@labelbox/rl-sdk 0.0.146 → 0.0.148

package/dist/generated/types.gen.d.ts

@@ -7126,7 +7126,7 @@ export type LockProblemVersionDto = {
     };
 };
 /**
- * A configured agent: its model, system prompt, tool and MCP surface, and the vault defaults new sessions inherit. Mutating an agent mints a new immutable AgentVersion; a session records the version it ran.
+ * A configured agent: its versioned execution definition plus current mutable classification tags. Patching the execution definition mints a new immutable AgentVersion; applying tags does not. A session records the version it ran and never snapshots tags.
  */
 export type ManagedAgentsAgent = {
     /**
@@ -7206,6 +7206,10 @@ export type ManagedAgentsAgent = {
      * System prompt prepended to every conversation this agent runs.
      */
     system?: string;
+    /**
+     * Current organization-scoped classification tags applied to this agent. Always an array. Tags are mutable catalog metadata and are deliberately absent from AgentVersion and session runtime snapshots.
+     */
+    tags: Array<ManagedAgentsTag>;
     /**
      * Additional tool groups to enable, snapshotted into the session and passed to the execution runtime unchanged. This does NOT gate the sandbox tools: run_command, run_process, read_file and write_file are offered to every session with a sandbox whether or not this list mentions them, so a shell needs no entry here. The names a session actually offers the model are reported as config.available_builtin_tools on the started session -- read that rather than inferring the tool surface from this list.
      */
@@ -8247,6 +8251,23 @@ export type ManagedAgentsCreateEnvironmentRequest = {
      */
     stopped_delete_after_seconds?: number;
 };
+/**
+ * Request body for creating one organization-scoped tag definition. The organization always comes from the authenticated principal.
+ */
+export type ManagedAgentsCreateTagRequest = {
+    /**
+     * Display color in #RRGGBB form.
+     */
+    color: string;
+    /**
+     * Optional operator-facing explanation of this classification, up to 280 characters.
+     */
+    description?: string;
+    /**
+     * Display label. Leading and trailing whitespace is removed; the result must contain 1-32 characters and be unique case-insensitively among live tags in the organization.
+     */
+    label: string;
+};
 /**
  * Request body creating a Slack wake rule: the connection and event to match, and the agent, environment, and vaults a match runs with. Every referenced object must belong to the calling organization; GitHub events use provider-neutral automations instead.
  */
@@ -8376,7 +8397,7 @@ export type ManagedAgentsDefineOutcomeRequest = {
     rubric: string;
 };
 /**
- * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
+ * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, tags, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
  */
 export type ManagedAgentsDeletedResponse = {
     /**
@@ -9156,6 +9177,23 @@ export type ManagedAgentsMemory = {
      */
     updated_at?: string;
 };
+/**
+ * Fields for creating one memory. Path, content and summary are all required; omitting any of them is a 400.
+ */
+export type ManagedAgentsMemoryCreateRequest = {
+    /**
+     * Full text of the memory. Capped at 100 kB; memory works better as many small focused documents.
+     */
+    content: string;
+    /**
+     * Address within the store, e.g. /conventions/testing.md.
+     */
+    path: string;
+    /**
+     * One line describing what this memory says, shown in search results and the console.
+     */
+    summary: string;
+};
 /**
  * One level of a memory store's namespace: memories and the prefixes standing for the paths beneath them.
  */
@@ -9175,7 +9213,7 @@ export type ManagedAgentsMemoryPinRequest = {
     pinned?: boolean;
 };
 /**
- * Fields for creating or updating one memory. Supply content_sha256 on update to apply the write only if the stored content still matches what you read.
+ * Fields for updating one memory. Every field is optional and an omitted one is left unchanged. Supply content_sha256 to apply the write only if the stored content still matches what you read.
  */
 export type ManagedAgentsMemoryRequest = {
     /**
@@ -10295,6 +10333,15 @@ export type ManagedAgentsReflectionListResponse = {
      */
     reflections?: unknown;
 };
+/**
+ * Request body for atomically replacing an agent's complete mutable tag classification.
+ */
+export type ManagedAgentsReplaceAgentTagsRequest = {
+    /**
+     * Complete replacement set of tag ids, with at most 32 distinct ids. Every id must be a live tag in the caller's organization. Duplicates are collapsed before enforcing the limit; [] removes every tag.
+     */
+    tag_ids: Array<string>;
+};
 /**
  * Structured input for manually starting an automation without a webhook delivery.
  */
@@ -11032,6 +11079,48 @@ export type ManagedAgentsStartSessionRequest = {
      */
     vault_ids?: Array<string>;
 };
+/**
+ * An organization-scoped classification definition. Applying or removing it changes only catalog membership: it does not update the agent, mint an AgentVersion, or affect running sessions.
+ */
+export type ManagedAgentsTag = {
+    /**
+     * Display color in #RRGGBB form.
+     */
+    color?: string;
+    /**
+     * Server-assigned RFC 3339 timestamp of when the tag was created.
+     */
+    created_at?: string;
+    /**
+     * Optional operator-facing explanation of the classification, up to 280 characters.
+     */
+    description?: string;
+    /**
+     * Display label, trimmed by the service. Unique case-insensitively among live tags in this organization.
+     */
+    label?: string;
+    /**
+     * Labelbox organization that owns the tag. Server-assigned from the authenticated principal and never accepted as authority from the request body.
+     */
+    organization_id?: string;
+    /**
+     * Server-assigned tag id (UUID).
+     */
+    tag_id?: string;
+    /**
+     * Server-assigned RFC 3339 timestamp of the most recent definition update.
+     */
+    updated_at?: string;
+};
+/**
+ * A complete set of organization-scoped tag definitions. GET /v1/tags returns the organization catalog; agent tag PUT routes return the agent's resulting exact set.
