@permute/sdk 0.9.0 → 0.10.0

package/README.md

@@ -20,6 +20,18 @@ bunx @permute/sdk auth logout
 
 Choose an organization, optionally limit the connection to one workspace, then select resources and permissions to approve in Permute. The CLI stores renewable credentials in your operating system’s credential store (no plaintext fallback). Active logins have no fixed maximum lifetime and expire after 30 days without renewal; company sign-in rules can require earlier authentication. Logging out revokes access before removing the local credential. Signing in again revokes the previous stored CLI session.
 
+To request a particular scope, add `--organization ID`, `--workspace ID`, or `--access-file PATH` to login. The JSON file uses the same resource/permission selections as API-key creation:
+
+```json
+{
+  "organizationId": "org_...",
+  "workspaceId": "wksp_...",
+  "permissions": [{ "resourceId": "dbas_...", "resourceType": "database", "level": "read" }]
+}
+```
+
+An SDK login can supply the same object as `new OAuthLogin({ requestedAccess })` before calling `beginDevice()` or `beginBrowser(...)`. The browser prefills the request and permits only narrower selections. When available in the same browser, reauthentication recalls settings from a prior session. Each login still requires confirmation, and current resource permissions apply (saved selections create no resource grants). The browser stores only a non-secret session ID; it does not create another grant or change existing sessions. Logout and Connections disconnect individual logins.
+
 The SDK reuses credentials in memory between requests and reloads the OS store before renewal or when another process changes the saved login. The local auth directory holds only a lock and a non-secret change marker; tokens stay out of ordinary files. Current server permissions and revocation still apply to every request.
 
 The CLI prints the issuer and `permute-cli` entry name to stderr before accessing the OS store. macOS controls its own permission dialog, which may identify the Node or Bun process. SDK applications stay silent by default and can supply `onCredentialStoreAccess: (issuer) => { /* show a notice */ }` to `OAuthLogin`; the callback runs once before the default OS store is accessed and receives no credentials.
@@ -130,8 +142,9 @@ Data Flow and operation authoring are REST/SDK only. MCP does not expose their c
 editing, draft inspection, execution, or publication. Hosted MCP access uses
 selected sources or a hosted app's current grants and published action bindings,
 intersected with the user's permissions. App actions require confirmation in
-Permute; see the [MCP guide](https://permute.ai/docs/mcp). Flow scheduling and
-standalone operation creation are not part of this surface.
+Permute; see the [MCP guide](https://permute.ai/docs/mcp). MCP does not expose flow
+scheduling or standalone operation creation; schedule operations and flows with
+`client.operations.update`.
 
 ## Publish write syncs
 
@@ -881,7 +894,8 @@ account’s access even when the caller has no connector access. Permute enforce
 declared execution capabilities and validates input/output schemas; the handler
 defines the operation exposed to callers.
 
-Handlers receive trusted `caller: { id, type }` (`type` is `user` or `apiKey`).
+Handlers receive trusted `caller: { id, type }` (`type` is `user`, `apiKey`, or
+`system`; a scheduled trigger run passes `{ type: 'system', id: '<triggerId>' }`).
 An action can use that identity and server-side business data to check or deny a
 request when its rules warrant it (such as an ownership rule or allowed state transition).
 Apply those checks before the affected reads or writes. They supplement the
@@ -996,6 +1010,49 @@ replay saved responses. Steps with uncertain outcomes block automatic resend and
 provider-state reconciliation. There is no automatic rollback, reconciliation API, or
 long-running workflow runner. Connector-only actions can use `sources: []`.
 
