kenso 0.1.7 → 0.1.10

package/docs/reference.md

@@ -1,8 +1,8 @@
 # Kenso CLI command reference
 
-Generated from kenso 0.1.7 (API contracts 54d399866b40) by `scripts/build-reference.ts`. Do not edit it: `pnpm build` writes it again.
+Generated from kenso 0.1.10 (API contracts 3d429b7be4f5) by `scripts/build-reference.ts`. Do not edit it: `pnpm build` writes it again.
 
-1358 commands. Beta commands work only on workspaces with their feature flag; `kenso describe` hides the ones yours cannot use. Every command also takes the global flags below. For the same data as JSON, run `kenso describe <resource> <action>`.
+1364 commands. Beta commands work only on workspaces with their feature flag; `kenso describe` hides the ones yours cannot use. Every command also takes the global flags below. For the same data as JSON, run `kenso describe <resource> <action>`.
 
 ## Global flags
 
@@ -76,6 +76,7 @@ Exit codes: 0 ok, 1 error, 2 usage, 3 auth, 4 not found, 5 some rows failed, 6 r
 - [bookings](#bookings) (5)
 - [brand-kit](#brand-kit) (3)
 - [brands](#brands) (1)
+- [browser-runs](#browser-runs) (4)
 - [bug-reports](#bug-reports) (1)
 - [build-events](#build-events) (2)
 - [build-files](#build-files) (6)
@@ -244,7 +245,7 @@ Exit codes: 0 ok, 1 error, 2 usage, 3 auth, 4 not found, 5 some rows failed, 6 r
 - [meeting-results](#meeting-results) (7)
 - [meeting-shares](#meeting-shares) (3)
 - [meeting-types](#meeting-types) (6)
-- [meetings](#meetings) (24)
+- [meetings](#meetings) (26)
 - [members](#members) (10)
 - [microsoft-teams-admin-consent-sessions](#microsoft-teams-admin-consent-sessions) (1)
 - [migration-connections](#migration-connections) (9)
@@ -489,7 +490,7 @@ kenso access-requests list --all
 
 Add a domain to an account. Returns the account.
 
-`domain`: a domain, website URL or work email (normalized to the registrable domain). `isPrimary` makes it the primary. A domain the account already has is a `200` no-op. One another account owns is `409 conflict` with `domain_taken` (and that `accountId`, unless account scope `own` hides that account). Requires `WriteAccess`.
+`domain`: a domain, website URL or work email (normalized to the registrable domain). `isPrimary` makes it the primary. A domain the account already has is a `200` no-op. One another account owns is `409 conflict` with `domain_taken` (and that `accountId`, unless account scope `own` hides that account). Requires Accounts edit.
 
 - Beta: needs the `accounts` feature flag on the workspace.
 - API: `POST /v1/accounts/{accountId}/domains`
@@ -515,7 +516,7 @@ kenso account-domains create --account-id <account-id> --data @body.json
 
 Remove a domain from its account. Returns the account.
 
-The account's last domain cannot go (`409 invalid_state`, `last_domain`). Removing the primary promotes the oldest remaining domain. Requires `WriteAccess`.
+The account's last domain cannot go (`409 invalid_state`, `last_domain`). Removing the primary promotes the oldest remaining domain. Requires Accounts edit.
 
 - Beta: needs the `accounts` feature flag on the workspace.
 - API: `DELETE /v1/account-domains/{accountDomainId}`
@@ -840,7 +841,7 @@ kenso account-tiers update --data @body.json
 
 Save a new account view at the end of the calling member's strip.
 
-Body: `name` (required, 1-80 characters after trim; names may repeat), `filters` (optional, the same `{ "field", "operator", "values" }` conditions as `accounts.search`; a condition with no values is dropped), `isActive` (optional; `true` makes the new view the active one and clears every view's draft). A member keeps at most 50 views, the four defaults included: the 51st is `409 conflict` with detail `view_limit`. Returns `201` with the view. Requires `ReadAccess`.
+Body: `name` (required, 1-80 characters after trim; names may repeat), `filters` (optional, the same `{ "field", "operator", "values" }` conditions as `accounts.search`; a condition with no values is dropped), `isActive` (optional; `true` makes the new view the active one and clears every view's draft). A member keeps at most 50 views, the four defaults included: the 51st is `409 conflict` with detail `view_limit`. Returns `201` with the view. Requires Accounts view.
 
 - Beta: needs the `accounts` feature flag on the workspace.
 - API: `POST /v1/account-views`
@@ -865,7 +866,7 @@ kenso account-views create --data @body.json
 
 Delete one of the calling member's account views.
 
-Soft delete; returns `204`. Deleting the active view makes the default view active with no draft. The default view cannot be deleted (`409 invalid_state`, detail `default_view`). Later views move up one position. Requires `ReadAccess`.
+Soft delete; returns `204`. Deleting the active view makes the default view active with no draft. The default view cannot be deleted (`409 invalid_state`, detail `default_view`). Later views move up one position. Requires Accounts view.
 
 - Beta: needs the `accounts` feature flag on the workspace.
 - API: `DELETE /v1/account-views/{accountViewId}`
@@ -885,7 +886,7 @@ kenso account-views delete --account-view-id <account-view-id>
 
 Copy one of the calling member's account views.
 