+ */
+export type ManagedAgentsTagListResponse = {
+    /**
+     * The complete live tag set for this response. Always an array; an empty array means no definitions exist or the agent has no classifications.
+     */
+    tags: Array<ManagedAgentsTag>;
+};
 /**
  * One tool or toolset enabled on an agent version, with its type-specific settings. Callers supply these when creating an agent version; the resulting session offers exactly the tools they declare.
  */
@@ -11192,6 +11281,117 @@ export type ManagedAgentsTriggerBindingListResponse = {
      */
     bindings?: unknown;
 };
+/**
+ * Partial update to an agent's versioned execution definition. Omitted fields keep their current values. Tags are changed only through the dedicated agent tag routes.
+ */
+export type ManagedAgentsUpdateAgentRequest = {
+    /**
+     * Server-assigned id of the agent, used in the agent, agent-version, and session routes.
+     */
+    agent_id?: string;
+    /**
+     * Server-assigned RFC 3339 timestamp of when the agent was created.
+     */
+    created_at?: string;
+    /**
+     * Caller-defined tools exposed to the model in addition to the built-in toolsets.
+     */
+    custom_tools?: unknown;
+    /**
+     * Narrows the default vaults to individual credentials. Every credential is selected when a vault is first added, and may then be unchecked.
+     */
+    default_credential_refs?: unknown;
+    /**
+     * Markdown rubric that sessions started from this agent are graded against when their create request omits an outcome. A session that supplies its own outcome ignores this entirely. Omit the field to keep the stored rubric; send an empty string to remove it.
+     */
+    default_rubric?: unknown;
+    /**
+     * Vaults whose credentials are copied into a new session when its create request omits vault_ids. Sending an explicit empty list on the session still overrides these.
+     */
+    default_vault_ids?: unknown;
+    /**
+     * Free-text note about what this agent is for.
+     */
+    description?: string;
+    /**
+     * Server-maintained id of the newest version of this agent; sessions started without an explicit version use it.
+     */
+    latest_agent_version_id?: string;
+    /**
+     * Remote MCP servers to attach. Each entry is an object with name (the label the server's tools are grouped under) and url (its http/https endpoint); any further keys are passed to the runtime unchanged. Credentials come from the vaults granted to the session, not from this entry. Tools are discovered and snapshotted at session start.
+     */
+    mcp_servers?: unknown;
+    /**
+     * Caller-owned key/value data stored with the agent and returned unchanged.
+     */
+    metadata?: {
+        [key: string]: unknown;
+    };
+    /**
+     * Model the agent runs on. Pass a gateway model id exactly as the gateway models catalog reports it, e.g. anthropic/claude-sonnet-4-5; it is stored prefixed as litellm:anthropic/claude-sonnet-4-5, which is the form the router reads and the form returned on reads. An explicitly provider-qualified string such as anthropic:claude-sonnet-4-5 selects a directly-configured provider instead and is left as written. An id the gateway does not serve is rejected here, not at the session's first turn.
+     */
+    model?: string;
+    model_config?: ManagedAgentsInferenceConfig;
+    /**
+     * Canonical model-reference id to run instead of a gateway model id, for fine-tuned or self-hosted models.
+     */
+    model_ref_id?: string;
+    /**
+     * Multi-agent orchestration settings, such as subagent definitions and delegation limits.
+     */
+    multiagent?: {
+        [key: string]: unknown;
+    };
+    /**
+     * Human-readable label shown wherever agents are listed. Not required to be unique.
+     */
+    name?: string;
+    /**
+     * Labelbox organization that owns the agent. Server-assigned from the caller's credentials; a value sent in a request body is ignored.
+     */
+    organization_id?: string;
+    /**
+     * Runtime adapter configurations that change how the harness executes turns; each entry is adapter-specific.
+     */
+    runtime_adapters?: unknown;
+    /**
+     * Skill packages loaded into the agent's runtime, each an entry with the skill reference and its metadata.
+     */
+    skills?: unknown;
+    /**
+     * System prompt prepended to every conversation this agent runs.
+     */
+    system?: string;
+    /**
+     * Additional tool groups to enable, snapshotted into the session and passed to the execution runtime unchanged. This does NOT gate the sandbox tools: run_command, run_process, read_file and write_file are offered to every session with a sandbox whether or not this list mentions them, so a shell needs no entry here. The names a session actually offers the model are reported as config.available_builtin_tools on the started session -- read that rather than inferring the tool surface from this list.
+     */
+    toolsets?: unknown;
+    /**
+     * Server-assigned RFC 3339 timestamp of the most recent update to the agent.
+     */
+    updated_at?: string;
+    /**
+     * Whether new sessions may use the native web_search tool. Omitted on legacy agents and interpreted as enabled.
+     */
+    web_search_enabled?: boolean;
+};
+/**
+ * Request body for changing a tag definition. Every field is optional and tag applications remain unchanged.
+ */
+export type ManagedAgentsUpdateTagRequest = {
+    /**
+     * Replacement display color in #RRGGBB form. Omit to keep the current color.
+     */
+    color?: string;
+    /**
+     * Replacement description. Send an empty string to clear it; omit to keep the current description.
+     */
+    description?: string;
+    /**
+     * Replacement display label. Leading and trailing whitespace is removed. Omit to keep the current label.
+     */
+    label?: string;
+};
 /**
  * Partial update of one trigger binding. Only the properties present in the request change; an omitted property keeps its stored value, so an explicit false or empty list is distinguishable from an omission. The merged binding is revalidated as a whole, which is what keeps a single-field edit from bypassing a provider or tenancy invariant.
