/{automation_id}';
 };
-export type DeleteManagedAgentsV1EnvironmentsByEnvironmentIdErrors = {
+export type DeleteManagedAgentsV1AutomationsByAutomationIdErrors = {
     /**
      * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
      */
@@ -23466,26 +23552,26 @@ export type DeleteManagedAgentsV1EnvironmentsByEnvironmentIdErrors = {
      */
     503: ManagedAgentsApiErrorBody | ApiErrorResponse;
 };
-export type DeleteManagedAgentsV1EnvironmentsByEnvironmentIdError = DeleteManagedAgentsV1EnvironmentsByEnvironmentIdErrors[keyof DeleteManagedAgentsV1EnvironmentsByEnvironmentIdErrors];
-export type DeleteManagedAgentsV1EnvironmentsByEnvironmentIdResponses = {
+export type DeleteManagedAgentsV1AutomationsByAutomationIdError = DeleteManagedAgentsV1AutomationsByAutomationIdErrors[keyof DeleteManagedAgentsV1AutomationsByAutomationIdErrors];
+export type DeleteManagedAgentsV1AutomationsByAutomationIdResponses = {
     /**
-     * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
+     * No Content
      */
-    200: ManagedAgentsDeletedResponse;
+    204: void;
 };
-export type DeleteManagedAgentsV1EnvironmentsByEnvironmentIdResponse = DeleteManagedAgentsV1EnvironmentsByEnvironmentIdResponses[keyof DeleteManagedAgentsV1EnvironmentsByEnvironmentIdResponses];
-export type GetManagedAgentsV1EnvironmentsByEnvironmentIdData = {
+export type DeleteManagedAgentsV1AutomationsByAutomationIdResponse = DeleteManagedAgentsV1AutomationsByAutomationIdResponses[keyof DeleteManagedAgentsV1AutomationsByAutomationIdResponses];
+export type GetManagedAgentsV1AutomationsByAutomationIdData = {
     body?: never;
     path: {
         /**
-         * Environment id (UUID) as returned by createEnvironment or listEnvironments.
+         * Automation id (UUID) as returned by createAutomation or listAutomations.
          */
-        environment_id: string;
+        automation_id: string;
     };
     query?: never;
-    url: '/managed-agents/v1/environments/{environment_id}';
+    url: '/managed-agents/v1/automations/{automation_id}';
 };
-export type GetManagedAgentsV1EnvironmentsByEnvironmentIdErrors = {
+export type GetManagedAgentsV1AutomationsByAutomationIdErrors = {
     /**
      * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
      */
@@ -23515,26 +23601,26 @@ export type GetManagedAgentsV1EnvironmentsByEnvironmentIdErrors = {
      */
     503: ManagedAgentsApiErrorBody | ApiErrorResponse;
 };
-export type GetManagedAgentsV1EnvironmentsByEnvironmentIdError = GetManagedAgentsV1EnvironmentsByEnvironmentIdErrors[keyof GetManagedAgentsV1EnvironmentsByEnvironmentIdErrors];
-export type GetManagedAgentsV1EnvironmentsByEnvironmentIdResponses = {
+export type GetManagedAgentsV1AutomationsByAutomationIdError = GetManagedAgentsV1AutomationsByAutomationIdErrors[keyof GetManagedAgentsV1AutomationsByAutomationIdErrors];
+export type GetManagedAgentsV1AutomationsByAutomationIdResponses = {
     /**
-     * A sandbox environment a session executes in: its provider, resources, mounts, setup steps and idle/delete lifecycle. Created and started independently of any session.
+     * A provider-neutral rule that starts or continues an ordinary managed-agent session from verified webhook events or structured manual input.
      */
-    200: ManagedAgentsEnvironment;
+    200: ManagedAgentsAutomation;
 };
-export type GetManagedAgentsV1EnvironmentsByEnvironmentIdResponse = GetManagedAgentsV1EnvironmentsByEnvironmentIdResponses[keyof GetManagedAgentsV1EnvironmentsByEnvironmentIdResponses];
-export type PatchManagedAgentsV1EnvironmentsByEnvironmentIdData = {
-    body?: ManagedAgentsEnvironment;
+export type GetManagedAgentsV1AutomationsByAutomationIdResponse = GetManagedAgentsV1AutomationsByAutomationIdResponses[keyof GetManagedAgentsV1AutomationsByAutomationIdResponses];
+export type PutManagedAgentsV1AutomationsByAutomationIdData = {
+    body?: ManagedAgentsAutomationRequest;
     path: {
         /**
-         * Environment id (UUID) as returned by createEnvironment or listEnvironments.
+         * Automation id (UUID) as returned by createAutomation or listAutomations.
