@labelbox/rl-sdk 0.0.147 → 0.0.148

package/dist/generated/types.gen.d.ts

@@ -7126,7 +7126,7 @@ export type LockProblemVersionDto = {
     };
 };
 /**
- * A configured agent: its model, system prompt, tool and MCP surface, and the vault defaults new sessions inherit. Mutating an agent mints a new immutable AgentVersion; a session records the version it ran.
+ * A configured agent: its versioned execution definition plus current mutable classification tags. Patching the execution definition mints a new immutable AgentVersion; applying tags does not. A session records the version it ran and never snapshots tags.
  */
 export type ManagedAgentsAgent = {
     /**
@@ -7206,6 +7206,10 @@ export type ManagedAgentsAgent = {
      * System prompt prepended to every conversation this agent runs.
      */
     system?: string;
+    /**
+     * Current organization-scoped classification tags applied to this agent. Always an array. Tags are mutable catalog metadata and are deliberately absent from AgentVersion and session runtime snapshots.
+     */
+    tags: Array<ManagedAgentsTag>;
     /**
      * Additional tool groups to enable, snapshotted into the session and passed to the execution runtime unchanged. This does NOT gate the sandbox tools: run_command, run_process, read_file and write_file are offered to every session with a sandbox whether or not this list mentions them, so a shell needs no entry here. The names a session actually offers the model are reported as config.available_builtin_tools on the started session -- read that rather than inferring the tool surface from this list.
      */
@@ -8247,6 +8251,23 @@ export type ManagedAgentsCreateEnvironmentRequest = {
      */
     stopped_delete_after_seconds?: number;
 };
+/**
+ * Request body for creating one organization-scoped tag definition. The organization always comes from the authenticated principal.
+ */
+export type ManagedAgentsCreateTagRequest = {
+    /**
+     * Display color in #RRGGBB form.
+     */
+    color: string;
+    /**
+     * Optional operator-facing explanation of this classification, up to 280 characters.
+     */
+    description?: string;
+    /**
+     * Display label. Leading and trailing whitespace is removed; the result must contain 1-32 characters and be unique case-insensitively among live tags in the organization.
+     */
+    label: string;
+};
 /**
  * Request body creating a Slack wake rule: the connection and event to match, and the agent, environment, and vaults a match runs with. Every referenced object must belong to the calling organization; GitHub events use provider-neutral automations instead.
  */
@@ -8376,7 +8397,7 @@ export type ManagedAgentsDefineOutcomeRequest = {
     rubric: string;
 };
 /**
- * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
+ * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, tags, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
  */
 export type ManagedAgentsDeletedResponse = {
     /**
@@ -10312,6 +10333,15 @@ export type ManagedAgentsReflectionListResponse = {
      */
     reflections?: unknown;
 };
+/**
+ * Request body for atomically replacing an agent's complete mutable tag classification.
+ */
+export type ManagedAgentsReplaceAgentTagsRequest = {
+    /**
+     * Complete replacement set of tag ids, with at most 32 distinct ids. Every id must be a live tag in the caller's organization. Duplicates are collapsed before enforcing the limit; [] removes every tag.
+     */
+    tag_ids: Array<string>;
+};
 /**
  * Structured input for manually starting an automation without a webhook delivery.
  */
@@ -11049,6 +11079,48 @@ export type ManagedAgentsStartSessionRequest = {
      */
     vault_ids?: Array<string>;
 };
+/**
+ * An organization-scoped classification definition. Applying or removing it changes only catalog membership: it does not update the agent, mint an AgentVersion, or affect running sessions.
+ */
+export type ManagedAgentsTag = {
+    /**
+     * Display color in #RRGGBB form.
+     */
+    color?: string;
+    /**
+     * Server-assigned RFC 3339 timestamp of when the tag was created.
+     */
+    created_at?: string;
+    /**
+     * Optional operator-facing explanation of the classification, up to 280 characters.
+     */
+    description?: string;
+    /**
+     * Display label, trimmed by the service. Unique case-insensitively among live tags in this organization.
+     */
+    label?: string;
+    /**
+     * Labelbox organization that owns the tag. Server-assigned from the authenticated principal and never accepted as authority from the request body.
+     */
+    organization_id?: string;
+    /**
+     * Server-assigned tag id (UUID).