-Inserts `{name} copy` (a long name is cut so the copy fits in 80 characters) with the source's saved `filters` (not its draft) right after the source; later views move down one position. The copy becomes the active view, with every draft cleared, when the source was active. The default view cannot be duplicated (`409 invalid_state`, detail `default_view`); the 51st view is `409 conflict`, detail `view_limit`. Returns `201` with the copy. Requires `ReadAccess`.
+Inserts `{name} copy` (a long name is cut so the copy fits in 80 characters) with the source's saved `filters` (not its draft) right after the source; later views move down one position. The copy becomes the active view, with every draft cleared, when the source was active. The default view cannot be duplicated (`409 invalid_state`, detail `default_view`); the 51st view is `409 conflict`, detail `view_limit`. Returns `201` with the copy. Requires Accounts view.
 
 - Beta: needs the `accounts` feature flag on the workspace.
 - API: `POST /v1/account-views/{accountViewId}/duplicate`
@@ -905,7 +906,7 @@ kenso account-views duplicate --account-view-id <account-view-id>
 
 List the calling member's saved account views.
 
-Every view in strip order (`position`, 0-based), at most 50, in one page (`pagination.hasMore` is always false). Exactly one view is `isActive`; only that view can carry `draftFilters` (unsaved edits, omitted when there are none). `accountCount` counts live accounts that pass the view's saved `filters`, not the draft and no `q` (with account scope `own`, only accounts the caller owns); for the active tab, show `pagination.total` of your own `accounts.search` (`includeTotal: true`) instead. The first call creates the four default views. `timeZone` (optional, an IANA zone) is the zone the lastTouch, latestSignal and nextTouch day buckets count calendar days in, as on `accounts.search`; the member's app time zone wins over it. Requires `ReadAccess`.
+Every view in strip order (`position`, 0-based), at most 50, in one page (`pagination.hasMore` is always false). Exactly one view is `isActive`; only that view can carry `draftFilters` (unsaved edits, omitted when there are none). `accountCount` counts live accounts that pass the view's saved `filters`, not the draft and no `q` (with account scope `own`, only accounts the caller owns); for the active tab, show `pagination.total` of your own `accounts.search` (`includeTotal: true`) instead. The first call creates the four default views. `timeZone` (optional, an IANA zone) is the zone the lastTouch, latestSignal and nextTouch day buckets count calendar days in, as on `accounts.search`; the member's app time zone wins over it. Requires Accounts view.
 
 - Beta: needs the `accounts` feature flag on the workspace.
 - API: `GET /v1/account-views`
@@ -925,7 +926,7 @@ kenso account-views list
 
 Update one of the calling member's account views. Absent fields stay unchanged.
 
-<list type="bullet"> <item> `name`: 1-80 characters after trim. Cannot be null.</item> <item> `filters`: saves the view's conditions (null or `[]` = none) and clears its draft, unless `draftFilters` is in the same body ("Update view").</item> <item> `draftFilters`: unsaved conditions; null clears them ("Reset"). Only the view that is active after this request can hold a draft; a draft on any other view is `409 invalid_state` with detail `view_not_active`.</item> <item> `isActive`: only `true`, which makes this the active view and clears every other view's draft. `false` is `400`: activate another view instead.</item> </list> The default view (`isDefault`) cannot change `name` or `filters` (`409 invalid_state`, detail `default_view`); it can hold a draft ("Save as view" on All). Another member's or workspace's view is `404`. Requires `ReadAccess`.
+<list type="bullet"> <item> `name`: 1-80 characters after trim. Cannot be null.</item> <item> `filters`: saves the view's conditions (null or `[]` = none) and clears its draft, unless `draftFilters` is in the same body ("Update view").</item> <item> `draftFilters`: unsaved conditions; null clears them ("Reset"). Only the view that is active after this request can hold a draft; a draft on any other view is `409 invalid_state` with detail `view_not_active`.</item> <item> `isActive`: only `true`, which makes this the active view and clears every other view's draft. `false` is `400`: activate another view instead.</item> </list> The default view (`isDefault`) cannot change `name` or `filters` (`409 invalid_state`, detail `default_view`); it can hold a draft ("Save as view" on All). Another member's or workspace's view is `404`. Requires Accounts view.
 
 - Beta: needs the `accounts` feature flag on the workspace.
 - API: `PATCH /v1/account-views/{accountViewId}`
@@ -1000,7 +1001,7 @@ kenso accounts add-to-campaign --account-id <account-id> --data @body.json
 
 Create up to 100 accounts in one call.
 
-`items` (1 to 100) are each a `POST /v1/accounts` body. Returns 200 with one result per item in request order: `created` (with the account and `research`: queued or waiting_credits), `domain_taken` (the `accountId` that already owns `domain`; counted in skipped), `invalid` (`field`, `code` and `error` of the item's first problem) or `failed` (retry that item). The same domain twice in one call (acme.com and www.acme.com) creates once; the repeat is domain_taken. Duplicates are by domain only: acme.com and acme.io are two accounts. Ken resolves each company from Kenso Search and, when research is on, starts research per created account, charged its model tokens at 2x model cost, and each web page or search on Kenso's Firecrawl key at 2x Firecrawl cost; research waits for credits when the balance is short. With account scope `own`, every created account is the caller's, and an item naming another member's `ownerMemberId` is `invalid` with code `permission_denied`. Requires `WriteAccess`.
+`items` (1 to 100) are each a `POST /v1/accounts` body. Returns 200 with one result per item in request order: `created` (with the account and `research`: queued or waiting_credits), `domain_taken` (the `accountId` that already owns `domain`; counted in skipped), `invalid` (`field`, `code` and `error` of the item's first problem) or `failed` (retry that item). The same domain twice in one call (acme.com and www.acme.com) creates once; the repeat is domain_taken. Duplicates are by domain only: acme.com and acme.io are two accounts. Ken resolves each company from Kenso Search and, when research is on, starts research per created account, charged its model tokens at 2x model cost, and each web page or search on Kenso's Firecrawl key at 2x Firecrawl cost; research waits for credits when the balance is short. With account scope `own`, every created account is the caller's, and an item naming another member's `ownerMemberId` is `invalid` with code `permission_denied`. Requires Accounts edit.
 