          */
-        environment_id: string;
+        automation_id: string;
     };
     query?: never;
-    url: '/managed-agents/v1/environments/{environment_id}';
+    url: '/managed-agents/v1/automations/{automation_id}';
 };
-export type PatchManagedAgentsV1EnvironmentsByEnvironmentIdErrors = {
+export type PutManagedAgentsV1AutomationsByAutomationIdErrors = {
     /**
      * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
      */
@@ -23572,66 +23658,26 @@ export type PatchManagedAgentsV1EnvironmentsByEnvironmentIdErrors = {
      */
     503: ManagedAgentsApiErrorBody | ApiErrorResponse;
 };
-export type PatchManagedAgentsV1EnvironmentsByEnvironmentIdError = PatchManagedAgentsV1EnvironmentsByEnvironmentIdErrors[keyof PatchManagedAgentsV1EnvironmentsByEnvironmentIdErrors];
-export type PatchManagedAgentsV1EnvironmentsByEnvironmentIdResponses = {
-    /**
-     * A sandbox environment a session executes in: its provider, resources, mounts, setup steps and idle/delete lifecycle. Created and started independently of any session.
-     */
-    200: ManagedAgentsEnvironment;
-};
-export type PatchManagedAgentsV1EnvironmentsByEnvironmentIdResponse = PatchManagedAgentsV1EnvironmentsByEnvironmentIdResponses[keyof PatchManagedAgentsV1EnvironmentsByEnvironmentIdResponses];
-export type GetManagedAgentsV1IntegrationsConnectionsData = {
-    body?: never;
-    path?: never;
-    query?: never;
-    url: '/managed-agents/v1/integrations/connections';
-};
-export type GetManagedAgentsV1IntegrationsConnectionsErrors = {
-    /**
-     * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
-     */
-    400: ManagedAgentsApiErrorBody | ApiErrorResponse;
-    /**
-     * The caller is unauthenticated. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
-     */
-    401: ManagedAgentsApiErrorBody | ApiErrorResponse;
-    /**
-     * Caller is missing a required permission, or the request scope (organization / environment / problem) does not resolve to the caller.
-     */
-    403: ApiErrorResponse;
-    /**
-     * A rate limit is exhausted. Honor `Retry-After`. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
-     */
-    429: ManagedAgentsApiErrorBody | ApiErrorResponse;
-    /**
-     * An unexpected server-side failure. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
-     */
-    500: ManagedAgentsApiErrorBody | ApiErrorResponse;
-    /**
-     * A dependency is unavailable. Retryable. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
-     */
-    503: ManagedAgentsApiErrorBody | ApiErrorResponse;
-};
-export type GetManagedAgentsV1IntegrationsConnectionsError = GetManagedAgentsV1IntegrationsConnectionsErrors[keyof GetManagedAgentsV1IntegrationsConnectionsErrors];
-export type GetManagedAgentsV1IntegrationsConnectionsResponses = {
+export type PutManagedAgentsV1AutomationsByAutomationIdError = PutManagedAgentsV1AutomationsByAutomationIdErrors[keyof PutManagedAgentsV1AutomationsByAutomationIdErrors];
+export type PutManagedAgentsV1AutomationsByAutomationIdResponses = {
     /**
-     * The integration connections belonging to the calling organization, as resolved from the API key. Returned when listing connections.
+     * A provider-neutral rule that starts or continues an ordinary managed-agent session from verified webhook events or structured manual input.
      */
-    200: ManagedAgentsIntegrationConnectionListResponse;
+    200: ManagedAgentsAutomation;
 };
-export type GetManagedAgentsV1IntegrationsConnectionsResponse = GetManagedAgentsV1IntegrationsConnectionsResponses[keyof GetManagedAgentsV1IntegrationsConnectionsResponses];
-export type DeleteManagedAgentsV1IntegrationsConnectionsByConnectionIdData = {
-    body?: never;
+export type PutManagedAgentsV1AutomationsByAutomationIdResponse = PutManagedAgentsV1AutomationsByAutomationIdResponses[keyof PutManagedAgentsV1AutomationsByAutomationIdResponses];
+export type PostManagedAgentsV1AutomationsByAutomationIdRunsData = {
+    body?: ManagedAgentsRunAutomationRequest;
     path: {
         /**
-         * Integration connection id (UUID) as returned by listIntegrationConnections.
+         * Automation id (UUID) as returned by createAutomation or listAutomations.
          */
-        connection_id: string;
+        automation_id: string;
     };
     query?: never;
-    url: '/managed-agents/v1/integrations/connections/{connection_id}';
+    url: '/managed-agents/v1/automations/{automation_id}/runs';
 };
-export type DeleteManagedAgentsV1IntegrationsConnectionsByConnectionIdErrors = {
+export type PostManagedAgentsV1AutomationsByAutomationIdRunsErrors = {
     /**
      * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
      */
@@ -23652,6 +23698,10 @@ export type DeleteManagedAgentsV1IntegrationsConnectionsByConnectionIdErrors = {
      * The request conflicts with the resource state, or with an in-flight idempotent replay. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
      */
     409: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The request exceeds a size or transaction budget. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    413: ManagedAgentsApiErrorBody | ApiErrorResponse;
     /**
      * A rate limit is exhausted. Honor `Retry-After`. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
      */
@@ -23665,26 +23715,21 @@ export type DeleteManagedAgentsV1IntegrationsConnectionsByConnectionIdErrors = {
      */
     503: ManagedAgentsApiErrorBody | ApiErrorResponse;
 };
-export type DeleteManagedAgentsV1IntegrationsConnectionsByConnectionIdError = DeleteManagedAgentsV1IntegrationsConnectionsByConnectionIdErrors[keyof DeleteManagedAgentsV1IntegrationsConnectionsByConnectionIdErrors];
-export type DeleteManagedAgentsV1IntegrationsConnectionsByConnectionIdResponses = {
+export type PostManagedAgentsV1AutomationsByAutomationIdRunsError = PostManagedAgentsV1AutomationsByAutomationIdRunsErrors[keyof PostManagedAgentsV1AutomationsByAutomationIdRunsErrors];
+export type PostManagedAgentsV1AutomationsByAutomationIdRunsResponses = {
     /**
-     * Summary of what removing an integration connection retired. Returned when a connection is disconnected, so a caller can see how many vault grants it invalidated.