  */
@@ -22739,7 +22939,12 @@ export type WorkspaceFileDownloadUrlResponseDto = {
 export type GetManagedAgentsV1AgentsData = {
     body?: never;
     path?: never;
-    query?: never;
+    query?: {
+        /**
+         * Comma-separated tag ids, with at most 32 distinct ids. Blank segments are ignored. An agent must carry every requested tag (AND semantics). Unknown or cross-organization ids return 404.
+         */
+        tag_ids?: string;
+    };
     url: '/managed-agents/v1/agents';
 };
 export type GetManagedAgentsV1AgentsErrors = {
@@ -22755,6 +22960,10 @@ export type GetManagedAgentsV1AgentsErrors = {
      * Caller is missing a required permission, or the request scope (organization / environment / problem) does not resolve to the caller.
      */
     403: ApiErrorResponse;
+    /**
+     * No such resource is reachable for this caller. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    404: ManagedAgentsApiErrorBody | ApiErrorResponse;
     /**
      * A rate limit is exhausted. Honor `Retry-After`. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
      */
@@ -22819,7 +23028,7 @@ export type PostManagedAgentsV1AgentsErrors = {
 export type PostManagedAgentsV1AgentsError = PostManagedAgentsV1AgentsErrors[keyof PostManagedAgentsV1AgentsErrors];
 export type PostManagedAgentsV1AgentsResponses = {
     /**
-     * A configured agent: its model, system prompt, tool and MCP surface, and the vault defaults new sessions inherit. Mutating an agent mints a new immutable AgentVersion; a session records the version it ran.
+     * A configured agent: its versioned execution definition plus current mutable classification tags. Patching the execution definition mints a new immutable AgentVersion; applying tags does not. A session records the version it ran and never snapshots tags.
      */
     200: ManagedAgentsAgent;
 };
@@ -22872,7 +23081,7 @@ export type DeleteManagedAgentsV1AgentsByAgentIdErrors = {
 export type DeleteManagedAgentsV1AgentsByAgentIdError = DeleteManagedAgentsV1AgentsByAgentIdErrors[keyof DeleteManagedAgentsV1AgentsByAgentIdErrors];
 export type DeleteManagedAgentsV1AgentsByAgentIdResponses = {
     /**
-     * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
+     * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, tags, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
      */
     200: ManagedAgentsDeletedResponse;
 };
@@ -22921,13 +23130,13 @@ export type GetManagedAgentsV1AgentsByAgentIdErrors = {
 export type GetManagedAgentsV1AgentsByAgentIdError = GetManagedAgentsV1AgentsByAgentIdErrors[keyof GetManagedAgentsV1AgentsByAgentIdErrors];
 export type GetManagedAgentsV1AgentsByAgentIdResponses = {
     /**
-     * A configured agent: its model, system prompt, tool and MCP surface, and the vault defaults new sessions inherit. Mutating an agent mints a new immutable AgentVersion; a session records the version it ran.
+     * A configured agent: its versioned execution definition plus current mutable classification tags. Patching the execution definition mints a new immutable AgentVersion; applying tags does not. A session records the version it ran and never snapshots tags.
      */
     200: ManagedAgentsAgent;
 };
 export type GetManagedAgentsV1AgentsByAgentIdResponse = GetManagedAgentsV1AgentsByAgentIdResponses[keyof GetManagedAgentsV1AgentsByAgentIdResponses];
 export type PatchManagedAgentsV1AgentsByAgentIdData = {
-    body?: ManagedAgentsAgent;
+    body?: ManagedAgentsUpdateAgentRequest;
     path: {
         /**
          * Agent id (UUID) as returned by createAgent or listAgents.
@@ -22978,7 +23187,7 @@ export type PatchManagedAgentsV1AgentsByAgentIdErrors = {
 export type PatchManagedAgentsV1AgentsByAgentIdError = PatchManagedAgentsV1AgentsByAgentIdErrors[keyof PatchManagedAgentsV1AgentsByAgentIdErrors];
 export type PatchManagedAgentsV1AgentsByAgentIdResponses = {
     /**
-     * A configured agent: its model, system prompt, tool and MCP surface, and the vault defaults new sessions inherit. Mutating an agent mints a new immutable AgentVersion; a session records the version it ran.
+     * A configured agent: its versioned execution definition plus current mutable classification tags. Patching the execution definition mints a new immutable AgentVersion; applying tags does not. A session records the version it ran and never snapshots tags.
      */
     200: ManagedAgentsAgent;
 };
@@ -23150,18 +23359,18 @@ export type PostManagedAgentsV1AgentsByAgentIdReflectionsResponses = {
     202: ManagedAgentsReflection;
 };
 export type PostManagedAgentsV1AgentsByAgentIdReflectionsResponse = PostManagedAgentsV1AgentsByAgentIdReflectionsResponses[keyof PostManagedAgentsV1AgentsByAgentIdReflectionsResponses];
-export type GetManagedAgentsV1AgentsByAgentIdVersionsData = {
-    body?: never;
+export type PutManagedAgentsV1AgentsByAgentIdTagsData = {
+    body?: ManagedAgentsReplaceAgentTagsRequest;
     path: {
         /**
-         * Agent id (UUID) as returned by createAgent or listAgents.
+         * Agent id (UUID) whose classifications are replaced.