 - Beta: needs the `accounts` feature flag on the workspace.
 - API: `POST /v1/accounts/bulk-create`
@@ -1045,7 +1046,7 @@ kenso accounts bulk-update --data @body.json
 
 Create an account from its domains.
 
-`domains` (1 to 20 domains, website URLs or work emails; the first is primary) is required. A domain another account owns is `409 conflict` with detail `domain_taken` and that `accountId`: use that account instead. With account scope `own`, an account the caller cannot see is not named (the detail has no `accountId`), a missing, null or own `ownerMemberId` makes the caller the owner, and another member's is `403 permission_denied` with `scope: all`. Fields a person sets are pinned. Ken resolves the company from Kenso Search and fills the name (else from the primary domain: acme.com becomes Acme), industry, size, HQ and LinkedIn page without pinning them. When research is on, it starts research, charged its model tokens at 2x model cost, and each web page or search on Kenso's Firecrawl key at 2x Firecrawl cost. `skipResearch=true` creates the account without research or the committee run, so the create costs no credits; research can be started later with `POST /v1/accounts/{accountId}/research`. `sendsFromInboxId` and `sendsFromLinkedInAccountId` are checked like on PATCH. Requires `WriteAccess`.
+`domains` (1 to 20 domains, website URLs or work emails; the first is primary) is required. A domain another account owns is `409 conflict` with detail `domain_taken` and that `accountId`: use that account instead. With account scope `own`, an account the caller cannot see is not named (the detail has no `accountId`), a missing, null or own `ownerMemberId` makes the caller the owner, and another member's is `403 permission_denied` with `scope: all`. Fields a person sets are pinned. Ken resolves the company from Kenso Search and fills the name (else from the primary domain: acme.com becomes Acme), industry, size, HQ and LinkedIn page without pinning them. When research is on, it starts research, charged its model tokens at 2x model cost, and each web page or search on Kenso's Firecrawl key at 2x Firecrawl cost. `skipResearch=true` creates the account without research or the committee run, so the create costs no credits; research can be started later with `POST /v1/accounts/{accountId}/research`. `sendsFromInboxId` and `sendsFromLinkedInAccountId` are checked like on PATCH. Requires Accounts edit.
 
 - Beta: needs the `accounts` feature flag on the workspace.
 - API: `POST /v1/accounts`
@@ -1105,7 +1106,7 @@ kenso accounts delete --account-id <account-id>
 
 Count accounts per filter value for the filter panel.
 
-Body: `filters`, the same conditions as `accounts.search` (optional). Returns `totalCount` (accounts that pass every filter) and one facet per field, in this order: `stage`, `committee`, `lastTouch`, `industry`, `fundingRound`, `headcount`, `signal`, `latestSignal`, `hasOpenOpportunity` (only while the opportunities feature is on), `tier`, `accountType`. Each value's `count` applies every other filter but not the field's own, so it is the number of accounts the list would show after adding that value (an account with several signal kinds counts under each). There is no `q`. Fixed fields list every value, zero counts included: stage in the order meeting_booked, engaged, warming, researching, nurture, lost, paused, not_a_fit; committee, lastTouch, headcount, signal, latestSignal and accountType in the order listed on `accounts.search`; tier 1 to the workspace ladder's tierCount. The facets take `filters` only, not `where`. `industry` and `fundingRound` list the 100 values most used across every account in the workspace, zero counts included. Industry sorts by count, highest first, then name; funding round puts Pre-seed, Seed and Series A to E first, then the rest alphabetically. With account scope `own`, the counts, `totalCount` and the industry and funding round values come only from the accounts the caller owns. Requires `ReadAccess`.
+Body: `filters`, the same conditions as `accounts.search` (optional). Returns `totalCount` (accounts that pass every filter) and one facet per field, in this order: `stage`, `committee`, `lastTouch`, `industry`, `fundingRound`, `headcount`, `signal`, `latestSignal`, `hasOpenOpportunity` (only while the opportunities feature is on), `tier`, `accountType`. Each value's `count` applies every other filter but not the field's own, so it is the number of accounts the list would show after adding that value (an account with several signal kinds counts under each). There is no `q`. Fixed fields list every value, zero counts included: stage in the order meeting_booked, engaged, warming, researching, nurture, lost, paused, not_a_fit; committee, lastTouch, headcount, signal, latestSignal and accountType in the order listed on `accounts.search`; tier 1 to the workspace ladder's tierCount. The facets take `filters` only, not `where`. `industry` and `fundingRound` list the 100 values most used across every account in the workspace, zero counts included. Industry sorts by count, highest first, then name; funding round puts Pre-seed, Seed and Series A to E first, then the rest alphabetically. With account scope `own`, the counts, `totalCount` and the industry and funding round values come only from the accounts the caller owns. Requires Accounts view.
 
 - Beta: needs the `accounts` feature flag on the workspace.
 - API: `POST /v1/accounts/facets`
@@ -1128,7 +1129,7 @@ kenso accounts facets --data @body.json
 
 Return one account.
 