+     * Reference to the asynchronously running managed-agent session created by a manual automation run.
      */
-    200: ManagedAgentsDisconnectResult;
+    202: ManagedAgentsAutomationRunResponse;
 };
-export type DeleteManagedAgentsV1IntegrationsConnectionsByConnectionIdResponse = DeleteManagedAgentsV1IntegrationsConnectionsByConnectionIdResponses[keyof DeleteManagedAgentsV1IntegrationsConnectionsByConnectionIdResponses];
-export type GetManagedAgentsV1IntegrationsConnectionsByConnectionIdData = {
+export type PostManagedAgentsV1AutomationsByAutomationIdRunsResponse = PostManagedAgentsV1AutomationsByAutomationIdRunsResponses[keyof PostManagedAgentsV1AutomationsByAutomationIdRunsResponses];
+export type GetManagedAgentsV1EnvironmentsData = {
     body?: never;
-    path: {
-        /**
-         * Integration connection id (UUID) as returned by listIntegrationConnections.
-         */
-        connection_id: string;
-    };
+    path?: never;
     query?: never;
-    url: '/managed-agents/v1/integrations/connections/{connection_id}';
+    url: '/managed-agents/v1/environments';
 };
-export type GetManagedAgentsV1IntegrationsConnectionsByConnectionIdErrors = {
+export type GetManagedAgentsV1EnvironmentsErrors = {
     /**
      * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
      */
@@ -23697,10 +23742,6 @@ export type GetManagedAgentsV1IntegrationsConnectionsByConnectionIdErrors = {
      * Caller is missing a required permission, or the request scope (organization / environment / problem) does not resolve to the caller.
      */
     403: ApiErrorResponse;
-    /**
-     * No such resource is reachable for this caller. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
-     */
-    404: ManagedAgentsApiErrorBody | ApiErrorResponse;
     /**
      * A rate limit is exhausted. Honor `Retry-After`. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
      */
@@ -23714,26 +23755,21 @@ export type GetManagedAgentsV1IntegrationsConnectionsByConnectionIdErrors = {
      */
     503: ManagedAgentsApiErrorBody | ApiErrorResponse;
 };
-export type GetManagedAgentsV1IntegrationsConnectionsByConnectionIdError = GetManagedAgentsV1IntegrationsConnectionsByConnectionIdErrors[keyof GetManagedAgentsV1IntegrationsConnectionsByConnectionIdErrors];
-export type GetManagedAgentsV1IntegrationsConnectionsByConnectionIdResponses = {
+export type GetManagedAgentsV1EnvironmentsError = GetManagedAgentsV1EnvironmentsErrors[keyof GetManagedAgentsV1EnvironmentsErrors];
+export type GetManagedAgentsV1EnvironmentsResponses = {
     /**
-     * An organization's link to a third-party account, created by installing an integration such as the GitHub App. It holds no secret itself; grant it to an agent so sessions can mint short-lived provider credentials from it.
+     * Response body of GET /v1/environments. An environment is the sandbox recipe a session runs inside; pick an environment_id from here when starting a session with POST /v1/sessions.
      */
-    200: ManagedAgentsIntegrationConnection;
+    200: ManagedAgentsEnvironmentListResponse;
 };
-export type GetManagedAgentsV1IntegrationsConnectionsByConnectionIdResponse = GetManagedAgentsV1IntegrationsConnectionsByConnectionIdResponses[keyof GetManagedAgentsV1IntegrationsConnectionsByConnectionIdResponses];
-export type PostManagedAgentsV1IntegrationsConnectionsByConnectionIdProbeData = {
-    body?: never;
-    path: {
-        /**
-         * Integration connection id (UUID) as returned by listIntegrationConnections.
-         */
-        connection_id: string;
-    };
+export type GetManagedAgentsV1EnvironmentsResponse = GetManagedAgentsV1EnvironmentsResponses[keyof GetManagedAgentsV1EnvironmentsResponses];
+export type PostManagedAgentsV1EnvironmentsData = {
+    body?: ManagedAgentsCreateEnvironmentRequest;
+    path?: never;
     query?: never;
-    url: '/managed-agents/v1/integrations/connections/{connection_id}/probe';
+    url: '/managed-agents/v1/environments';
 };
-export type PostManagedAgentsV1IntegrationsConnectionsByConnectionIdProbeErrors = {
+export type PostManagedAgentsV1EnvironmentsErrors = {
     /**
      * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
      */
@@ -23746,130 +23782,14 @@ export type PostManagedAgentsV1IntegrationsConnectionsByConnectionIdProbeErrors
      * Caller is missing a required permission, or the request scope (organization / environment / problem) does not resolve to the caller.