+### Schedule triggers
+
+A trigger invokes a published action automatically. Schedule triggers use the same UTC
+schedule format as operations and a fixed input which must match the published input contract.
+Schedule values are whole numbers: `hourly { minute }`, `daily { hour, minute }`,
+`weekly { hour, minute, dayOfWeek }` (0 is Sunday), and `monthly { hour, minute, dayOfMonth }`.
+Use `dayOfMonth` 1–28 to run in every month.
+
+```ts
+const trigger = await client.actionTriggers.create('actn_example', {
+  type: 'schedule',
+  config: { schedule: { type: 'daily', hour: 9, minute: 0 }, input: { region: 'EMEA' } },
+});
+await client.actionTriggers.update('actn_example', trigger.id, { isEnabled: false });
+const { items } = await client.actionTriggers.runs('actn_example', trigger.id);
+```
+
+Trigger routes require API key authentication. A trigger has no owner and runs as the workspace
+system identity, so its runs do not recheck anyone's access. Instead, creating, editing, or enabling a
+trigger requires invocation permission and authority to delegate every capability which the action
+declares (SDK permissions, connectors, and sources), and publishing an action with an enabled trigger
+requires the publisher to be able to invoke the new revision. Every reader of the action can see its
+triggers, and invokers can change them. Scheduled runs pass `caller: { type: 'system', id: '<triggerId>' }`.
+Resources which a scheduled run creates through the SDK belong to the action owner (the user who
+created the action, or the user who created its API key); scheduled runs cannot create or delete
+hosted resources (managed databases and apps) or create connector sessions. Each run uses the action's current published revision and the
+request ID `<triggerId>_<slot epoch ms>`, so a retried slot never runs twice. Runs start within about
+five minutes of their slot. Missed slots run once, as the newest missed slot, and the skipped
+slots appear as a `businessAction.trigger.skipped` audit event. A deleted or
+unpublished action, or input which no longer matches the contract, disables the trigger and
+sets `disabledReason`; enable it again with `update` after fixing the cause. A slot which cannot
+start for 24 hours, for example because of a persistent platform error, also disables the trigger.
+Publishing a new action revision does not check trigger input; an incompatible trigger turns
+off at its next run. A disable records no run, so read `isEnabled` and `disabledReason`; `nextRunAt`
+is `null` while the trigger is off. Updating `config` replaces the whole config and repeats the
+access and input checks, like enabling. Pausing with `isEnabled: false` keeps `disabledReason` `null`.
+`runs` returns the newest 50 runs with status, revision, and failure, but not their output; to keep a
+run's results, write them inside the handler. Saved receipts belong to their caller, so invoking with a
+run's request ID runs the action again.
+Failures inside the action do not disable the trigger and are not retried; the next slot runs as
+scheduled. They appear in `runs`, as `lastRun` on the trigger, and as a
+`businessAction.trigger.failed` audit event.
+
 ## Hosted app visitor access (next release)
 
 App admins can read `client.apps.access(appId)` and update access with

package/dist/auth/oauth.d.ts

@@ -1,3 +1,5 @@
+import { type RequestedAccess } from './request.js';
+export type { RequestedAccess } from './request.js';
 import { PermuteClient } from '../client.js';
 import { type CredentialStore, type LoginCredentials } from './store.js';
 export { SystemCredentialStore, type CredentialStore, type LoginCredentials } from './store.js';
@@ -6,6 +8,7 @@ export declare const DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_cod
 export interface OAuthOptions {
     issuer?: string;
     apiUrl?: string;
+    requestedAccess?: RequestedAccess;
     store?: CredentialStore;
     fetch?: typeof fetch;
     /** Called once before the default OS credential store is accessed; no tokens are passed. */
@@ -16,6 +19,7 @@ export declare class OAuthLogin {
     readonly apiUrl: string;
     private readonly store;
     private readonly fetchImpl;
+    private readonly requested;
     constructor(options?: OAuthOptions);
     private endpoint;
     private post;

package/dist/auth/oauth.js

@@ -1,3 +1,4 @@
+import { authorizationDetails } from './request.js';
 import { z } from 'zod';
 import { createHash, randomBytes } from 'node:crypto';
 import { setTimeout } from 'node:timers/promises';
@@ -27,11 +28,13 @@ export class OAuthLogin {
     apiUrl;
     store;
     fetchImpl;
+    requested;
     constructor(options = {}) {
         this.issuer = this.endpoint(options.issuer ?? DEFAULT_ISSUER);
         this.apiUrl = this.endpoint(options.apiUrl ?? 'https://api.permute.ai');
         this.store = options.store ?? new SystemCredentialStore(this.issuer, options.onCredentialStoreAccess);
         this.fetchImpl = options.fetch ?? fetch;
+        this.requested = authorizationDetails(options.requestedAccess);
     }
     endpoint(value) {
         const url = new URL(value);
@@ -90,7 +93,7 @@ export class OAuthLogin {
         return credentials;
     }
     async beginDevice() {
-        const parsed = DeviceSchema.safeParse(await this.post('/cli/device/authorization', { client_id: CLIENT_ID, scope: 'workspace' }));
+        const parsed = DeviceSchema.safeParse(await this.post('/cli/device/authorization', { client_id: CLIENT_ID, scope: 'workspace', ...this.requested }));
         if (!parsed.success)
             throw new Error('Invalid device login response');
         const result = parsed.data;
@@ -139,6 +142,7 @@ export class OAuthLogin {
         url.search = new URLSearchParams({
             client_id: CLIENT_ID,
             scope: 'workspace',
+            ...this.requested,
             response_type: 'code',
             redirect_uri: redirectURI,
             state,