-`expand=stakeholders` embeds up to 200 stakeholders with their person. `expand=research` embeds the research dossier (status, trigger, errorCode, researchedAt, isStale, whyNow, angle, fitScore, tagline, description, facts, links, pains, stack, signals, sources). The status is the latest run's; the dossier fields come from the latest succeeded run, so a refresh in progress still shows the previous dossier. researchStatus (none | waiting_credits | queued | running | succeeded | failed) and researchedAt are on every account in get, list and search. `score` (0-99 from the signals of the last 90 days and the engaged people), `scoredAt`, `signalCount`, `engagedPeopleCount` and `latestSignal` (id, kind, title, occurredAt, detectedAt) are absent until the account is first scored. `handoff` is the latest hand-off to a teammate (`accounts.hand-off`), omitted when there is none. Requires `ReadAccess`.
+`expand=stakeholders` embeds up to 200 stakeholders with their person. `expand=research` embeds the research dossier (status, trigger, errorCode, researchedAt, isStale, whyNow, angle, fitScore, tagline, description, facts, links, pains, stack, signals, sources). The status is the latest run's; the dossier fields come from the latest succeeded run, so a refresh in progress still shows the previous dossier. researchStatus (none | waiting_credits | queued | running | succeeded | failed) and researchedAt are on every account in get, list and search. `score` (0-99 from the signals of the last 90 days and the engaged people), `scoredAt`, `signalCount`, `engagedPeopleCount` and `latestSignal` (id, kind, title, occurredAt, detectedAt) are absent until the account is first scored. `handoff` is the latest hand-off to a teammate (`accounts.hand-off`), omitted when there is none. Requires Accounts view.
 
 - Beta: needs the `accounts` feature flag on the workspace.
 - API: `GET /v1/accounts/{accountId}`
@@ -1261,7 +1262,7 @@ kenso accounts links --account-id <account-id>
 
 List accounts in the current workspace.
 
-Filters: `stage` (comma = OR: researching, warming, engaged, meeting_booked, nurture, lost, paused, not_a_fit), `ownerMemberId`, `domain` (any domain, URL or email; normalized), `q` (name or domain contains), `nextTouchBefore`, `latestSignalAfter` (the latest signal's event time is at or after it), `tagIds` (comma = OR: accounts carrying any of these tags; up to 100 positive ids, anything else is `400 validation_failed`), `hasOpenOpportunity` (`true`: accounts with an open opportunity, `false`: accounts without), `isCustomer` (`true`: customer accounts, `false`: the rest), `accountType` (comma = OR: prospect, client, lost, churned, partner, competitor, investor, do_not_contact), `fitsIcp` (`true`: accounts that fit the ICP, which are the accounts Today surfaces for their signals: none of the account's domains is one of the workspace's own domains (Settings > Company domains and the Primary), its stage is not `not_a_fit`, and research has not scored its fit below 20 (an account not researched yet fits); `false`: the accounts that do not). `sort`: `-createdAt` (default), `name`, `nextTouchAt`, `-score` (highest first, never scored last), `-latestSignalAt` (newest first, no signal last). Today's Heating up is `latestSignalAfter=<now - 7 days>&fitsIcp=true&sort=-score&limit=4`. Each item embeds its domains, its `tagIds` and, when it has one, its `latestSignal`, and carries `openOpportunityCount`, `openPipelineAmount` and `openOpportunityStage`, and, once handed off, its latest `handoff`. `score` (0-99), `scoredAt`, `signalCount` and `engagedPeopleCount` are absent until the account is first scored. `expand=committee` adds each account's `committee`: `stakeholderCount`, `openSeatCount`, `coverage` (covered and total, as on `GET /v1/accounts/{accountId}/committee`), `roles` (role, stakeholderCount and openSeatCount per role that has either) and `run`, the latest mapping run as the committee read returns it (omitted when Ken never mapped the account). Without `expand` there is no `committee`. Requires `ReadAccess`.
+Filters: `stage` (comma = OR: researching, warming, engaged, meeting_booked, nurture, lost, paused, not_a_fit), `ownerMemberId`, `domain` (any domain, URL or email; normalized), `q` (name or domain contains), `nextTouchBefore`, `latestSignalAfter` (the latest signal's event time is at or after it), `tagIds` (comma = OR: accounts carrying any of these tags; up to 100 positive ids, anything else is `400 validation_failed`), `hasOpenOpportunity` (`true`: accounts with an open opportunity, `false`: accounts without), `isCustomer` (`true`: customer accounts, `false`: the rest), `accountType` (comma = OR: prospect, client, lost, churned, partner, competitor, investor, do_not_contact), `fitsIcp` (`true`: accounts that fit the ICP, which are the accounts Today surfaces for their signals: none of the account's domains is one of the workspace's own domains (Settings > Company domains and the Primary), its stage is not `not_a_fit`, and research has not scored its fit below 20 (an account not researched yet fits); `false`: the accounts that do not). `sort`: `-createdAt` (default), `name`, `nextTouchAt`, `-score` (highest first, never scored last), `-latestSignalAt` (newest first, no signal last). Today's Heating up is `latestSignalAfter=<now - 7 days>&fitsIcp=true&sort=-score&limit=4`. Each item embeds its domains, its `tagIds` and, when it has one, its `latestSignal`, and carries `openOpportunityCount`, `openPipelineAmount` and `openOpportunityStage`, and, once handed off, its latest `handoff`. `score` (0-99), `scoredAt`, `signalCount` and `engagedPeopleCount` are absent until the account is first scored. `expand=committee` adds each account's `committee`: `stakeholderCount`, `openSeatCount`, `coverage` (covered and total, as on `GET /v1/accounts/{accountId}/committee`), `roles` (role, stakeholderCount and openSeatCount per role that has either) and `run`, the latest mapping run as the committee read returns it (omitted when Ken never mapped the account). Without `expand` there is no `committee`. Requires Accounts view.
 