          */
         agent_id: string;
     };
     query?: never;
-    url: '/managed-agents/v1/agents/{agent_id}/versions';
+    url: '/managed-agents/v1/agents/{agent_id}/tags';
 };
-export type GetManagedAgentsV1AgentsByAgentIdVersionsErrors = {
+export type PutManagedAgentsV1AgentsByAgentIdTagsErrors = {
     /**
      * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
      */
@@ -23178,6 +23387,14 @@ export type GetManagedAgentsV1AgentsByAgentIdVersionsErrors = {
      * No such resource is reachable for this caller. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
      */
     404: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The request conflicts with the resource state, or with an in-flight idempotent replay. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    409: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The request exceeds a size or transaction budget. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    413: ManagedAgentsApiErrorBody | ApiErrorResponse;
     /**
      * A rate limit is exhausted. Honor `Retry-After`. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
      */
@@ -23191,30 +23408,30 @@ export type GetManagedAgentsV1AgentsByAgentIdVersionsErrors = {
      */
     503: ManagedAgentsApiErrorBody | ApiErrorResponse;
 };
-export type GetManagedAgentsV1AgentsByAgentIdVersionsError = GetManagedAgentsV1AgentsByAgentIdVersionsErrors[keyof GetManagedAgentsV1AgentsByAgentIdVersionsErrors];
-export type GetManagedAgentsV1AgentsByAgentIdVersionsResponses = {
+export type PutManagedAgentsV1AgentsByAgentIdTagsError = PutManagedAgentsV1AgentsByAgentIdTagsErrors[keyof PutManagedAgentsV1AgentsByAgentIdTagsErrors];
+export type PutManagedAgentsV1AgentsByAgentIdTagsResponses = {
     /**
-     * Response body of GET /v1/agents/{agent_id}/versions. Scoped to the one agent in the path, so an empty list means that agent has no versions yet, not that no agents exist. Versions are immutable snapshots: pin one to make a session reproducible.
+     * A complete set of organization-scoped tag definitions. GET /v1/tags returns the organization catalog; agent tag PUT routes return the agent's resulting exact set.
      */
-    200: ManagedAgentsAgentVersionListResponse;
+    200: ManagedAgentsTagListResponse;
 };
-export type GetManagedAgentsV1AgentsByAgentIdVersionsResponse = GetManagedAgentsV1AgentsByAgentIdVersionsResponses[keyof GetManagedAgentsV1AgentsByAgentIdVersionsResponses];
-export type GetManagedAgentsV1AgentsByAgentIdVersionsByAgentVersionIdData = {
+export type PutManagedAgentsV1AgentsByAgentIdTagsResponse = PutManagedAgentsV1AgentsByAgentIdTagsResponses[keyof PutManagedAgentsV1AgentsByAgentIdTagsResponses];
+export type DeleteManagedAgentsV1AgentsByAgentIdTagsByTagIdData = {
     body?: never;
     path: {
         /**
-         * Agent id (UUID) the version belongs to.
+         * Agent id (UUID) as returned by createAgent or listAgents.
          */
         agent_id: string;
         /**
-         * Immutable agent version id (UUID), as listed by listAgentVersions or reported as an agent's latest_agent_version_id.
+         * Tag id (UUID) as returned by createTag or listTags.
          */
-        agent_version_id: string;
+        tag_id: string;
     };
     query?: never;
-    url: '/managed-agents/v1/agents/{agent_id}/versions/{agent_version_id}';
+    url: '/managed-agents/v1/agents/{agent_id}/tags/{tag_id}';
 };
-export type GetManagedAgentsV1AgentsByAgentIdVersionsByAgentVersionIdErrors = {
+export type DeleteManagedAgentsV1AgentsByAgentIdTagsByTagIdErrors = {
     /**
      * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
      */
@@ -23231,6 +23448,10 @@ export type GetManagedAgentsV1AgentsByAgentIdVersionsByAgentVersionIdErrors = {
      * No such resource is reachable for this caller. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
      */
     404: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The request conflicts with the resource state, or with an in-flight idempotent replay. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    409: ManagedAgentsApiErrorBody | ApiErrorResponse;
     /**
      * A rate limit is exhausted. Honor `Retry-After`. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
      */
@@ -23244,65 +23465,224 @@ export type GetManagedAgentsV1AgentsByAgentIdVersionsByAgentVersionIdErrors = {
      */
     503: ManagedAgentsApiErrorBody | ApiErrorResponse;
 };
-export type GetManagedAgentsV1AgentsByAgentIdVersionsByAgentVersionIdError = GetManagedAgentsV1AgentsByAgentIdVersionsByAgentVersionIdErrors[keyof GetManagedAgentsV1AgentsByAgentIdVersionsByAgentVersionIdErrors];
-export type GetManagedAgentsV1AgentsByAgentIdVersionsByAgentVersionIdResponses = {
+export type DeleteManagedAgentsV1AgentsByAgentIdTagsByTagIdError = DeleteManagedAgentsV1AgentsByAgentIdTagsByTagIdErrors[keyof DeleteManagedAgentsV1AgentsByAgentIdTagsByTagIdErrors];
+export type DeleteManagedAgentsV1AgentsByAgentIdTagsByTagIdResponses = {
     /**
-     * An immutable snapshot of an agent's configuration, minted on every update. Sessions reference a version rather than the agent, so a running session's behaviour cannot change under it.
+     * No Content
      */
-    200: ManagedAgentsAgentVersion;
+    204: void;
 };
-export type GetManagedAgentsV1AgentsByAgentIdVersionsByAgentVersionIdResponse = GetManagedAgentsV1AgentsByAgentIdVersionsByAgentVersionIdResponses[keyof GetManagedAgentsV1AgentsByAgentIdVersionsByAgentVersionIdResponses];
-export type GetManagedAgentsV1AnalyticsByFamilyData = {
+export type DeleteManagedAgentsV1AgentsByAgentIdTagsByTagIdResponse = DeleteManagedAgentsV1AgentsByAgentIdTagsByTagIdResponses[keyof DeleteManagedAgentsV1AgentsByAgentIdTagsByTagIdResponses];
+export type PutManagedAgentsV1AgentsByAgentIdTagsByTagIdData = {
     body?: never;
     path: {
         /**
-         * Metric family to read: managed_agent_usage for tool, token, and cost figures, managed_agent_turn for turn counts and turn duration percentiles, managed_agent_environment for sandbox startup latency.