package/dist/auth/request.d.ts

@@ -0,0 +1,24 @@
+import { z } from 'zod';
+import type { components } from '../generated/openapi.js';
+export type RequestedAccess = components['schemas']['OAuthRequestedAccess'];
+export declare const RequestedAccessSchema: z.ZodCustom<{
+    organizationId?: string;
+    permissions?: {
+        level: 'read' | 'write' | 'admin';
+        operations?: ('application.read_metadata' | 'application.update_metadata' | 'application.read_implementation' | 'application.update_draft' | 'application.publish' | 'application.manage_access' | 'application.manage_hosting' | 'application.delete' | 'business_action.read_metadata' | 'business_action.invoke' | 'business_action.read_implementation' | 'business_action.update_draft' | 'business_action.publish' | 'business_action.manage_access' | 'business_action.delegate_access' | 'business_action.delete')[];
+        resourceId: string;
+        resourceType: string;
+    }[];
+    workspaceId?: string;
+}, {
+    organizationId?: string;
+    permissions?: {
+        level: 'read' | 'write' | 'admin';
+        operations?: ('application.read_metadata' | 'application.update_metadata' | 'application.read_implementation' | 'application.update_draft' | 'application.publish' | 'application.manage_access' | 'application.manage_hosting' | 'application.delete' | 'business_action.read_metadata' | 'business_action.invoke' | 'business_action.read_implementation' | 'business_action.update_draft' | 'business_action.publish' | 'business_action.manage_access' | 'business_action.delegate_access' | 'business_action.delete')[];
+        resourceId: string;
+        resourceType: string;
+    }[];
+    workspaceId?: string;
+}>;
+/** RFC 9396 carries structured permissions without inventing a second operation catalog. */
+export declare function authorizationDetails(request: RequestedAccess | undefined): Record<string, string>;

package/dist/auth/request.js

@@ -0,0 +1,15 @@
+import { Ajv } from 'ajv';
+import { z } from 'zod';
+import { authorizationRequestSchema } from '../generated/runtime-contract.js';
+const validate = new Ajv({ strict: false }).compile(authorizationRequestSchema);
+export const RequestedAccessSchema = z.custom((value) => validate(value), 'Invalid requested access');
+/** RFC 9396 carries structured permissions without inventing a second operation catalog. */
+export function authorizationDetails(request) {
+    if (!request)
+        return {};
+    return {
+        authorization_details: JSON.stringify([
+            { type: 'https://permute.ai/permissions', ...RequestedAccessSchema.parse(request) },
+        ]),
+    };
+}

package/dist/cli.js

@@ -1,4 +1,6 @@
 #!/usr/bin/env node
+import { readFile } from 'node:fs/promises';
+import { RequestedAccessSchema } from './auth/request.js';
 import { createServer } from 'node:http';
 import { spawn } from 'node:child_process';
 import { parseArgs } from 'node:util';
@@ -75,6 +77,9 @@ export async function runCli(args = process.argv.slice(2)) {
         allowPositionals: true,
         options: {
             issuer: { type: 'string' },
+            'access-file': { type: 'string' },
+            organization: { type: 'string' },
+            workspace: { type: 'string' },
             'api-url': { type: 'string' },
             'device-code': { type: 'boolean' },
             'no-browser': { type: 'boolean' },
@@ -83,14 +88,21 @@ export async function runCli(args = process.argv.slice(2)) {
     });
     const [area, command] = positionals;
     if (values.help || area !== 'auth' || !['login', 'logout', 'status'].includes(command ?? '')) {
-        console.log('permute auth login [--device-code] [--no-browser]\npermute auth status\npermute auth logout\n\nUse --issuer and --api-url together for a development environment.');
+        console.log('permute auth login [--device-code] [--no-browser] [--organization ID] [--workspace ID] [--access-file PATH]\npermute auth status\npermute auth logout\n\nUse --issuer and --api-url together for a development environment.');
         if (!values.help)
             process.exitCode = 1;
         return;
     }
     if (!!values.issuer !== !!values['api-url'])
         throw new Error('Provide both --issuer and --api-url for another environment.');
+    const requestedAccess = {
+        ...(values['access-file'] &&
+            RequestedAccessSchema.parse(JSON.parse(await readFile(values['access-file'], 'utf8')))),
+        ...(values.organization && { organizationId: values.organization }),
+        ...(values.workspace && { workspaceId: values.workspace }),
+    };
     const login = new OAuthLogin({
+        ...(Object.keys(requestedAccess).length > 0 && { requestedAccess }),
         issuer: values.issuer,
         apiUrl: values['api-url'],
         onCredentialStoreAccess: (issuer) => {