      */
     403: ApiErrorResponse;
-    /**
-     * No such resource is reachable for this caller. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
-     */
-    404: ManagedAgentsApiErrorBody | ApiErrorResponse;
     /**
      * The request conflicts with the resource state, or with an in-flight idempotent replay. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
      */
     409: ManagedAgentsApiErrorBody | ApiErrorResponse;
     /**
-     * A rate limit is exhausted. Honor `Retry-After`. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
-     */
-    429: ManagedAgentsApiErrorBody | ApiErrorResponse;
-    /**
-     * An unexpected server-side failure. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
-     */
-    500: ManagedAgentsApiErrorBody | ApiErrorResponse;
-    /**
-     * A dependency is unavailable. Retryable. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
-     */
-    503: ManagedAgentsApiErrorBody | ApiErrorResponse;
-};
-export type PostManagedAgentsV1IntegrationsConnectionsByConnectionIdProbeError = PostManagedAgentsV1IntegrationsConnectionsByConnectionIdProbeErrors[keyof PostManagedAgentsV1IntegrationsConnectionsByConnectionIdProbeErrors];
-export type PostManagedAgentsV1IntegrationsConnectionsByConnectionIdProbeResponses = {
-    /**
-     * Result of a live health check against one integration connection: its refreshed state at the provider, whether a token could be minted, and what is missing if not. A failed check is reported here rather than as an HTTP error.
-     */
-    200: ManagedAgentsConnectionProbe;
-};
-export type PostManagedAgentsV1IntegrationsConnectionsByConnectionIdProbeResponse = PostManagedAgentsV1IntegrationsConnectionsByConnectionIdProbeResponses[keyof PostManagedAgentsV1IntegrationsConnectionsByConnectionIdProbeResponses];
-export type GetManagedAgentsV1IntegrationsConnectionsByConnectionIdRepositoriesData = {
-    body?: never;
-    path: {
-        /**
-         * Integration connection id (UUID) as returned by listIntegrationConnections.
-         */
-        connection_id: string;
-    };
-    query?: {
-        /**
-         * 1-based page of up to 100 repositories.
-         */
-        page?: number;
-    };
-    url: '/managed-agents/v1/integrations/connections/{connection_id}/repositories';
-};
-export type GetManagedAgentsV1IntegrationsConnectionsByConnectionIdRepositoriesErrors = {
-    /**
-     * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
-     */
-    400: ManagedAgentsApiErrorBody | ApiErrorResponse;
-    /**
-     * The caller is unauthenticated. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
-     */
-    401: ManagedAgentsApiErrorBody | ApiErrorResponse;
-    /**
-     * Caller is missing a required permission, or the request scope (organization / environment / problem) does not resolve to the caller.
-     */
-    403: ApiErrorResponse;
-    /**
-     * No such resource is reachable for this caller. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
-     */
-    404: ManagedAgentsApiErrorBody | ApiErrorResponse;
-    /**
-     * A rate limit is exhausted. Honor `Retry-After`. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
-     */
-    429: ManagedAgentsApiErrorBody | ApiErrorResponse;
-    /**
-     * An unexpected server-side failure. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
-     */
-    500: ManagedAgentsApiErrorBody | ApiErrorResponse;
-    /**
-     * A dependency is unavailable. Retryable. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
-     */
-    503: ManagedAgentsApiErrorBody | ApiErrorResponse;
-};
-export type GetManagedAgentsV1IntegrationsConnectionsByConnectionIdRepositoriesError = GetManagedAgentsV1IntegrationsConnectionsByConnectionIdRepositoriesErrors[keyof GetManagedAgentsV1IntegrationsConnectionsByConnectionIdRepositoriesErrors];
-export type GetManagedAgentsV1IntegrationsConnectionsByConnectionIdRepositoriesResponses = {
-    /**
-     * One page of the repositories a GitHub integration connection can reach. Returned to populate a repository picker when scoping a vault grant.
-     */
-    200: ManagedAgentsRepositories;
-};
-export type GetManagedAgentsV1IntegrationsConnectionsByConnectionIdRepositoriesResponse = GetManagedAgentsV1IntegrationsConnectionsByConnectionIdRepositoriesResponses[keyof GetManagedAgentsV1IntegrationsConnectionsByConnectionIdRepositoriesResponses];
-export type GetManagedAgentsV1IntegrationsConnectionsByConnectionIdRepositoriesByRepositoryPullRequestsData = {
-    body?: never;
-    path: {
-        /**
-         * Integration connection id (UUID) as returned by listIntegrationConnections.
-         */
-        connection_id: string;
-        /**
-         * Repository name reachable through this connection. Bare names, owner/name references, and names ending in .git are accepted.
-         */
-        repository: string;
-    };
-    query?: {
-        /**
-         * Pull request state: open, closed, or all.
-         */
-        state?: string;
-        /**
-         * 1-based page of up to 100 pull requests.