+     */
+    tag_id?: string;
+    /**
+     * Server-assigned RFC 3339 timestamp of the most recent definition update.
+     */
+    updated_at?: string;
+};
+/**
+ * A complete set of organization-scoped tag definitions. GET /v1/tags returns the organization catalog; agent tag PUT routes return the agent's resulting exact set.
+ */
+export type ManagedAgentsTagListResponse = {
+    /**
+     * The complete live tag set for this response. Always an array; an empty array means no definitions exist or the agent has no classifications.
+     */
+    tags: Array<ManagedAgentsTag>;
+};
 /**
  * One tool or toolset enabled on an agent version, with its type-specific settings. Callers supply these when creating an agent version; the resulting session offers exactly the tools they declare.
  */
@@ -11209,6 +11281,117 @@ export type ManagedAgentsTriggerBindingListResponse = {
      */
     bindings?: unknown;
 };
+/**
+ * Partial update to an agent's versioned execution definition. Omitted fields keep their current values. Tags are changed only through the dedicated agent tag routes.
+ */
+export type ManagedAgentsUpdateAgentRequest = {
+    /**
+     * Server-assigned id of the agent, used in the agent, agent-version, and session routes.
+     */
+    agent_id?: string;
+    /**
+     * Server-assigned RFC 3339 timestamp of when the agent was created.
+     */
+    created_at?: string;
+    /**
+     * Caller-defined tools exposed to the model in addition to the built-in toolsets.
+     */
+    custom_tools?: unknown;
+    /**
+     * Narrows the default vaults to individual credentials. Every credential is selected when a vault is first added, and may then be unchecked.
+     */
+    default_credential_refs?: unknown;
+    /**
+     * Markdown rubric that sessions started from this agent are graded against when their create request omits an outcome. A session that supplies its own outcome ignores this entirely. Omit the field to keep the stored rubric; send an empty string to remove it.
+     */
+    default_rubric?: unknown;
+    /**
+     * Vaults whose credentials are copied into a new session when its create request omits vault_ids. Sending an explicit empty list on the session still overrides these.
+     */
+    default_vault_ids?: unknown;
+    /**
+     * Free-text note about what this agent is for.
+     */
+    description?: string;
+    /**
+     * Server-maintained id of the newest version of this agent; sessions started without an explicit version use it.
+     */
+    latest_agent_version_id?: string;
+    /**
+     * Remote MCP servers to attach. Each entry is an object with name (the label the server's tools are grouped under) and url (its http/https endpoint); any further keys are passed to the runtime unchanged. Credentials come from the vaults granted to the session, not from this entry. Tools are discovered and snapshotted at session start.
+     */
+    mcp_servers?: unknown;
+    /**
+     * Caller-owned key/value data stored with the agent and returned unchanged.
+     */
+    metadata?: {
+        [key: string]: unknown;
+    };
+    /**
+     * Model the agent runs on. Pass a gateway model id exactly as the gateway models catalog reports it, e.g. anthropic/claude-sonnet-4-5; it is stored prefixed as litellm:anthropic/claude-sonnet-4-5, which is the form the router reads and the form returned on reads. An explicitly provider-qualified string such as anthropic:claude-sonnet-4-5 selects a directly-configured provider instead and is left as written. An id the gateway does not serve is rejected here, not at the session's first turn.
+     */
+    model?: string;
+    model_config?: ManagedAgentsInferenceConfig;
+    /**
+     * Canonical model-reference id to run instead of a gateway model id, for fine-tuned or self-hosted models.
+     */
+    model_ref_id?: string;
+    /**
+     * Multi-agent orchestration settings, such as subagent definitions and delegation limits.
+     */
+    multiagent?: {
+        [key: string]: unknown;
+    };
+    /**
+     * Human-readable label shown wherever agents are listed. Not required to be unique.
+     */
+    name?: string;
+    /**
+     * Labelbox organization that owns the agent. Server-assigned from the caller's credentials; a value sent in a request body is ignored.
+     */
+    organization_id?: string;
+    /**
+     * Runtime adapter configurations that change how the harness executes turns; each entry is adapter-specific.
+     */
+    runtime_adapters?: unknown;
+    /**
+     * Skill packages loaded into the agent's runtime, each an entry with the skill reference and its metadata.