 - Beta: needs the `accounts` feature flag on the workspace.
 - API: `GET /v1/accounts` (a list: `--limit`, `--cursor`, `--all`)
@@ -1349,7 +1350,7 @@ kenso accounts research --account-id <account-id> --data @body.json
 
 Search accounts in the current workspace with filter conditions and AND / OR groups.
 
-Body: `filters`, `where`, `q`, `sort`, `limit` (1-200, default 50), `cursor`, `includeTotal`. Every field is optional; an empty body lists every account. `filters`, `where` and `q` AND together. `filters` is a list of `{ "field", "operator", "values" }` conditions. Conditions AND together; the values of one condition OR together. `operator` is `is` or `is_not`; `is_not` also matches an account that has no value for the field. One condition per field (a second is `400 validation_failed`, detail `duplicate_field`). 1 to 50 values per condition, duplicates removed; a condition with an empty `values` list is ignored. Fields and values:<list type="bullet"><item>`stage`: researching, warming, engaged, meeting_booked, nurture, lost, paused, not_a_fit.</item><item>`committee`: n = stakeholders with coverage engaged or planned, t = all stakeholders. `none_engaged` when n = 0 (also with no stakeholders), `under_half` when n / t < 0.5, else `half_or_more`.</item><item>`lastTouch`: `past_7_days` (lastTouchAt within 7 days), `one_to_four_weeks` (7 to 28 days ago), `over_a_month` (older), `never` (no touch sent or done).</item><item>`headcount`: `under_250`, `from_250_to_999`, `from_1000` (employeeCount). An account with no employeeCount is in no bucket.</item><item>`industry`, `fundingRound`: any text, 1-200 characters, exact match. Read the values in use from `accounts.facets`.</item><item>`signal`: job_change, funding, hiring, public_post, event, asset_view, tech_change. An account matches a value when it has a signal of that kind whose event time (when it happened, else when Ken found it) is in the last 90 days; `job_change` also matches `leadership_hire`. `is_not` matches an account with none of them.</item><item>`latestSignal`: the latest signal's event time in the `lastTouch` buckets: `past_7_days`, `one_to_four_weeks`, `over_a_month`, `never` (no signal, or not scored yet).</item><item>`hasOpenOpportunity`: `true` (the account has a live opportunity in an open stage) or `false`. It is also a facet field with yes and no counts.</item><item>`isCustomer`: `true` (the account is marked a customer) or `false`. Not a facet field.</item><item>`tier`: 1 to 10, the tier the account is worked at (the hand-set tier, else the placed tier, else the tier its score falls in on the workspace's ladder). A tier past the ladder's tierCount matches no account. It is also a facet field.</item><item>`accountType`: prospect, client, lost, churned, partner, competitor, investor, do_not_contact. It is also a facet field.</item></list> `where` is a group `{ "match": "all" | "any", "conditions": [...] }`: `all` needs every entry to hold, `any` at least one. An entry is a condition `{ "field", "operator", "values" }` or a group, one level deep (a group inside a group inside `where` is `400`), with at most 50 conditions in all. A field may appear in several conditions. A condition whose operator needs values and that has none is dropped, and a group with no entries matches every account. Every `filters` field takes `is` and `is_not` with the values above, and where adds:<list type="bullet"><item>`headcount``lt` / `gte`: one whole number of employees (0 to 10,000,000). An account with no employeeCount matches neither.</item><item>`committee``lt` / `gte`: one share from 0 to 100, 100 n / t (no committee is 0).</item><item>`lastTouch`, `latestSignal``within_days` / `older_than_days`: one whole number of days from 1 to 365. Within: in the last N days. Older: more than N days ago; an account never touched (or with no signal) matches neither.</item><item>`owner`: `is` / `is_not` member ids (`is_not` also matches no owner), or `is_empty` (no owner, no values).</item><item>`tags`: tag ids. `is`: the account has any of them; `is_not`: it has none of them.</item><item>`domain`: `is` (a domain, URL or work email, normalized like a domain write; a free email provider is `400`), `contains` or `ends_with` (a lower-case piece such as `acme` or `.io`). It matches when any of the account's domains does.</item><item>`pipelineStage`: the stage key of the account's open opportunities. `is`: one of them is in one of these stages; `is_not`: none is; `is_empty`: the account has no open opportunity.</item><item>`nextTouch`: `is_planned`, `is_not_planned` (no values), or `within_days` N (planned for the next N days, 1 to 365; an overdue touch counts).</item></list> Example: <c>{"where": {"match": "any", "conditions": [{"field": "tier", "operator": "is", "values": ["1"]}, {"match": "all", "conditions": [{"field": "accountType", "operator": "is", "values": ["prospect"]}, {"field": "lastTouch", "operator": "older_than_days", "values": ["30"]}]}]}}</c>: tier 1 accounts, and prospects last touched more than 30 days ago. Every problem in `filters` or `where` is listed in one `400 validation_failed`, each with its path (`where.conditions[1].conditions[0].values[0]`). `q` (name or domain contains) and `sort` (`-createdAt` default, `name`, `nextTouchAt`, `-score`, `-latestSignalAt`) work as on `accounts.list`. `includeTotal: true` fills `pagination.total` with every account that passes the filters, where and q. Each item embeds its domains. Requires `ReadAccess`. Days: with a time zone, `lastTouch`, `latestSignal` and `nextTouch` count calendar days in it, as the app shows them. The zone is the member's app time zone (Settings), else `timeZone` (an IANA zone such as `Europe/Bucharest`; an unknown one is `400`). Past 7 days is today and the 7 days before it (from the zone's midnight 7 days ago), 1-4 weeks back to the zone's midnight 28 days ago, `within_days` N from the zone's midnight N days ago (`older_than_days` is before it), and `nextTouch``within_days` N before the zone's midnight after the day N days ahead. With no zone the windows roll back from now.