-         */
-        page?: number;
-    };
-    url: '/managed-agents/v1/integrations/connections/{connection_id}/repositories/{repository}/pull-requests';
-};
-export type GetManagedAgentsV1IntegrationsConnectionsByConnectionIdRepositoriesByRepositoryPullRequestsErrors = {
-    /**
-     * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
-     */
-    400: ManagedAgentsApiErrorBody | ApiErrorResponse;
-    /**
-     * The caller is unauthenticated. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
-     */
-    401: ManagedAgentsApiErrorBody | ApiErrorResponse;
-    /**
-     * Caller is missing a required permission, or the request scope (organization / environment / problem) does not resolve to the caller.
-     */
-    403: ApiErrorResponse;
-    /**
-     * No such resource is reachable for this caller. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     * The request exceeds a size or transaction budget. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
      */
-    404: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    413: ManagedAgentsApiErrorBody | ApiErrorResponse;
     /**
      * A rate limit is exhausted. Honor `Retry-After`. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
      */
@@ -23883,21 +23803,26 @@ export type GetManagedAgentsV1IntegrationsConnectionsByConnectionIdRepositoriesB
      */
     503: ManagedAgentsApiErrorBody | ApiErrorResponse;
 };
-export type GetManagedAgentsV1IntegrationsConnectionsByConnectionIdRepositoriesByRepositoryPullRequestsError = GetManagedAgentsV1IntegrationsConnectionsByConnectionIdRepositoriesByRepositoryPullRequestsErrors[keyof GetManagedAgentsV1IntegrationsConnectionsByConnectionIdRepositoriesByRepositoryPullRequestsErrors];
-export type GetManagedAgentsV1IntegrationsConnectionsByConnectionIdRepositoriesByRepositoryPullRequestsResponses = {
+export type PostManagedAgentsV1EnvironmentsError = PostManagedAgentsV1EnvironmentsErrors[keyof PostManagedAgentsV1EnvironmentsErrors];
+export type PostManagedAgentsV1EnvironmentsResponses = {
     /**
-     * One page of pull requests in a GitHub repository reachable through an integration connection. Returned to populate a pull request picker.
+     * A sandbox environment a session executes in: its provider, resources, mounts, setup steps and idle/delete lifecycle. Created and started independently of any session.
      */
-    200: ManagedAgentsPullRequests;
+    200: ManagedAgentsEnvironment;
 };
-export type GetManagedAgentsV1IntegrationsConnectionsByConnectionIdRepositoriesByRepositoryPullRequestsResponse = GetManagedAgentsV1IntegrationsConnectionsByConnectionIdRepositoriesByRepositoryPullRequestsResponses[keyof GetManagedAgentsV1IntegrationsConnectionsByConnectionIdRepositoriesByRepositoryPullRequestsResponses];
-export type GetManagedAgentsV1IntegrationsProvidersData = {
+export type PostManagedAgentsV1EnvironmentsResponse = PostManagedAgentsV1EnvironmentsResponses[keyof PostManagedAgentsV1EnvironmentsResponses];
+export type DeleteManagedAgentsV1EnvironmentsByEnvironmentIdData = {
     body?: never;
-    path?: never;
+    path: {
+        /**
+         * Environment id (UUID) as returned by createEnvironment or listEnvironments.
+         */
+        environment_id: string;
+    };
     query?: never;
-    url: '/managed-agents/v1/integrations/providers';
+    url: '/managed-agents/v1/environments/{environment_id}';
 };
-export type GetManagedAgentsV1IntegrationsProvidersErrors = {
+export type DeleteManagedAgentsV1EnvironmentsByEnvironmentIdErrors = {
     /**
      * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
      */
@@ -23910,6 +23835,14 @@ export type GetManagedAgentsV1IntegrationsProvidersErrors = {
      * Caller is missing a required permission, or the request scope (organization / environment / problem) does not resolve to the caller.
      */
     403: ApiErrorResponse;
+    /**
+     * No such resource is reachable for this caller. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    404: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The request conflicts with the resource state, or with an in-flight idempotent replay. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    409: ManagedAgentsApiErrorBody | ApiErrorResponse;
     /**
      * A rate limit is exhausted. Honor `Retry-After`. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
      */
@@ -23923,26 +23856,26 @@ export type GetManagedAgentsV1IntegrationsProvidersErrors = {
      */
     503: ManagedAgentsApiErrorBody | ApiErrorResponse;
 };
-export type GetManagedAgentsV1IntegrationsProvidersError = GetManagedAgentsV1IntegrationsProvidersErrors[keyof GetManagedAgentsV1IntegrationsProvidersErrors];
-export type GetManagedAgentsV1IntegrationsProvidersResponses = {
+export type DeleteManagedAgentsV1EnvironmentsByEnvironmentIdError = DeleteManagedAgentsV1EnvironmentsByEnvironmentIdErrors[keyof DeleteManagedAgentsV1EnvironmentsByEnvironmentIdErrors];
+export type DeleteManagedAgentsV1EnvironmentsByEnvironmentIdResponses = {
     /**
-     * The integration providers this deployment can connect to. Returned by the provider list a console reads before offering a connect action.