package/dist/client.d.ts

@@ -1,6 +1,6 @@
-import type { EmailSender, EmailSendRequest, EmailReceipt, PermissionGrant, PermissionGrantInput, PermissionGrantUpdate, PermissionGrantQuery, PermissionGrantList, PermissionGrantRevoked, PermissionInspectionInput, PermissionInspection, AccessRequest, AccessRequestInput, AccessRequestQuery, AccessRequestList, AccessRequestDecision } from './types.js';
+import type { EmailSender, EmailSendRequest, EmailReceipt, PermissionGrant, PermissionGrantInput, PermissionGrantUpdate, PermissionGrantQuery, PermissionGrantList, PermissionGrantRevoked, PermissionInspectionInput, PermissionInspection, AccessRequest, AccessRequestInput, AccessRequestQuery, AccessRequestList, AccessRequestDecision, MemberList, OrganizationMemberInvite, WorkspaceMemberInvite, OrganizationMemberRoleUpdate, WorkspaceMemberRoleUpdate, MemberInvitation, MemberInvitationDelivery, MemberRoleUpdated, MemberRemoved, Organization, OrganizationList } from './types.js';
 export { PermuteApiError } from './errors.js';
-import type { BusinessAction, BusinessActionDetail, BusinessActionList, ActionCreateRequest, ActionDefinition, ActionDefinitionSaveRequest, ActionDefinitionSaved, ActionRequest, ActionReceipt, ActionPublicationRequest, ActionPublicationRequestInput, ActionPublicationRequestList, ActionPublicationDecision } from './types.js';
+import type { BusinessAction, BusinessActionDetail, BusinessActionList, ActionCreateRequest, ActionDefinition, ActionDefinitionSaveRequest, ActionDefinitionSaved, ActionRequest, ActionReceipt, ActionTrigger, ActionTriggerList, ActionTriggerCreateRequest, ActionTriggerUpdateRequest, ActionTriggerRunList, ActionPublicationRequest, ActionPublicationRequestInput, ActionPublicationRequestList, ActionPublicationDecision } from './types.js';
 import type { ConnectorSession, ConnectorSessionCreated, ConnectorSessionCreateRequest, Database, AppPublicationRequest, AppPublicationRequestInput, AppPublicationRequestList, AppPublicationDecision, AppDraft, AppAccess, AppAddressSettings, AppAddressSetRequest, AppAccessSetRequest, AppDraftList, AppCreateRequest, AppUpdateRequest, AppDeleted, AppUploadsRequest, AppUploads, AppSiteSaveRequest, AppSourceFileQuery, AppSourceFileContent, AppGrants, AppGrantSetRequest, AppUploadFile, DatabaseList, DatabaseCreateRequest, DatabaseDefinition, DatabaseDefinitionSaveRequest, DatabaseDefinitionSaved, DatabaseTables, DatabaseTableCreateRequest, DatabaseTableCreated, DatabaseRecords, DatabaseRecordsQuery, DatabaseTransactionRequest, DatabaseTransactionReceipt, WriteSync, WriteSyncCreateRequest, WriteSyncUpdateRequest, WriteSyncDetail, WriteSyncList, WriteSyncDeleted, WriteSyncDestinations, WriteSyncRun, WriteSyncRunList, WriteSyncRunQuery, WriteSyncExecution, ResourceVersionState, ResourceRevisionList, ResourceRevision, ResourceVersionRequest, ResourcePublishRequest, Fact, FactList, FactWriteRequest, SkillList, SkillContent, SkillWriteRequest, KnowledgeWriteResponse, OperationRunGroup, OperationRunQuery, Operation, OperationList, OperationListQuery, OperationSource, OperationSourceUpdateRequest, OperationUpdateRequest, OperationRunRequest, OperationRunStarted, OperationRunList, OperationRunOutput, DataFlow, DataFlowCreateRequest, DataFlowCommandRequest, DataFlowCommandResponse, Workspace, WorkspaceCreateRequest, WorkspaceDeleteResponse, WorkspaceList, WorkspaceUpdateRequest, AnswerRequest, AnswerResponse, PermuteClientOptions, PermuteRequestOptions, QueryRequest, SearchRequest, SourceDetail, CatalogTable, SourceList, CustomDatasetCreateRequest, DatasetDeleteResponse, DatasetResponse, FileDatasetCreateRequest, FileDatasetMetadataCreateRequest, FileDatasetResponse, DatasetRows, DatasetCsvUploadOptions, CustomDatasetResponse, DashboardSource, DashboardSourceUpdateRequest } from './types.js';