+Body: `filters`, `where`, `q`, `sort`, `limit` (1-200, default 50), `cursor`, `includeTotal`. Every field is optional; an empty body lists every account. `filters`, `where` and `q` AND together. `filters` is a list of `{ "field", "operator", "values" }` conditions. Conditions AND together; the values of one condition OR together. `operator` is `is` or `is_not`; `is_not` also matches an account that has no value for the field. One condition per field (a second is `400 validation_failed`, detail `duplicate_field`). 1 to 50 values per condition, duplicates removed; a condition with an empty `values` list is ignored. Fields and values:<list type="bullet"><item>`stage`: researching, warming, engaged, meeting_booked, nurture, lost, paused, not_a_fit.</item><item>`committee`: n = stakeholders with coverage engaged or planned, t = all stakeholders. `none_engaged` when n = 0 (also with no stakeholders), `under_half` when n / t < 0.5, else `half_or_more`.</item><item>`lastTouch`: `past_7_days` (lastTouchAt within 7 days), `one_to_four_weeks` (7 to 28 days ago), `over_a_month` (older), `never` (no touch sent or done).</item><item>`headcount`: `under_250`, `from_250_to_999`, `from_1000` (employeeCount). An account with no employeeCount is in no bucket.</item><item>`industry`, `fundingRound`: any text, 1-200 characters, exact match. Read the values in use from `accounts.facets`.</item><item>`signal`: job_change, funding, hiring, public_post, event, asset_view, tech_change. An account matches a value when it has a signal of that kind whose event time (when it happened, else when Ken found it) is in the last 90 days; `job_change` also matches `leadership_hire`. `is_not` matches an account with none of them.</item><item>`latestSignal`: the latest signal's event time in the `lastTouch` buckets: `past_7_days`, `one_to_four_weeks`, `over_a_month`, `never` (no signal, or not scored yet).</item><item>`hasOpenOpportunity`: `true` (the account has a live opportunity in an open stage) or `false`. It is also a facet field with yes and no counts.</item><item>`isCustomer`: `true` (the account is marked a customer) or `false`. Not a facet field.</item><item>`tier`: 1 to 10, the tier the account is worked at (the hand-set tier, else the placed tier, else the tier its score falls in on the workspace's ladder). A tier past the ladder's tierCount matches no account. It is also a facet field.</item><item>`accountType`: prospect, client, lost, churned, partner, competitor, investor, do_not_contact. It is also a facet field.</item></list> `where` is a group `{ "match": "all" | "any", "conditions": [...] }`: `all` needs every entry to hold, `any` at least one. An entry is a condition `{ "field", "operator", "values" }` or a group, one level deep (a group inside a group inside `where` is `400`), with at most 50 conditions in all. A field may appear in several conditions. A condition whose operator needs values and that has none is dropped, and a group with no entries matches every account. Every `filters` field takes `is` and `is_not` with the values above, and where adds:<list type="bullet"><item>`headcount``lt` / `gte`: one whole number of employees (0 to 10,000,000). An account with no employeeCount matches neither.</item><item>`committee``lt` / `gte`: one share from 0 to 100, 100 n / t (no committee is 0).</item><item>`lastTouch`, `latestSignal``within_days` / `older_than_days`: one whole number of days from 1 to 365. Within: in the last N days. Older: more than N days ago; an account never touched (or with no signal) matches neither.</item><item>`owner`: `is` / `is_not` member ids (`is_not` also matches no owner), or `is_empty` (no owner, no values).</item><item>`tags`: tag ids. `is`: the account has any of them; `is_not`: it has none of them.</item><item>`domain`: `is` (a domain, URL or work email, normalized like a domain write; a free email provider is `400`), `contains` or `ends_with` (a lower-case piece such as `acme` or `.io`). It matches when any of the account's domains does.</item><item>`pipelineStage`: the stage key of the account's open opportunities. `is`: one of them is in one of these stages; `is_not`: none is; `is_empty`: the account has no open opportunity.</item><item>`nextTouch`: `is_planned`, `is_not_planned` (no values), or `within_days` N (planned for the next N days, 1 to 365; an overdue touch counts).</item></list> Example: <c>{"where": {"match": "any", "conditions": [{"field": "tier", "operator": "is", "values": ["1"]}, {"match": "all", "conditions": [{"field": "accountType", "operator": "is", "values": ["prospect"]}, {"field": "lastTouch", "operator": "older_than_days", "values": ["30"]}]}]}}</c>: tier 1 accounts, and prospects last touched more than 30 days ago. Every problem in `filters` or `where` is listed in one `400 validation_failed`, each with its path (`where.conditions[1].conditions[0].values[0]`). `q` (name or domain contains) and `sort` (`-createdAt` default, `name`, `nextTouchAt`, `-score`, `-latestSignalAt`) work as on `accounts.list`. `includeTotal: true` fills `pagination.total` with every account that passes the filters, where and q. Each item embeds its domains. Requires Accounts view. Days: with a time zone, `lastTouch`, `latestSignal` and `nextTouch` count calendar days in it, as the app shows them. The zone is the member's app time zone (Settings), else `timeZone` (an IANA zone such as `Europe/Bucharest`; an unknown one is `400`). Past 7 days is today and the 7 days before it (from the zone's midnight 7 days ago), 1-4 weeks back to the zone's midnight 28 days ago, `within_days` N from the zone's midnight N days ago (`older_than_days` is before it), and `nextTouch``within_days` N before the zone's midnight after the day N days ahead. With no zone the windows roll back from now.
 