-         */
-        family: 'managed_agent_usage' | 'managed_agent_turn' | 'managed_agent_environment';
-    };
-    query?: {
-        /**
-         * Read locality. workspace is the caller's own organization; tenant aggregates every workspace in the parent tenant organization and requires a Tenant Admin role.
-         */
-        scope?: 'workspace' | 'tenant';
-        /**
-         * With scope=tenant, narrow to one workspace of the tenant. Ignored at workspace scope, where the authenticated organization is authoritative.
-         */
-        workspace_id?: string;
-        /**
-         * RFC 3339 start of the window. Defaults to seven days before to. Widened outward to a bucket boundary.
-         */
-        from?: string;
-        /**
-         * RFC 3339 exclusive end of the window. Defaults to now.
-         */
-        to?: string;
-        /**
-         * Series bucket width. Defaults to hourly for windows up to two days and daily beyond that.
-         */
-        granularity?: 'hour' | 'day';
-        /**
-         * Filter to work under sessions launched from this agent, including its subagents.
-         */
-        launched_agent_id?: string;
-        /**
-         * Filter to work performed by this agent, whether it was launched directly or delegated to.
-         */
-        executing_agent_id?: string;
-        /**
-         * Filter to one immutable agent version.
-         */
-        executing_agent_version_id?: string;
-        /**
-         * Filter to one provider model id.
+         * Agent id (UUID) as returned by createAgent or listAgents.
          */
-        model?: string;
+        agent_id: string;
         /**
-         * Filter by the system a project or external source belongs to, e.g. rl_gym, taiga, or slack_thread.
+         * Tag id (UUID) as returned by createTag or listTags.
          */
-        project_source?: string;
-        /**
-         * Filter to one project or external source id within project_source.
+        tag_id: string;
+    };
+    query?: never;
+    url: '/managed-agents/v1/agents/{agent_id}/tags/{tag_id}';
+};
+export type PutManagedAgentsV1AgentsByAgentIdTagsByTagIdErrors = {
+    /**
+     * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    400: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The caller is unauthenticated. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    401: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * Caller is missing a required permission, or the request scope (organization / environment / problem) does not resolve to the caller.
+     */
+    403: ApiErrorResponse;
+    /**
+     * No such resource is reachable for this caller. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    404: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The request conflicts with the resource state, or with an in-flight idempotent replay. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    409: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A rate limit is exhausted. Honor `Retry-After`. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    429: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * An unexpected server-side failure. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    500: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A dependency is unavailable. Retryable. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    503: ManagedAgentsApiErrorBody | ApiErrorResponse;
+};
+export type PutManagedAgentsV1AgentsByAgentIdTagsByTagIdError = PutManagedAgentsV1AgentsByAgentIdTagsByTagIdErrors[keyof PutManagedAgentsV1AgentsByAgentIdTagsByTagIdErrors];
+export type PutManagedAgentsV1AgentsByAgentIdTagsByTagIdResponses = {
+    /**
+     * A complete set of organization-scoped tag definitions. GET /v1/tags returns the organization catalog; agent tag PUT routes return the agent's resulting exact set.
+     */
+    200: ManagedAgentsTagListResponse;
+};
+export type PutManagedAgentsV1AgentsByAgentIdTagsByTagIdResponse = PutManagedAgentsV1AgentsByAgentIdTagsByTagIdResponses[keyof PutManagedAgentsV1AgentsByAgentIdTagsByTagIdResponses];
+export type GetManagedAgentsV1AgentsByAgentIdVersionsData = {
+    body?: never;
+    path: {
+        /**
+         * Agent id (UUID) as returned by createAgent or listAgents.
+         */
+        agent_id: string;
+    };
+    query?: never;
+    url: '/managed-agents/v1/agents/{agent_id}/versions';
+};
+export type GetManagedAgentsV1AgentsByAgentIdVersionsErrors = {
+    /**
+     * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    400: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The caller is unauthenticated. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    401: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * Caller is missing a required permission, or the request scope (organization / environment / problem) does not resolve to the caller.
+     */
+    403: ApiErrorResponse;
+    /**
+     * No such resource is reachable for this caller. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    404: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A rate limit is exhausted. Honor `Retry-After`. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    429: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * An unexpected server-side failure. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    500: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A dependency is unavailable. Retryable. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    503: ManagedAgentsApiErrorBody | ApiErrorResponse;
+};
+export type GetManagedAgentsV1AgentsByAgentIdVersionsError = GetManagedAgentsV1AgentsByAgentIdVersionsErrors[keyof GetManagedAgentsV1AgentsByAgentIdVersionsErrors];
+export type GetManagedAgentsV1AgentsByAgentIdVersionsResponses = {
+    /**
+     * Response body of GET /v1/agents/{agent_id}/versions. Scoped to the one agent in the path, so an empty list means that agent has no versions yet, not that no agents exist. Versions are immutable snapshots: pin one to make a session reproducible.
+     */
+    200: ManagedAgentsAgentVersionListResponse;
+};
+export type GetManagedAgentsV1AgentsByAgentIdVersionsResponse = GetManagedAgentsV1AgentsByAgentIdVersionsResponses[keyof GetManagedAgentsV1AgentsByAgentIdVersionsResponses];
+export type GetManagedAgentsV1AgentsByAgentIdVersionsByAgentVersionIdData = {
+    body?: never;
+    path: {
+        /**
+         * Agent id (UUID) the version belongs to.