 type DatasetWriteInput = {
     tables: Record<string, DatasetRows>;
@@ -62,6 +62,24 @@ export interface SkillsClient {
     delete(path: string, options?: PermuteRequestOptions): Promise<KnowledgeWriteResponse>;
 }
 export declare class PermuteClient {
+    readonly organizations: {
+        list(options?: PermuteRequestOptions): Promise<OrganizationList>;
+        get(organizationId: string, options?: PermuteRequestOptions): Promise<Organization>;
+    };
+    readonly organizationMembers: {
+        list(organizationId: string, options?: PermuteRequestOptions): Promise<MemberList>;
+        invite(organizationId: string, body: OrganizationMemberInvite, options?: PermuteRequestOptions): Promise<MemberInvitation>;
+        resendInvitation(organizationId: string, userId: string, options?: PermuteRequestOptions): Promise<MemberInvitationDelivery>;
+        updateRole(organizationId: string, userId: string, body: OrganizationMemberRoleUpdate, options?: PermuteRequestOptions): Promise<MemberRoleUpdated>;
+        remove(organizationId: string, userId: string, options?: PermuteRequestOptions): Promise<MemberRemoved>;
+    };
+    readonly workspaceMembers: {
+        list(workspaceId: string, options?: PermuteRequestOptions): Promise<MemberList>;
+        invite(workspaceId: string, body: WorkspaceMemberInvite, options?: PermuteRequestOptions): Promise<MemberInvitation>;
+        resendInvitation(workspaceId: string, userId: string, options?: PermuteRequestOptions): Promise<MemberInvitationDelivery>;
+        updateRole(workspaceId: string, userId: string, body: WorkspaceMemberRoleUpdate, options?: PermuteRequestOptions): Promise<MemberRoleUpdated>;
+        remove(workspaceId: string, userId: string, options?: PermuteRequestOptions): Promise<MemberRemoved>;
+    };
     readonly permissions: {
         update(permissionId: string, body: PermissionGrantUpdate, options?: PermuteRequestOptions): Promise<PermissionGrant>;
         list(query?: PermissionGrantQuery, options?: PermuteRequestOptions): Promise<PermissionGrantList>;
@@ -102,6 +120,14 @@ export declare class PermuteClient {
         saveDefinition(actionId: string, body: ActionDefinitionSaveRequest, options?: PermuteRequestOptions): Promise<ActionDefinitionSaved>;
         invoke(actionId: string, body: ActionRequest, options?: PermuteRequestOptions): Promise<ActionReceipt>;
     };
+    readonly actionTriggers: {
+        list(actionId: string, options?: PermuteRequestOptions): Promise<ActionTriggerList>;
+        create(actionId: string, body: ActionTriggerCreateRequest, options?: PermuteRequestOptions): Promise<ActionTrigger>;
+        get(actionId: string, triggerId: string, options?: PermuteRequestOptions): Promise<ActionTrigger>;
+        update(actionId: string, triggerId: string, body: ActionTriggerUpdateRequest, options?: PermuteRequestOptions): Promise<ActionTrigger>;
+        delete(actionId: string, triggerId: string, options?: PermuteRequestOptions): Promise<ActionTrigger>;
+        runs(actionId: string, triggerId: string, options?: PermuteRequestOptions): Promise<ActionTriggerRunList>;
+    };
     readonly emails: {
         get(options?: PermuteRequestOptions): Promise<EmailSender>;
         /** Only callable from Business Actions through platform.withStep(stepId). */