 - Beta: needs the `accounts` feature flag on the workspace.
 - API: `POST /v1/accounts/search`
@@ -1380,7 +1381,7 @@ kenso accounts search --data @body.json
 
 Update account fields. Absent fields stay unchanged; null clears.
 
-Fields: name, stage, ownerMemberId (a workspace member), fitScore (0-100), whyNow, angle, cadenceDays (1-365), industry, fundingRound (1-100 characters), employeeCount, hqLocation, linkedinUrl, kenCompanyId (the company's Kenso id), sendsFromInboxId, sendsFromLinkedInAccountId. `sendsFromInboxId` is the inbox email touches send from: a member's primary inbox (owned and on the workspace's primary domain), or a shared campaign inbox on one of the workspace's cold sending domains, whose touches the account owner approves. `sendsFromLinkedInAccountId` is the LinkedIn account LinkedIn touches send from, connected by a member. Null on either means the owner's default. Neither is pinned, so an agent may change them. A bad id is `400 validation_failed` with code `not_found`, `not_owned`, `not_member` (its member left the workspace) or `email_domain_mismatch` (the inbox is not on the workspace's email domain; the message says what fixes it). Only a changed id is checked, so a form that sends the stored ids back saves. A disconnected sender is accepted; its touches wait until it reconnects. Changing a field a person set is `409 conflict` with `pinned_by_user` unless `overwritePinned: true`; nothing is applied partially. With account scope `own`, an account the caller does not own is `404 not_found`, and an `ownerMemberId` other than the caller's own is `403 permission_denied` with `scope: all`. Requires `WriteAccess`. `tierOverride` (1 to the ladder's `tierCount`; a higher tier is `400 validation_failed`) sets the account's tier by hand after the other fields are saved, and routes it to that tier's destination at once where the workspace has tier routing on (account-tiers); null is Auto: the account goes back to its auto tier (the tier the ladder placed it at, else its score's tier) without routing, and the ladder moves it from then on. Both write a tier change to the account's activity, with tier routing on or off. A tier whose move adds the account's people to a campaign, or stops the people the ladder put in one, also requires campaigns edit (`403 permission_denied`); both are checked before anything is saved. The response's `tier` is the hand-set tier, else `autoTier`. When another tier change on the account ran at the same time, the tier is not set and the response is `409 conflict`; the other fields are saved. A campaign that refuses the people (the plan's lead limit) also leaves the tier unset, with the other fields saved. `isCustomer` (true or false) marks the account a customer or clears it, after the other fields are saved. Only a workspace admin can change it (`403 forbidden` with code `customer_not_allowed`, checked before anything is saved); anyone else may send the stored value back, which leaves the flag as it is. true puts every domain of the account on the workspace blocklist with reason `customer`, so Ken sends its people nothing; false takes off only those rows, and a domain blocked for another reason stays blocked. The response carries `isCustomer`, `customerSince` and `customerSource` (manual here). `accountType` (prospect, client, lost, churned, partner, competitor, investor, do_not_contact; not null) is what the workspace calls the account, written after `isCustomer`. `client` is the customer flag: moving an account to client marks it a customer (its domains go on the blocklist) and moving a client to another type clears it, so either needs a workspace admin (`403 forbidden` with code `customer_not_allowed`, checked before anything is saved); the flag turning on or off any other way (a won opportunity, the CRM, `isCustomer`) moves the type to client or back to prospect. Any other type change is open to anyone with accounts edit. `accountType` and `isCustomer` that disagree in one body are `400 validation_failed`. Each change writes `account.type_changed` on the account's timeline. Only `client` changes sending by itself: any other type blocks the account's domains only while an enabled blocklist rule names it (`accountTypes` on `/v1/blocklist-rules`, DEV-4105), except that a client moved to lost, churned, competitor or do_not_contact keeps its domains on the blocklist. Sending the type the account already has changes nothing. To stop contacting an account, put its domains on the blocklist.
+Fields: name, stage, ownerMemberId (a workspace member), fitScore (0-100), whyNow, angle, cadenceDays (1-365), industry, fundingRound (1-100 characters), employeeCount, hqLocation, linkedinUrl, kenCompanyId (the company's Kenso id), sendsFromInboxId, sendsFromLinkedInAccountId. `sendsFromInboxId` is the inbox email touches send from: a member's primary inbox (owned and on the workspace's primary domain), or a shared campaign inbox on one of the workspace's cold sending domains, whose touches the account owner approves. `sendsFromLinkedInAccountId` is the LinkedIn account LinkedIn touches send from, connected by a member. Null on either means the owner's default. Neither is pinned, so an agent may change them. A bad id is `400 validation_failed` with code `not_found`, `not_owned`, `not_member` (its member left the workspace) or `email_domain_mismatch` (the inbox is not on the workspace's email domain; the message says what fixes it). Only a changed id is checked, so a form that sends the stored ids back saves. A disconnected sender is accepted; its touches wait until it reconnects. Changing a field a person set is `409 conflict` with `pinned_by_user` unless `overwritePinned: true`; nothing is applied partially. With account scope `own`, an account the caller does not own is `404 not_found`, and an `ownerMemberId` other than the caller's own is `403 permission_denied` with `scope: all`. Requires Accounts edit. `tierOverride` (1 to the ladder's `tierCount`; a higher tier is `400 validation_failed`) sets the account's tier by hand after the other fields are saved, and routes it to that tier's destination at once where the workspace has tier routing on (account-tiers); null is Auto: the account goes back to its auto tier (the tier the ladder placed it at, else its score's tier) without routing, and the ladder moves it from then on. Both write a tier change to the account's activity, with tier routing on or off. A tier whose move adds the account's people to a campaign, or stops the people the ladder put in one, also requires campaigns edit (`403 permission_denied`); both are checked before anything is saved. The response's `tier` is the hand-set tier, else `autoTier`. When another tier change on the account ran at the same time, the tier is not set and the response is `409 conflict`; the other fields are saved. A campaign that refuses the people (the plan's lead limit) also leaves the tier unset, with the other fields saved. `isCustomer` (true or false) marks the account a customer or clears it, after the other fields are saved. Only a workspace admin can change it (`403 forbidden` with code `customer_not_allowed`, checked before anything is saved); anyone else may send the stored value back, which leaves the flag as it is. true puts every domain of the account on the workspace blocklist with reason `customer`, so Ken sends its people nothing; false takes off only those rows, and a domain blocked for another reason stays blocked. The response carries `isCustomer`, `customerSince` and `customerSource` (manual here). `accountType` (prospect, client, lost, churned, partner, competitor, investor, do_not_contact; not null) is what the workspace calls the account, written after `isCustomer`. `client` is the customer flag: moving an account to client marks it a customer (its domains go on the blocklist) and moving a client to another type clears it, so either needs a workspace admin (`403 forbidden` with code `customer_not_allowed`, checked before anything is saved); the flag turning on or off any other way (a won opportunity, the CRM, `isCustomer`) moves the type to client or back to prospect. Any other type change is open to anyone with accounts edit. `accountType` and `isCustomer` that disagree in one body are `400 validation_failed`. Each change writes `account.type_changed` on the account's timeline. Only `client` changes sending by itself: any other type blocks the account's domains only while an enabled blocklist rule names it (`accountTypes` on `/v1/blocklist-rules`, DEV-4105), except that a client moved to lost, churned, competitor or do_not_contact keeps its domains on the blocklist. Sending the type the account already has changes nothing. To stop contacting an account, put its domains on the blocklist.
 