+         */
+        agent_id: string;
+        /**
+         * Immutable agent version id (UUID), as listed by listAgentVersions or reported as an agent's latest_agent_version_id.
+         */
+        agent_version_id: string;
+    };
+    query?: never;
+    url: '/managed-agents/v1/agents/{agent_id}/versions/{agent_version_id}';
+};
+export type GetManagedAgentsV1AgentsByAgentIdVersionsByAgentVersionIdErrors = {
+    /**
+     * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    400: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The caller is unauthenticated. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    401: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * Caller is missing a required permission, or the request scope (organization / environment / problem) does not resolve to the caller.
+     */
+    403: ApiErrorResponse;
+    /**
+     * No such resource is reachable for this caller. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    404: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A rate limit is exhausted. Honor `Retry-After`. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    429: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * An unexpected server-side failure. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    500: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A dependency is unavailable. Retryable. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    503: ManagedAgentsApiErrorBody | ApiErrorResponse;
+};
+export type GetManagedAgentsV1AgentsByAgentIdVersionsByAgentVersionIdError = GetManagedAgentsV1AgentsByAgentIdVersionsByAgentVersionIdErrors[keyof GetManagedAgentsV1AgentsByAgentIdVersionsByAgentVersionIdErrors];
+export type GetManagedAgentsV1AgentsByAgentIdVersionsByAgentVersionIdResponses = {
+    /**
+     * An immutable snapshot of an agent's configuration, minted on every update. Sessions reference a version rather than the agent, so a running session's behaviour cannot change under it.
+     */
+    200: ManagedAgentsAgentVersion;
+};
+export type GetManagedAgentsV1AgentsByAgentIdVersionsByAgentVersionIdResponse = GetManagedAgentsV1AgentsByAgentIdVersionsByAgentVersionIdResponses[keyof GetManagedAgentsV1AgentsByAgentIdVersionsByAgentVersionIdResponses];
+export type GetManagedAgentsV1AnalyticsByFamilyData = {
+    body?: never;
+    path: {
+        /**
+         * Metric family to read: managed_agent_usage for tool, token, and cost figures, managed_agent_turn for turn counts and turn duration percentiles, managed_agent_environment for sandbox startup latency.
+         */
+        family: 'managed_agent_usage' | 'managed_agent_turn' | 'managed_agent_environment';
+    };
+    query?: {
+        /**
+         * Read locality. workspace is the caller's own organization; tenant aggregates every workspace in the parent tenant organization and requires a Tenant Admin role.
+         */
+        scope?: 'workspace' | 'tenant';
+        /**
+         * With scope=tenant, narrow to one workspace of the tenant. Ignored at workspace scope, where the authenticated organization is authoritative.
+         */
+        workspace_id?: string;
+        /**
+         * RFC 3339 start of the window. Defaults to seven days before to. Widened outward to a bucket boundary.
+         */
+        from?: string;
+        /**
+         * RFC 3339 exclusive end of the window. Defaults to now.
+         */
+        to?: string;
+        /**
+         * Series bucket width. Defaults to hourly for windows up to two days and daily beyond that.
+         */
+        granularity?: 'hour' | 'day';
+        /**
+         * Filter to work under sessions launched from this agent, including its subagents.
+         */
+        launched_agent_id?: string;
+        /**
+         * Filter to work performed by this agent, whether it was launched directly or delegated to.
+         */
+        executing_agent_id?: string;
+        /**
+         * Filter to one immutable agent version.
+         */
+        executing_agent_version_id?: string;
+        /**
+         * Filter to one provider model id.
+         */
+        model?: string;
+        /**
+         * Filter by the system a project or external source belongs to, e.g. rl_gym, taiga, or slack_thread.
+         */
+        project_source?: string;
+        /**
+         * Filter to one project or external source id within project_source.
          */
         project_id?: string;
         /**
@@ -23818,7 +24198,7 @@ export type DeleteManagedAgentsV1EnvironmentsByEnvironmentIdErrors = {
 export type DeleteManagedAgentsV1EnvironmentsByEnvironmentIdError = DeleteManagedAgentsV1EnvironmentsByEnvironmentIdErrors[keyof DeleteManagedAgentsV1EnvironmentsByEnvironmentIdErrors];
 export type DeleteManagedAgentsV1EnvironmentsByEnvironmentIdResponses = {
     /**
-     * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
+     * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, tags, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
      */
     200: ManagedAgentsDeletedResponse;
 };
@@ -24410,7 +24790,7 @@ export type GetManagedAgentsV1MemoryStoresByMemoryStoreIdMemoriesResponses = {
 };
 export type GetManagedAgentsV1MemoryStoresByMemoryStoreIdMemoriesResponse = GetManagedAgentsV1MemoryStoresByMemoryStoreIdMemoriesResponses[keyof GetManagedAgentsV1MemoryStoresByMemoryStoreIdMemoriesResponses];
 export type PostManagedAgentsV1MemoryStoresByMemoryStoreIdMemoriesData = {
-    body?: ManagedAgentsMemoryRequest;
+    body?: ManagedAgentsMemoryCreateRequest;
     path: {
         /**
          * Memory store id (UUID) as returned by createMemoryStore or listMemoryStores.
@@ -25385,6 +25765,10 @@ export type GetManagedAgentsV1SessionsData = {
          * Filter by agent id.
          */
         agent_id?: string;
+        /**
+         * Comma-separated current agent tag ids, with at most 32 distinct ids. A session row's agent must carry every requested tag (AND semantics). Unknown or cross-organization ids return 404. Tags are resolved at read time, not from the session snapshot.