+     */
+    skills?: unknown;
+    /**
+     * System prompt prepended to every conversation this agent runs.
+     */
+    system?: string;
+    /**
+     * Additional tool groups to enable, snapshotted into the session and passed to the execution runtime unchanged. This does NOT gate the sandbox tools: run_command, run_process, read_file and write_file are offered to every session with a sandbox whether or not this list mentions them, so a shell needs no entry here. The names a session actually offers the model are reported as config.available_builtin_tools on the started session -- read that rather than inferring the tool surface from this list.
+     */
+    toolsets?: unknown;
+    /**
+     * Server-assigned RFC 3339 timestamp of the most recent update to the agent.
+     */
+    updated_at?: string;
+    /**
+     * Whether new sessions may use the native web_search tool. Omitted on legacy agents and interpreted as enabled.
+     */
+    web_search_enabled?: boolean;
+};
+/**
+ * Request body for changing a tag definition. Every field is optional and tag applications remain unchanged.
+ */
+export type ManagedAgentsUpdateTagRequest = {
+    /**
+     * Replacement display color in #RRGGBB form. Omit to keep the current color.
+     */
+    color?: string;
+    /**
+     * Replacement description. Send an empty string to clear it; omit to keep the current description.
+     */
+    description?: string;
+    /**
+     * Replacement display label. Leading and trailing whitespace is removed. Omit to keep the current label.
+     */
+    label?: string;
+};
 /**
  * Partial update of one trigger binding. Only the properties present in the request change; an omitted property keeps its stored value, so an explicit false or empty list is distinguishable from an omission. The merged binding is revalidated as a whole, which is what keeps a single-field edit from bypassing a provider or tenancy invariant.
  */
@@ -22756,7 +22939,12 @@ export type WorkspaceFileDownloadUrlResponseDto = {
 export type GetManagedAgentsV1AgentsData = {
     body?: never;
     path?: never;
-    query?: never;
+    query?: {
+        /**
+         * Comma-separated tag ids, with at most 32 distinct ids. Blank segments are ignored. An agent must carry every requested tag (AND semantics). Unknown or cross-organization ids return 404.
+         */
+        tag_ids?: string;
+    };
     url: '/managed-agents/v1/agents';
 };
 export type GetManagedAgentsV1AgentsErrors = {
@@ -22772,6 +22960,10 @@ export type GetManagedAgentsV1AgentsErrors = {
      * Caller is missing a required permission, or the request scope (organization / environment / problem) does not resolve to the caller.
      */
     403: ApiErrorResponse;
+    /**
+     * No such resource is reachable for this caller. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    404: ManagedAgentsApiErrorBody | ApiErrorResponse;
     /**
      * A rate limit is exhausted. Honor `Retry-After`. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
      */
@@ -22836,7 +23028,7 @@ export type PostManagedAgentsV1AgentsErrors = {
 export type PostManagedAgentsV1AgentsError = PostManagedAgentsV1AgentsErrors[keyof PostManagedAgentsV1AgentsErrors];
 export type PostManagedAgentsV1AgentsResponses = {
     /**
-     * A configured agent: its model, system prompt, tool and MCP surface, and the vault defaults new sessions inherit. Mutating an agent mints a new immutable AgentVersion; a session records the version it ran.
+     * A configured agent: its versioned execution definition plus current mutable classification tags. Patching the execution definition mints a new immutable AgentVersion; applying tags does not. A session records the version it ran and never snapshots tags.
      */
     200: ManagedAgentsAgent;
 };
@@ -22889,7 +23081,7 @@ export type DeleteManagedAgentsV1AgentsByAgentIdErrors = {
 export type DeleteManagedAgentsV1AgentsByAgentIdError = DeleteManagedAgentsV1AgentsByAgentIdErrors[keyof DeleteManagedAgentsV1AgentsByAgentIdErrors];
 export type DeleteManagedAgentsV1AgentsByAgentIdResponses = {
     /**
-     * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
+     * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, tags, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
      */
     200: ManagedAgentsDeletedResponse;
 };
@@ -22938,13 +23130,13 @@ export type GetManagedAgentsV1AgentsByAgentIdErrors = {
 export type GetManagedAgentsV1AgentsByAgentIdError = GetManagedAgentsV1AgentsByAgentIdErrors[keyof GetManagedAgentsV1AgentsByAgentIdErrors];
 export type GetManagedAgentsV1AgentsByAgentIdResponses = {
     /**
-     * A configured agent: its model, system prompt, tool and MCP surface, and the vault defaults new sessions inherit. Mutating an agent mints a new immutable AgentVersion; a session records the version it ran.