+     * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
      */
-    200: ManagedAgentsIntegrationProviderListResponse;
+    200: ManagedAgentsDeletedResponse;
 };
-export type GetManagedAgentsV1IntegrationsProvidersResponse = GetManagedAgentsV1IntegrationsProvidersResponses[keyof GetManagedAgentsV1IntegrationsProvidersResponses];
-export type PostManagedAgentsV1IntegrationsByProviderInstallData = {
+export type DeleteManagedAgentsV1EnvironmentsByEnvironmentIdResponse = DeleteManagedAgentsV1EnvironmentsByEnvironmentIdResponses[keyof DeleteManagedAgentsV1EnvironmentsByEnvironmentIdResponses];
+export type GetManagedAgentsV1EnvironmentsByEnvironmentIdData = {
     body?: never;
     path: {
         /**
-         * Integration provider id. Only GitHub has an OAuth connection flow; Slack is connected workspace-side and is not startable here, so naming it returns 400.
+         * Environment id (UUID) as returned by createEnvironment or listEnvironments.
          */
-        provider: 'github';
+        environment_id: string;
     };
     query?: never;
-    url: '/managed-agents/v1/integrations/{provider}/install';
+    url: '/managed-agents/v1/environments/{environment_id}';
 };
-export type PostManagedAgentsV1IntegrationsByProviderInstallErrors = {
+export type GetManagedAgentsV1EnvironmentsByEnvironmentIdErrors = {
     /**
      * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
      */
@@ -23959,14 +23892,6 @@ export type PostManagedAgentsV1IntegrationsByProviderInstallErrors = {
      * No such resource is reachable for this caller. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
      */
     404: ManagedAgentsApiErrorBody | ApiErrorResponse;
-    /**
-     * The request conflicts with the resource state, or with an in-flight idempotent replay. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
-     */
-    409: ManagedAgentsApiErrorBody | ApiErrorResponse;
-    /**
-     * The request exceeds a size or transaction budget. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
-     */
-    413: ManagedAgentsApiErrorBody | ApiErrorResponse;
     /**
      * A rate limit is exhausted. Honor `Retry-After`. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
      */
@@ -23980,26 +23905,26 @@ export type PostManagedAgentsV1IntegrationsByProviderInstallErrors = {
      */
     503: ManagedAgentsApiErrorBody | ApiErrorResponse;
 };
-export type PostManagedAgentsV1IntegrationsByProviderInstallError = PostManagedAgentsV1IntegrationsByProviderInstallErrors[keyof PostManagedAgentsV1IntegrationsByProviderInstallErrors];
-export type PostManagedAgentsV1IntegrationsByProviderInstallResponses = {
+export type GetManagedAgentsV1EnvironmentsByEnvironmentIdError = GetManagedAgentsV1EnvironmentsByEnvironmentIdErrors[keyof GetManagedAgentsV1EnvironmentsByEnvironmentIdErrors];
+export type GetManagedAgentsV1EnvironmentsByEnvironmentIdResponses = {
     /**
-     * Where to send a user to authorize an integration, plus the one-time state nonce that ties the provider's callback back to this attempt. Returned when an authorization flow is started.
+     * A sandbox environment a session executes in: its provider, resources, mounts, setup steps and idle/delete lifecycle. Created and started independently of any session.
      */
-    200: ManagedAgentsInstallStart;
+    200: ManagedAgentsEnvironment;
 };
-export type PostManagedAgentsV1IntegrationsByProviderInstallResponse = PostManagedAgentsV1IntegrationsByProviderInstallResponses[keyof PostManagedAgentsV1IntegrationsByProviderInstallResponses];
-export type PostManagedAgentsV1IntegrationsByProviderInstallCompleteData = {
-    body?: ManagedAgentsCompleteIntegrationInstallRequest;
+export type GetManagedAgentsV1EnvironmentsByEnvironmentIdResponse = GetManagedAgentsV1EnvironmentsByEnvironmentIdResponses[keyof GetManagedAgentsV1EnvironmentsByEnvironmentIdResponses];
+export type PatchManagedAgentsV1EnvironmentsByEnvironmentIdData = {
+    body?: ManagedAgentsEnvironment;
     path: {
         /**
-         * Integration provider id. Only GitHub has an OAuth connection flow; Slack is connected workspace-side and is not startable here, so naming it returns 400.
+         * Environment id (UUID) as returned by createEnvironment or listEnvironments.
          */
-        provider: 'github';
+        environment_id: string;
     };
     query?: never;
-    url: '/managed-agents/v1/integrations/{provider}/install/complete';
+    url: '/managed-agents/v1/environments/{environment_id}';
 };
-export type PostManagedAgentsV1IntegrationsByProviderInstallCompleteErrors = {
+export type PatchManagedAgentsV1EnvironmentsByEnvironmentIdErrors = {
     /**
      * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
      */
@@ -24037,14 +23962,14 @@ export type PostManagedAgentsV1IntegrationsByProviderInstallCompleteErrors = {
      */
     503: ManagedAgentsApiErrorBody | ApiErrorResponse;
 };
-export type PostManagedAgentsV1IntegrationsByProviderInstallCompleteError = PostManagedAgentsV1IntegrationsByProviderInstallCompleteErrors[keyof PostManagedAgentsV1IntegrationsByProviderInstallCompleteErrors];
-export type PostManagedAgentsV1IntegrationsByProviderInstallCompleteResponses = {
+export type PatchManagedAgentsV1EnvironmentsByEnvironmentIdError = PatchManagedAgentsV1EnvironmentsByEnvironmentIdErrors[keyof PatchManagedAgentsV1EnvironmentsByEnvironmentIdErrors];
+export type PatchManagedAgentsV1EnvironmentsByEnvironmentIdResponses = {
     /**
-     * An organization's link to a third-party account, created by installing an integration such as the GitHub App. It holds no secret itself; grant it to an agent so sessions can mint short-lived provider credentials from it.