package/dist/client.js

@@ -295,6 +295,9 @@ export class PermuteFileDataset {
     }
 }
 export class PermuteClient {
+    organizations;
+    organizationMembers;
+    workspaceMembers;
     permissions;
     accessRequests;
     revisions;
@@ -302,6 +305,7 @@ export class PermuteClient {
     skills;
     organizationSkills;
     actions;
+    actionTriggers;
     emails;
     databases;
     apps;
@@ -349,6 +353,24 @@ export class PermuteClient {
             delete: this.bindMethod('permissionsDelete', (request) => (permissionId, options) => request({ pathParams: { permissionId } }, options)),
             inspect: this.bindMethod('permissionsInspect', (request) => (body, options) => request({ body }, options)),
         };
+        this.organizations = {
+            list: this.bindMethod('organizationsList', (apiRequest) => (options) => apiRequest({}, options)),
+            get: this.bindMethod('organizationsGet', (apiRequest) => (organizationId, options) => apiRequest({ pathParams: { organizationId } }, options)),
+        };
+        this.organizationMembers = {
+            list: this.bindMethod('organizationMembersList', (apiRequest) => (organizationId, options) => apiRequest({ pathParams: { organizationId } }, options)),
+            invite: this.bindMethod('organizationMembersInvite', (request) => (organizationId, body, options) => request({ pathParams: { organizationId }, body }, options)),
+            resendInvitation: this.bindMethod('organizationMembersResendInvitation', (request) => (organizationId, userId, options) => request({ pathParams: { organizationId, userId } }, options)),
+            updateRole: this.bindMethod('organizationMembersUpdateRole', (request) => (organizationId, userId, body, options) => request({ pathParams: { organizationId, userId }, body }, options)),
+            remove: this.bindMethod('organizationMembersRemove', (request) => (organizationId, userId, options) => request({ pathParams: { organizationId, userId } }, options)),
+        };
+        this.workspaceMembers = {
+            list: this.bindMethod('workspaceMembersList', (apiRequest) => (workspaceId, options) => apiRequest({ pathParams: { workspaceId } }, options)),
+            invite: this.bindMethod('workspaceMembersInvite', (request) => (workspaceId, body, options) => request({ pathParams: { workspaceId }, body }, options)),
+            resendInvitation: this.bindMethod('workspaceMembersResendInvitation', (request) => (workspaceId, userId, options) => request({ pathParams: { workspaceId, userId } }, options)),
+            updateRole: this.bindMethod('workspaceMembersUpdateRole', (request) => (workspaceId, userId, body, options) => request({ pathParams: { workspaceId, userId }, body }, options)),
+            remove: this.bindMethod('workspaceMembersRemove', (request) => (workspaceId, userId, options) => request({ pathParams: { workspaceId, userId } }, options)),
+        };
         this.accessRequests = {
             create: this.bindMethod('accessRequestsCreate', (request) => (body, options) => request({ body }, options)),
             list: this.bindMethod('accessRequestsList', (request) => (query, options) => request({ query }, options)),
@@ -388,6 +410,14 @@ export class PermuteClient {
             saveDefinition: this.bindMethod('actionDefinitionSave', (apiRequest) => (actionId, body, options) => apiRequest({ pathParams: { actionId }, body }, options)),
             invoke: this.bindMethod('actionsInvoke', (apiRequest) => (actionId, body, options) => apiRequest({ pathParams: { actionId }, body }, options)),
         };
+        this.actionTriggers = {
+            list: this.bindMethod('actionTriggersList', (apiRequest) => (actionId, options) => apiRequest({ pathParams: { actionId } }, options)),
+            create: this.bindMethod('actionTriggersCreate', (apiRequest) => (actionId, body, options) => apiRequest({ pathParams: { actionId }, body }, options)),
+            get: this.bindMethod('actionTriggersGet', (apiRequest) => (actionId, triggerId, options) => apiRequest({ pathParams: { actionId, triggerId } }, options)),
+            update: this.bindMethod('actionTriggersUpdate', (apiRequest) => (actionId, triggerId, body, options) => apiRequest({ pathParams: { actionId, triggerId }, body }, options)),
+            delete: this.bindMethod('actionTriggersDelete', (apiRequest) => (actionId, triggerId, options) => apiRequest({ pathParams: { actionId, triggerId } }, options)),
+            runs: this.bindMethod('actionTriggerRunsList', (apiRequest) => (actionId, triggerId, options) => apiRequest({ pathParams: { actionId, triggerId } }, options)),
+        };
         this.emails = {
             get: this.bindMethod('emailsGet', (request) => (options) => request({}, options)),
             send: this.bindMethod('emailsSend', (request) => (body, options) => request({ body }, options)),
@@ -715,7 +745,7 @@ export class PermuteClient {
             ...options?.headers,
         };
         const workspaceId = options?.workspaceId ?? this.workspaceId;
-        if (route.scope === 'workspace' && workspaceId) {
+        if (route.scope === 'workspace' && workspaceId && !input.pathParams?.workspaceId) {
             headers['X-Workspace-Id'] = workspaceId;
         }
         if (body !== undefined) {