+     * A configured agent: its versioned execution definition plus current mutable classification tags. Patching the execution definition mints a new immutable AgentVersion; applying tags does not. A session records the version it ran and never snapshots tags.
      */
     200: ManagedAgentsAgent;
 };
 export type GetManagedAgentsV1AgentsByAgentIdResponse = GetManagedAgentsV1AgentsByAgentIdResponses[keyof GetManagedAgentsV1AgentsByAgentIdResponses];
 export type PatchManagedAgentsV1AgentsByAgentIdData = {
-    body?: ManagedAgentsAgent;
+    body?: ManagedAgentsUpdateAgentRequest;
     path: {
         /**
          * Agent id (UUID) as returned by createAgent or listAgents.
@@ -22995,7 +23187,7 @@ export type PatchManagedAgentsV1AgentsByAgentIdErrors = {
 export type PatchManagedAgentsV1AgentsByAgentIdError = PatchManagedAgentsV1AgentsByAgentIdErrors[keyof PatchManagedAgentsV1AgentsByAgentIdErrors];
 export type PatchManagedAgentsV1AgentsByAgentIdResponses = {
     /**
-     * A configured agent: its model, system prompt, tool and MCP surface, and the vault defaults new sessions inherit. Mutating an agent mints a new immutable AgentVersion; a session records the version it ran.
+     * A configured agent: its versioned execution definition plus current mutable classification tags. Patching the execution definition mints a new immutable AgentVersion; applying tags does not. A session records the version it ran and never snapshots tags.
      */
     200: ManagedAgentsAgent;
 };
@@ -23167,6 +23359,177 @@ export type PostManagedAgentsV1AgentsByAgentIdReflectionsResponses = {
     202: ManagedAgentsReflection;
 };
 export type PostManagedAgentsV1AgentsByAgentIdReflectionsResponse = PostManagedAgentsV1AgentsByAgentIdReflectionsResponses[keyof PostManagedAgentsV1AgentsByAgentIdReflectionsResponses];
+export type PutManagedAgentsV1AgentsByAgentIdTagsData = {
+    body?: ManagedAgentsReplaceAgentTagsRequest;
+    path: {
+        /**
+         * Agent id (UUID) whose classifications are replaced.
+         */
+        agent_id: string;
+    };
+    query?: never;
+    url: '/managed-agents/v1/agents/{agent_id}/tags';
+};
+export type PutManagedAgentsV1AgentsByAgentIdTagsErrors = {
+    /**
+     * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    400: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The caller is unauthenticated. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    401: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * Caller is missing a required permission, or the request scope (organization / environment / problem) does not resolve to the caller.
+     */
+    403: ApiErrorResponse;
+    /**
+     * No such resource is reachable for this caller. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    404: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The request conflicts with the resource state, or with an in-flight idempotent replay. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    409: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The request exceeds a size or transaction budget. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    413: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A rate limit is exhausted. Honor `Retry-After`. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    429: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * An unexpected server-side failure. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    500: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A dependency is unavailable. Retryable. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    503: ManagedAgentsApiErrorBody | ApiErrorResponse;
+};
+export type PutManagedAgentsV1AgentsByAgentIdTagsError = PutManagedAgentsV1AgentsByAgentIdTagsErrors[keyof PutManagedAgentsV1AgentsByAgentIdTagsErrors];
+export type PutManagedAgentsV1AgentsByAgentIdTagsResponses = {
+    /**
+     * A complete set of organization-scoped tag definitions. GET /v1/tags returns the organization catalog; agent tag PUT routes return the agent's resulting exact set.