+         */
+        tag_ids?: string;
         external_source_type?: string;
         external_source_id?: string;
         /**
@@ -25408,6 +25792,10 @@ export type GetManagedAgentsV1SessionsErrors = {
      * Caller is missing a required permission, or the request scope (organization / environment / problem) does not resolve to the caller.
      */
     403: ApiErrorResponse;
+    /**
+     * No such resource is reachable for this caller. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    404: ManagedAgentsApiErrorBody | ApiErrorResponse;
     /**
      * A rate limit is exhausted. Honor `Retry-After`. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
      */
@@ -25625,7 +26013,7 @@ export type DeleteManagedAgentsV1SessionsBySessionIdErrors = {
 export type DeleteManagedAgentsV1SessionsBySessionIdError = DeleteManagedAgentsV1SessionsBySessionIdErrors[keyof DeleteManagedAgentsV1SessionsBySessionIdErrors];
 export type DeleteManagedAgentsV1SessionsBySessionIdResponses = {
     /**
-     * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
+     * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, tags, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
      */
     200: ManagedAgentsDeletedResponse;
 };
@@ -26490,7 +26878,7 @@ export type DeleteManagedAgentsV1SkillsBySkillIdErrors = {
 export type DeleteManagedAgentsV1SkillsBySkillIdError = DeleteManagedAgentsV1SkillsBySkillIdErrors[keyof DeleteManagedAgentsV1SkillsBySkillIdErrors];
 export type DeleteManagedAgentsV1SkillsBySkillIdResponses = {
     /**
-     * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
+     * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, tags, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
      */
     200: ManagedAgentsDeletedResponse;
 };
@@ -26703,6 +27091,253 @@ export type GetManagedAgentsV1SkillsBySkillIdVersionsBySkillVersionIdResponses =
     200: ManagedAgentsSkillVersion;
 };
 export type GetManagedAgentsV1SkillsBySkillIdVersionsBySkillVersionIdResponse = GetManagedAgentsV1SkillsBySkillIdVersionsBySkillVersionIdResponses[keyof GetManagedAgentsV1SkillsBySkillIdVersionsBySkillVersionIdResponses];
+export type GetManagedAgentsV1TagsData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/managed-agents/v1/tags';
+};
+export type GetManagedAgentsV1TagsErrors = {
+    /**
+     * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    400: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The caller is unauthenticated. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    401: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * Caller is missing a required permission, or the request scope (organization / environment / problem) does not resolve to the caller.
+     */
+    403: ApiErrorResponse;
+    /**
+     * A rate limit is exhausted. Honor `Retry-After`. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    429: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * An unexpected server-side failure. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    500: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A dependency is unavailable. Retryable. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    503: ManagedAgentsApiErrorBody | ApiErrorResponse;
+};
+export type GetManagedAgentsV1TagsError = GetManagedAgentsV1TagsErrors[keyof GetManagedAgentsV1TagsErrors];
+export type GetManagedAgentsV1TagsResponses = {
+    /**
+     * A complete set of organization-scoped tag definitions. GET /v1/tags returns the organization catalog; agent tag PUT routes return the agent's resulting exact set.
+     */
+    200: ManagedAgentsTagListResponse;
+};
+export type GetManagedAgentsV1TagsResponse = GetManagedAgentsV1TagsResponses[keyof GetManagedAgentsV1TagsResponses];
+export type PostManagedAgentsV1TagsData = {
+    body?: ManagedAgentsCreateTagRequest;
+    path?: never;
+    query?: never;
+    url: '/managed-agents/v1/tags';
+};
+export type PostManagedAgentsV1TagsErrors = {
+    /**
+     * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    400: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The caller is unauthenticated. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    401: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * Caller is missing a required permission, or the request scope (organization / environment / problem) does not resolve to the caller.
+     */
+    403: ApiErrorResponse;
+    /**
+     * The request conflicts with the resource state, or with an in-flight idempotent replay. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    409: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The request exceeds a size or transaction budget. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    413: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A rate limit is exhausted. Honor `Retry-After`. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    429: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * An unexpected server-side failure. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    500: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A dependency is unavailable. Retryable. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    503: ManagedAgentsApiErrorBody | ApiErrorResponse;
+};
+export type PostManagedAgentsV1TagsError = PostManagedAgentsV1TagsErrors[keyof PostManagedAgentsV1TagsErrors];
+export type PostManagedAgentsV1TagsResponses = {
+    /**
+     * An organization-scoped classification definition. Applying or removing it changes only catalog membership: it does not update the agent, mint an AgentVersion, or affect running sessions.
+     */
+    200: ManagedAgentsTag;
+};
+export type PostManagedAgentsV1TagsResponse = PostManagedAgentsV1TagsResponses[keyof PostManagedAgentsV1TagsResponses];
+export type DeleteManagedAgentsV1TagsByTagIdData = {
+    body?: never;
+    path: {
+        /**
+         * Tag id (UUID) as returned by createTag or listTags.
+         */
+        tag_id: string;
+    };
+    query?: never;
+    url: '/managed-agents/v1/tags/{tag_id}';
+};
+export type DeleteManagedAgentsV1TagsByTagIdErrors = {
+    /**
+     * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    400: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The caller is unauthenticated. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    401: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * Caller is missing a required permission, or the request scope (organization / environment / problem) does not resolve to the caller.