+     * A sandbox environment a session executes in: its provider, resources, mounts, setup steps and idle/delete lifecycle. Created and started independently of any session.
      */
-    200: ManagedAgentsIntegrationConnection;
+    200: ManagedAgentsEnvironment;
 };
-export type PostManagedAgentsV1IntegrationsByProviderInstallCompleteResponse = PostManagedAgentsV1IntegrationsByProviderInstallCompleteResponses[keyof PostManagedAgentsV1IntegrationsByProviderInstallCompleteResponses];
+export type PatchManagedAgentsV1EnvironmentsByEnvironmentIdResponse = PatchManagedAgentsV1EnvironmentsByEnvironmentIdResponses[keyof PatchManagedAgentsV1EnvironmentsByEnvironmentIdResponses];
 export type PostManagedAgentsV1McpProbeData = {
     body?: ManagedAgentsProbeMcpServerRequest;
     path?: never;
@@ -27600,6 +27525,253 @@ export type PatchManagedAgentsV1VaultsByVaultIdCredentialsByCredentialIdResponse
     200: ManagedAgentsVaultCredential;
 };
 export type PatchManagedAgentsV1VaultsByVaultIdCredentialsByCredentialIdResponse = PatchManagedAgentsV1VaultsByVaultIdCredentialsByCredentialIdResponses[keyof PatchManagedAgentsV1VaultsByVaultIdCredentialsByCredentialIdResponses];
+export type GetManagedAgentsV1WebhookEndpointsData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/managed-agents/v1/webhook-endpoints';
+};
+export type GetManagedAgentsV1WebhookEndpointsErrors = {
+    /**
+     * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    400: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The caller is unauthenticated. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    401: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * Caller is missing a required permission, or the request scope (organization / environment / problem) does not resolve to the caller.
+     */
+    403: ApiErrorResponse;
+    /**
+     * A rate limit is exhausted. Honor `Retry-After`. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    429: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * An unexpected server-side failure. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    500: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A dependency is unavailable. Retryable. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    503: ManagedAgentsApiErrorBody | ApiErrorResponse;
+};
+export type GetManagedAgentsV1WebhookEndpointsError = GetManagedAgentsV1WebhookEndpointsErrors[keyof GetManagedAgentsV1WebhookEndpointsErrors];
+export type GetManagedAgentsV1WebhookEndpointsResponses = {
+    /**
+     * Webhook endpoints available to automations in the calling organization.
+     */
+    200: ManagedAgentsWebhookEndpointListResponse;
+};
+export type GetManagedAgentsV1WebhookEndpointsResponse = GetManagedAgentsV1WebhookEndpointsResponses[keyof GetManagedAgentsV1WebhookEndpointsResponses];
+export type PostManagedAgentsV1WebhookEndpointsData = {
+    body?: ManagedAgentsWebhookEndpointRequest;
+    path?: never;
+    query?: never;
+    url: '/managed-agents/v1/webhook-endpoints';
+};
+export type PostManagedAgentsV1WebhookEndpointsErrors = {
+    /**
+     * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    400: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The caller is unauthenticated. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    401: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * Caller is missing a required permission, or the request scope (organization / environment / problem) does not resolve to the caller.
+     */
+    403: ApiErrorResponse;
+    /**
+     * The request conflicts with the resource state, or with an in-flight idempotent replay. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    409: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The request exceeds a size or transaction budget. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    413: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A rate limit is exhausted. Honor `Retry-After`. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    429: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * An unexpected server-side failure. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    500: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A dependency is unavailable. Retryable. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    503: ManagedAgentsApiErrorBody | ApiErrorResponse;
+};
+export type PostManagedAgentsV1WebhookEndpointsError = PostManagedAgentsV1WebhookEndpointsErrors[keyof PostManagedAgentsV1WebhookEndpointsErrors];
+export type PostManagedAgentsV1WebhookEndpointsResponses = {
+    /**
+     * An organization-owned, provider-neutral webhook ingress endpoint with configurable verification and acknowledgement.
+     */
+    201: ManagedAgentsWebhookEndpoint;
+};
+export type PostManagedAgentsV1WebhookEndpointsResponse = PostManagedAgentsV1WebhookEndpointsResponses[keyof PostManagedAgentsV1WebhookEndpointsResponses];
+export type DeleteManagedAgentsV1WebhookEndpointsByEndpointIdData = {
+    body?: never;
+    path: {
+        /**
+         * Webhook endpoint id (UUID) as returned by createWebhookEndpoint or listWebhookEndpoints.