+     */
+    200: ManagedAgentsTagListResponse;
+};
+export type PutManagedAgentsV1AgentsByAgentIdTagsResponse = PutManagedAgentsV1AgentsByAgentIdTagsResponses[keyof PutManagedAgentsV1AgentsByAgentIdTagsResponses];
+export type DeleteManagedAgentsV1AgentsByAgentIdTagsByTagIdData = {
+    body?: never;
+    path: {
+        /**
+         * Agent id (UUID) as returned by createAgent or listAgents.
+         */
+        agent_id: string;
+        /**
+         * Tag id (UUID) as returned by createTag or listTags.
+         */
+        tag_id: string;
+    };
+    query?: never;
+    url: '/managed-agents/v1/agents/{agent_id}/tags/{tag_id}';
+};
+export type DeleteManagedAgentsV1AgentsByAgentIdTagsByTagIdErrors = {
+    /**
+     * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    400: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The caller is unauthenticated. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    401: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * Caller is missing a required permission, or the request scope (organization / environment / problem) does not resolve to the caller.
+     */
+    403: ApiErrorResponse;
+    /**
+     * No such resource is reachable for this caller. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    404: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The request conflicts with the resource state, or with an in-flight idempotent replay. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    409: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A rate limit is exhausted. Honor `Retry-After`. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    429: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * An unexpected server-side failure. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    500: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A dependency is unavailable. Retryable. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    503: ManagedAgentsApiErrorBody | ApiErrorResponse;
+};
+export type DeleteManagedAgentsV1AgentsByAgentIdTagsByTagIdError = DeleteManagedAgentsV1AgentsByAgentIdTagsByTagIdErrors[keyof DeleteManagedAgentsV1AgentsByAgentIdTagsByTagIdErrors];
+export type DeleteManagedAgentsV1AgentsByAgentIdTagsByTagIdResponses = {
+    /**
+     * No Content
+     */
+    204: void;
+};
+export type DeleteManagedAgentsV1AgentsByAgentIdTagsByTagIdResponse = DeleteManagedAgentsV1AgentsByAgentIdTagsByTagIdResponses[keyof DeleteManagedAgentsV1AgentsByAgentIdTagsByTagIdResponses];
+export type PutManagedAgentsV1AgentsByAgentIdTagsByTagIdData = {
+    body?: never;
+    path: {
+        /**
+         * Agent id (UUID) as returned by createAgent or listAgents.
+         */
+        agent_id: string;
+        /**
+         * Tag id (UUID) as returned by createTag or listTags.
+         */
+        tag_id: string;
+    };
+    query?: never;
+    url: '/managed-agents/v1/agents/{agent_id}/tags/{tag_id}';
+};
+export type PutManagedAgentsV1AgentsByAgentIdTagsByTagIdErrors = {
+    /**
+     * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    400: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The caller is unauthenticated. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    401: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * Caller is missing a required permission, or the request scope (organization / environment / problem) does not resolve to the caller.
+     */
+    403: ApiErrorResponse;
+    /**
+     * No such resource is reachable for this caller. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    404: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The request conflicts with the resource state, or with an in-flight idempotent replay. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    409: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A rate limit is exhausted. Honor `Retry-After`. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    429: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * An unexpected server-side failure. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    500: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A dependency is unavailable. Retryable. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    503: ManagedAgentsApiErrorBody | ApiErrorResponse;
+};
+export type PutManagedAgentsV1AgentsByAgentIdTagsByTagIdError = PutManagedAgentsV1AgentsByAgentIdTagsByTagIdErrors[keyof PutManagedAgentsV1AgentsByAgentIdTagsByTagIdErrors];
+export type PutManagedAgentsV1AgentsByAgentIdTagsByTagIdResponses = {
+    /**
+     * A complete set of organization-scoped tag definitions. GET /v1/tags returns the organization catalog; agent tag PUT routes return the agent's resulting exact set.
+     */
+    200: ManagedAgentsTagListResponse;
+};
+export type PutManagedAgentsV1AgentsByAgentIdTagsByTagIdResponse = PutManagedAgentsV1AgentsByAgentIdTagsByTagIdResponses[keyof PutManagedAgentsV1AgentsByAgentIdTagsByTagIdResponses];
 export type GetManagedAgentsV1AgentsByAgentIdVersionsData = {
     body?: never;
     path: {
@@ -23835,7 +24198,7 @@ export type DeleteManagedAgentsV1EnvironmentsByEnvironmentIdErrors = {
 export type DeleteManagedAgentsV1EnvironmentsByEnvironmentIdError = DeleteManagedAgentsV1EnvironmentsByEnvironmentIdErrors[keyof DeleteManagedAgentsV1EnvironmentsByEnvironmentIdErrors];
 export type DeleteManagedAgentsV1EnvironmentsByEnvironmentIdResponses = {
     /**
-     * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
+     * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, tags, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
      */
     200: ManagedAgentsDeletedResponse;
 };
@@ -25402,6 +25765,10 @@ export type GetManagedAgentsV1SessionsData = {
          * Filter by agent id.