+     */
+    403: ApiErrorResponse;
+    /**
+     * No such resource is reachable for this caller. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    404: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The request conflicts with the resource state, or with an in-flight idempotent replay. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    409: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A rate limit is exhausted. Honor `Retry-After`. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    429: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * An unexpected server-side failure. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    500: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A dependency is unavailable. Retryable. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    503: ManagedAgentsApiErrorBody | ApiErrorResponse;
+};
+export type DeleteManagedAgentsV1TagsByTagIdError = DeleteManagedAgentsV1TagsByTagIdErrors[keyof DeleteManagedAgentsV1TagsByTagIdErrors];
+export type DeleteManagedAgentsV1TagsByTagIdResponses = {
+    /**
+     * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, tags, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
+     */
+    200: ManagedAgentsDeletedResponse;
+};
+export type DeleteManagedAgentsV1TagsByTagIdResponse = DeleteManagedAgentsV1TagsByTagIdResponses[keyof DeleteManagedAgentsV1TagsByTagIdResponses];
+export type GetManagedAgentsV1TagsByTagIdData = {
+    body?: never;
+    path: {
+        /**
+         * Tag id (UUID) as returned by createTag or listTags.
+         */
+        tag_id: string;
+    };
+    query?: never;
+    url: '/managed-agents/v1/tags/{tag_id}';
+};
+export type GetManagedAgentsV1TagsByTagIdErrors = {
+    /**
+     * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    400: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The caller is unauthenticated. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    401: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * Caller is missing a required permission, or the request scope (organization / environment / problem) does not resolve to the caller.
+     */
+    403: ApiErrorResponse;
+    /**
+     * No such resource is reachable for this caller. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    404: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A rate limit is exhausted. Honor `Retry-After`. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    429: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * An unexpected server-side failure. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    500: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A dependency is unavailable. Retryable. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    503: ManagedAgentsApiErrorBody | ApiErrorResponse;
+};
+export type GetManagedAgentsV1TagsByTagIdError = GetManagedAgentsV1TagsByTagIdErrors[keyof GetManagedAgentsV1TagsByTagIdErrors];
+export type GetManagedAgentsV1TagsByTagIdResponses = {
+    /**
+     * An organization-scoped classification definition. Applying or removing it changes only catalog membership: it does not update the agent, mint an AgentVersion, or affect running sessions.
+     */
+    200: ManagedAgentsTag;
+};
+export type GetManagedAgentsV1TagsByTagIdResponse = GetManagedAgentsV1TagsByTagIdResponses[keyof GetManagedAgentsV1TagsByTagIdResponses];
+export type PatchManagedAgentsV1TagsByTagIdData = {
+    body?: ManagedAgentsUpdateTagRequest;
+    path: {
+        /**
+         * Tag id (UUID) as returned by createTag or listTags.
+         */
+        tag_id: string;
+    };
+    query?: never;
+    url: '/managed-agents/v1/tags/{tag_id}';
+};
+export type PatchManagedAgentsV1TagsByTagIdErrors = {
+    /**
+     * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    400: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The caller is unauthenticated. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    401: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * Caller is missing a required permission, or the request scope (organization / environment / problem) does not resolve to the caller.
+     */
+    403: ApiErrorResponse;
+    /**
+     * No such resource is reachable for this caller. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    404: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The request conflicts with the resource state, or with an in-flight idempotent replay. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    409: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The request exceeds a size or transaction budget. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    413: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A rate limit is exhausted. Honor `Retry-After`. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    429: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * An unexpected server-side failure. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    500: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A dependency is unavailable. Retryable. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    503: ManagedAgentsApiErrorBody | ApiErrorResponse;
+};
+export type PatchManagedAgentsV1TagsByTagIdError = PatchManagedAgentsV1TagsByTagIdErrors[keyof PatchManagedAgentsV1TagsByTagIdErrors];
+export type PatchManagedAgentsV1TagsByTagIdResponses = {
+    /**
+     * An organization-scoped classification definition. Applying or removing it changes only catalog membership: it does not update the agent, mint an AgentVersion, or affect running sessions.
+     */
+    200: ManagedAgentsTag;
+};
+export type PatchManagedAgentsV1TagsByTagIdResponse = PatchManagedAgentsV1TagsByTagIdResponses[keyof PatchManagedAgentsV1TagsByTagIdResponses];
 export type GetManagedAgentsV1TriggerBindingsData = {
     body?: never;
     path?: never;
@@ -26844,7 +27479,7 @@ export type DeleteManagedAgentsV1TriggerBindingsByBindingIdErrors = {
 export type DeleteManagedAgentsV1TriggerBindingsByBindingIdError = DeleteManagedAgentsV1TriggerBindingsByBindingIdErrors[keyof DeleteManagedAgentsV1TriggerBindingsByBindingIdErrors];
 export type DeleteManagedAgentsV1TriggerBindingsByBindingIdResponses = {
     /**
-     * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
+     * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, tags, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
      */
     200: ManagedAgentsDeletedResponse;
 };
@@ -27042,7 +27677,7 @@ export type DeleteManagedAgentsV1VaultsByVaultIdErrors = {
 export type DeleteManagedAgentsV1VaultsByVaultIdError = DeleteManagedAgentsV1VaultsByVaultIdErrors[keyof DeleteManagedAgentsV1VaultsByVaultIdErrors];
 export type DeleteManagedAgentsV1VaultsByVaultIdResponses = {
     /**
-     * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
+     * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, tags, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
      */
     200: ManagedAgentsDeletedResponse;
 };
@@ -27311,7 +27946,7 @@ export type DeleteManagedAgentsV1VaultsByVaultIdCredentialsByCredentialIdErrors
 export type DeleteManagedAgentsV1VaultsByVaultIdCredentialsByCredentialIdError = DeleteManagedAgentsV1VaultsByVaultIdCredentialsByCredentialIdErrors[keyof DeleteManagedAgentsV1VaultsByVaultIdCredentialsByCredentialIdErrors];
 export type DeleteManagedAgentsV1VaultsByVaultIdCredentialsByCredentialIdResponses = {
     /**
-     * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
+     * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, tags, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
      */
     200: ManagedAgentsDeletedResponse;
 };