+         */
+        endpoint_id: string;
+    };
+    query?: never;
+    url: '/managed-agents/v1/webhook-endpoints/{endpoint_id}';
+};
+export type DeleteManagedAgentsV1WebhookEndpointsByEndpointIdErrors = {
+    /**
+     * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    400: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The caller is unauthenticated. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    401: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * Caller is missing a required permission, or the request scope (organization / environment / problem) does not resolve to the caller.
+     */
+    403: ApiErrorResponse;
+    /**
+     * No such resource is reachable for this caller. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    404: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The request conflicts with the resource state, or with an in-flight idempotent replay. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    409: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A rate limit is exhausted. Honor `Retry-After`. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    429: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * An unexpected server-side failure. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    500: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A dependency is unavailable. Retryable. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    503: ManagedAgentsApiErrorBody | ApiErrorResponse;
+};
+export type DeleteManagedAgentsV1WebhookEndpointsByEndpointIdError = DeleteManagedAgentsV1WebhookEndpointsByEndpointIdErrors[keyof DeleteManagedAgentsV1WebhookEndpointsByEndpointIdErrors];
+export type DeleteManagedAgentsV1WebhookEndpointsByEndpointIdResponses = {
+    /**
+     * No Content
+     */
+    204: void;
+};
+export type DeleteManagedAgentsV1WebhookEndpointsByEndpointIdResponse = DeleteManagedAgentsV1WebhookEndpointsByEndpointIdResponses[keyof DeleteManagedAgentsV1WebhookEndpointsByEndpointIdResponses];
+export type GetManagedAgentsV1WebhookEndpointsByEndpointIdData = {
+    body?: never;
+    path: {
+        /**
+         * Webhook endpoint id (UUID) as returned by createWebhookEndpoint or listWebhookEndpoints.
+         */
+        endpoint_id: string;
+    };
+    query?: never;
+    url: '/managed-agents/v1/webhook-endpoints/{endpoint_id}';
+};
+export type GetManagedAgentsV1WebhookEndpointsByEndpointIdErrors = {
+    /**
+     * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    400: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The caller is unauthenticated. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    401: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * Caller is missing a required permission, or the request scope (organization / environment / problem) does not resolve to the caller.
+     */
+    403: ApiErrorResponse;
+    /**
+     * No such resource is reachable for this caller. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    404: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A rate limit is exhausted. Honor `Retry-After`. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    429: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * An unexpected server-side failure. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    500: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A dependency is unavailable. Retryable. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    503: ManagedAgentsApiErrorBody | ApiErrorResponse;
+};
+export type GetManagedAgentsV1WebhookEndpointsByEndpointIdError = GetManagedAgentsV1WebhookEndpointsByEndpointIdErrors[keyof GetManagedAgentsV1WebhookEndpointsByEndpointIdErrors];
+export type GetManagedAgentsV1WebhookEndpointsByEndpointIdResponses = {
+    /**
+     * An organization-owned, provider-neutral webhook ingress endpoint with configurable verification and acknowledgement.
+     */
+    200: ManagedAgentsWebhookEndpoint;
+};
+export type GetManagedAgentsV1WebhookEndpointsByEndpointIdResponse = GetManagedAgentsV1WebhookEndpointsByEndpointIdResponses[keyof GetManagedAgentsV1WebhookEndpointsByEndpointIdResponses];
+export type PutManagedAgentsV1WebhookEndpointsByEndpointIdData = {
+    body?: ManagedAgentsWebhookEndpointRequest;
+    path: {
+        /**
+         * Webhook endpoint id (UUID) as returned by createWebhookEndpoint or listWebhookEndpoints.
+         */
+        endpoint_id: string;
+    };
+    query?: never;
+    url: '/managed-agents/v1/webhook-endpoints/{endpoint_id}';
+};
+export type PutManagedAgentsV1WebhookEndpointsByEndpointIdErrors = {
+    /**
+     * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    400: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The caller is unauthenticated. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    401: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * Caller is missing a required permission, or the request scope (organization / environment / problem) does not resolve to the caller.
+     */
+    403: ApiErrorResponse;
+    /**
+     * No such resource is reachable for this caller. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    404: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The request conflicts with the resource state, or with an in-flight idempotent replay. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    409: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The request exceeds a size or transaction budget. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    413: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A rate limit is exhausted. Honor `Retry-After`. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    429: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * An unexpected server-side failure. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    500: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A dependency is unavailable. Retryable. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    503: ManagedAgentsApiErrorBody | ApiErrorResponse;
+};
+export type PutManagedAgentsV1WebhookEndpointsByEndpointIdError = PutManagedAgentsV1WebhookEndpointsByEndpointIdErrors[keyof PutManagedAgentsV1WebhookEndpointsByEndpointIdErrors];
+export type PutManagedAgentsV1WebhookEndpointsByEndpointIdResponses = {
+    /**
+     * An organization-owned, provider-neutral webhook ingress endpoint with configurable verification and acknowledgement.
+     */
+    200: ManagedAgentsWebhookEndpoint;
+};
+export type PutManagedAgentsV1WebhookEndpointsByEndpointIdResponse = PutManagedAgentsV1WebhookEndpointsByEndpointIdResponses[keyof PutManagedAgentsV1WebhookEndpointsByEndpointIdResponses];
 export type GetV1ComputesData = {
     body?: never;
     path?: never;