          */
         agent_id?: string;
+        /**
+         * Comma-separated current agent tag ids, with at most 32 distinct ids. A session row's agent must carry every requested tag (AND semantics). Unknown or cross-organization ids return 404. Tags are resolved at read time, not from the session snapshot.
+         */
+        tag_ids?: string;
         external_source_type?: string;
         external_source_id?: string;
         /**
@@ -25425,6 +25792,10 @@ export type GetManagedAgentsV1SessionsErrors = {
      * Caller is missing a required permission, or the request scope (organization / environment / problem) does not resolve to the caller.
      */
     403: ApiErrorResponse;
+    /**
+     * No such resource is reachable for this caller. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    404: ManagedAgentsApiErrorBody | ApiErrorResponse;
     /**
      * A rate limit is exhausted. Honor `Retry-After`. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
      */
@@ -25642,7 +26013,7 @@ export type DeleteManagedAgentsV1SessionsBySessionIdErrors = {
 export type DeleteManagedAgentsV1SessionsBySessionIdError = DeleteManagedAgentsV1SessionsBySessionIdErrors[keyof DeleteManagedAgentsV1SessionsBySessionIdErrors];
 export type DeleteManagedAgentsV1SessionsBySessionIdResponses = {
     /**
-     * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
+     * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, tags, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
      */
     200: ManagedAgentsDeletedResponse;
 };
@@ -26507,7 +26878,7 @@ export type DeleteManagedAgentsV1SkillsBySkillIdErrors = {
 export type DeleteManagedAgentsV1SkillsBySkillIdError = DeleteManagedAgentsV1SkillsBySkillIdErrors[keyof DeleteManagedAgentsV1SkillsBySkillIdErrors];
 export type DeleteManagedAgentsV1SkillsBySkillIdResponses = {
     /**
-     * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
+     * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, tags, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
      */
     200: ManagedAgentsDeletedResponse;
 };
@@ -26720,6 +27091,253 @@ export type GetManagedAgentsV1SkillsBySkillIdVersionsBySkillVersionIdResponses =
     200: ManagedAgentsSkillVersion;
 };
 export type GetManagedAgentsV1SkillsBySkillIdVersionsBySkillVersionIdResponse = GetManagedAgentsV1SkillsBySkillIdVersionsBySkillVersionIdResponses[keyof GetManagedAgentsV1SkillsBySkillIdVersionsBySkillVersionIdResponses];
+export type GetManagedAgentsV1TagsData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/managed-agents/v1/tags';
+};
+export type GetManagedAgentsV1TagsErrors = {
+    /**
+     * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    400: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The caller is unauthenticated. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    401: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * Caller is missing a required permission, or the request scope (organization / environment / problem) does not resolve to the caller.
+     */
+    403: ApiErrorResponse;
+    /**
+     * A rate limit is exhausted. Honor `Retry-After`. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    429: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * An unexpected server-side failure. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    500: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A dependency is unavailable. Retryable. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    503: ManagedAgentsApiErrorBody | ApiErrorResponse;
+};
+export type GetManagedAgentsV1TagsError = GetManagedAgentsV1TagsErrors[keyof GetManagedAgentsV1TagsErrors];
+export type GetManagedAgentsV1TagsResponses = {
+    /**
+     * A complete set of organization-scoped tag definitions. GET /v1/tags returns the organization catalog; agent tag PUT routes return the agent's resulting exact set.
+     */
+    200: ManagedAgentsTagListResponse;
+};
+export type GetManagedAgentsV1TagsResponse = GetManagedAgentsV1TagsResponses[keyof GetManagedAgentsV1TagsResponses];
+export type PostManagedAgentsV1TagsData = {
+    body?: ManagedAgentsCreateTagRequest;
+    path?: never;
+    query?: never;
+    url: '/managed-agents/v1/tags';
+};
+export type PostManagedAgentsV1TagsErrors = {
+    /**
+     * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    400: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The caller is unauthenticated. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    401: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * Caller is missing a required permission, or the request scope (organization / environment / problem) does not resolve to the caller.
+     */
+    403: ApiErrorResponse;
+    /**
+     * The request conflicts with the resource state, or with an in-flight idempotent replay. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    409: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The request exceeds a size or transaction budget. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    413: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A rate limit is exhausted. Honor `Retry-After`. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    429: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * An unexpected server-side failure. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    500: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A dependency is unavailable. Retryable. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    503: ManagedAgentsApiErrorBody | ApiErrorResponse;
+};
+export type PostManagedAgentsV1TagsError = PostManagedAgentsV1TagsErrors[keyof PostManagedAgentsV1TagsErrors];
+export type PostManagedAgentsV1TagsResponses = {
+    /**
+     * An organization-scoped classification definition. Applying or removing it changes only catalog membership: it does not update the agent, mint an AgentVersion, or affect running sessions.
+     */
+    200: ManagedAgentsTag;
+};
+export type PostManagedAgentsV1TagsResponse = PostManagedAgentsV1TagsResponses[keyof PostManagedAgentsV1TagsResponses];
+export type DeleteManagedAgentsV1TagsByTagIdData = {
+    body?: never;
+    path: {
+        /**
+         * Tag id (UUID) as returned by createTag or listTags.
+         */
+        tag_id: string;
+    };
+    query?: never;
+    url: '/managed-agents/v1/tags/{tag_id}';
+};
+export type DeleteManagedAgentsV1TagsByTagIdErrors = {
+    /**
+     * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    400: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The caller is unauthenticated. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    401: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * Caller is missing a required permission, or the request scope (organization / environment / problem) does not resolve to the caller.
+     */
+    403: ApiErrorResponse;
+    /**
+     * No such resource is reachable for this caller. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    404: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The request conflicts with the resource state, or with an in-flight idempotent replay. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    409: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A rate limit is exhausted. Honor `Retry-After`. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    429: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * An unexpected server-side failure. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    500: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A dependency is unavailable. Retryable. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    503: ManagedAgentsApiErrorBody | ApiErrorResponse;
+};
+export type DeleteManagedAgentsV1TagsByTagIdError = DeleteManagedAgentsV1TagsByTagIdErrors[keyof DeleteManagedAgentsV1TagsByTagIdErrors];
+export type DeleteManagedAgentsV1TagsByTagIdResponses = {
+    /**
+     * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, tags, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
+     */
+    200: ManagedAgentsDeletedResponse;
+};
+export type DeleteManagedAgentsV1TagsByTagIdResponse = DeleteManagedAgentsV1TagsByTagIdResponses[keyof DeleteManagedAgentsV1TagsByTagIdResponses];
+export type GetManagedAgentsV1TagsByTagIdData = {
+    body?: never;
+    path: {
+        /**
+         * Tag id (UUID) as returned by createTag or listTags.
+         */
+        tag_id: string;
+    };
+    query?: never;
+    url: '/managed-agents/v1/tags/{tag_id}';
+};
+export type GetManagedAgentsV1TagsByTagIdErrors = {
+    /**
+     * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    400: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The caller is unauthenticated. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    401: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * Caller is missing a required permission, or the request scope (organization / environment / problem) does not resolve to the caller.
+     */
+    403: ApiErrorResponse;
+    /**
+     * No such resource is reachable for this caller. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    404: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A rate limit is exhausted. Honor `Retry-After`. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    429: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * An unexpected server-side failure. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    500: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A dependency is unavailable. Retryable. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    503: ManagedAgentsApiErrorBody | ApiErrorResponse;
+};
+export type GetManagedAgentsV1TagsByTagIdError = GetManagedAgentsV1TagsByTagIdErrors[keyof GetManagedAgentsV1TagsByTagIdErrors];
+export type GetManagedAgentsV1TagsByTagIdResponses = {
+    /**
+     * An organization-scoped classification definition. Applying or removing it changes only catalog membership: it does not update the agent, mint an AgentVersion, or affect running sessions.
+     */
+    200: ManagedAgentsTag;
+};
+export type GetManagedAgentsV1TagsByTagIdResponse = GetManagedAgentsV1TagsByTagIdResponses[keyof GetManagedAgentsV1TagsByTagIdResponses];
+export type PatchManagedAgentsV1TagsByTagIdData = {
+    body?: ManagedAgentsUpdateTagRequest;
+    path: {
+        /**
+         * Tag id (UUID) as returned by createTag or listTags.
+         */
+        tag_id: string;
+    };
+    query?: never;
+    url: '/managed-agents/v1/tags/{tag_id}';
+};
+export type PatchManagedAgentsV1TagsByTagIdErrors = {
+    /**
+     * The request was rejected by schema or semantic validation. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    400: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The caller is unauthenticated. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    401: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * Caller is missing a required permission, or the request scope (organization / environment / problem) does not resolve to the caller.
+     */
+    403: ApiErrorResponse;
+    /**
+     * No such resource is reachable for this caller. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    404: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The request conflicts with the resource state, or with an in-flight idempotent replay. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    409: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * The request exceeds a size or transaction budget. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    413: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A rate limit is exhausted. Honor `Retry-After`. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    429: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * An unexpected server-side failure. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    500: ManagedAgentsApiErrorBody | ApiErrorResponse;
+    /**
+     * A dependency is unavailable. Retryable. Carries the managed-agents envelope (`error.code` is the stable, machine-readable contract) when the request reached the service, or the platform envelope when this API rejected it before forwarding.
+     */
+    503: ManagedAgentsApiErrorBody | ApiErrorResponse;
+};
+export type PatchManagedAgentsV1TagsByTagIdError = PatchManagedAgentsV1TagsByTagIdErrors[keyof PatchManagedAgentsV1TagsByTagIdErrors];
+export type PatchManagedAgentsV1TagsByTagIdResponses = {
+    /**
+     * An organization-scoped classification definition. Applying or removing it changes only catalog membership: it does not update the agent, mint an AgentVersion, or affect running sessions.
+     */
+    200: ManagedAgentsTag;
+};
+export type PatchManagedAgentsV1TagsByTagIdResponse = PatchManagedAgentsV1TagsByTagIdResponses[keyof PatchManagedAgentsV1TagsByTagIdResponses];
 export type GetManagedAgentsV1TriggerBindingsData = {
     body?: never;
     path?: never;
@@ -26861,7 +27479,7 @@ export type DeleteManagedAgentsV1TriggerBindingsByBindingIdErrors = {
 export type DeleteManagedAgentsV1TriggerBindingsByBindingIdError = DeleteManagedAgentsV1TriggerBindingsByBindingIdErrors[keyof DeleteManagedAgentsV1TriggerBindingsByBindingIdErrors];
 export type DeleteManagedAgentsV1TriggerBindingsByBindingIdResponses = {
     /**
-     * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
+     * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, tags, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
      */
     200: ManagedAgentsDeletedResponse;
 };
@@ -27059,7 +27677,7 @@ export type DeleteManagedAgentsV1VaultsByVaultIdErrors = {
 export type DeleteManagedAgentsV1VaultsByVaultIdError = DeleteManagedAgentsV1VaultsByVaultIdErrors[keyof DeleteManagedAgentsV1VaultsByVaultIdErrors];
 export type DeleteManagedAgentsV1VaultsByVaultIdResponses = {
     /**
-     * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
+     * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, tags, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
      */
     200: ManagedAgentsDeletedResponse;
 };
@@ -27328,7 +27946,7 @@ export type DeleteManagedAgentsV1VaultsByVaultIdCredentialsByCredentialIdErrors
 export type DeleteManagedAgentsV1VaultsByVaultIdCredentialsByCredentialIdError = DeleteManagedAgentsV1VaultsByVaultIdCredentialsByCredentialIdErrors[keyof DeleteManagedAgentsV1VaultsByVaultIdCredentialsByCredentialIdErrors];
 export type DeleteManagedAgentsV1VaultsByVaultIdCredentialsByCredentialIdResponses = {
     /**
-     * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
+     * Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, tags, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.
      */
     200: ManagedAgentsDeletedResponse;
 };