 - Beta: needs the `accounts` feature flag on the workspace.
 - API: `PATCH /v1/accounts/{accountId}`
@@ -1892,7 +1893,7 @@ kenso agent-team update-settings --data @body.json
 
 Reserve one AI assist call for the calling member.
 
-Counts against the caller's per-user quota for the feature (`onboarding_interview`, `build_chat_suggestions`, `ai_search_filters`, or `builder_chat`): 10 to 20 a minute and 200 to 300 a rolling day. Nothing else is saved. An unknown feature is `400 validation_failed`. A spent quota is `429 quota_exceeded` with `Retry-After` and a top-level `quotaResetAt`, the same shape as `POST /v1/support/turns`. Super admins and workspaces with billing bypass are exempt. Requires `ReadAccess`.
+Counts against the caller's per-user quota for the feature (`onboarding_interview`, `build_chat_suggestions`, `ai_search_filters`, or `builder_chat`): 10 to 20 a minute and 200 to 300 a rolling day. Nothing else is saved. An unknown feature is `400 validation_failed`. A spent quota is `429 quota_exceeded` with `Retry-After` and a top-level `quotaResetAt`, the same shape as `POST /v1/support/turns`. Super admins and workspaces with billing bypass are exempt. Requires the `ask` permission.
 
 - API: `POST /v1/ai-assist/reservations`
 - Generated from the API contract
@@ -1916,7 +1917,7 @@ kenso ai-assist-reservations create --data @body.json
 
 Estimate prompt tokens and list the models a flow can use.
 
-Internal. Replaces token analysis and supported models. `flow` is required. A campaign outside `X-Ken-Workspace-Id` is `not_found` before either read. Requires `ReadAccess`.
+Internal. Replaces token analysis and supported models. `flow` is required. A campaign outside `X-Ken-Workspace-Id` is `not_found` before either read. Requires Campaigns view.
 
 - API: `GET /v1/campaigns/{campaignId}/ai-cost-estimate`
 - Generated from the API contract
@@ -1939,7 +1940,7 @@ kenso ai-cost-estimate get --campaign-id <campaign-id>
 
 Approve a held contact's lines.
 
-The lines the hold keeps become the contact's personalization lines and the contact counts as personalized, so it can send. Not charged. A contact with no hold in the campaign (never held, already approved, or regenerated) is `not_held` (409). When the contact already has a live line for one of the held variables the approval is `conflict` (409) and nothing changes; regenerate the contact instead. A campaign or contact outside the workspace, or a contact not in this campaign, is `not_found`. Requires `WriteAccess`.
+The lines the hold keeps become the contact's personalization lines and the contact counts as personalized, so it can send. Not charged. A contact with no hold in the campaign (never held, already approved, or regenerated) is `not_held` (409). When the contact already has a live line for one of the held variables the approval is `conflict` (409) and nothing changes; regenerate the contact instead. A campaign or contact outside the workspace, or a contact not in this campaign, is `not_found`. Requires Campaigns edit.
 
 - API: `POST /v1/campaigns/{campaignId}/ai-line-holds/{contactId}/approve`
 - Generated from the API contract
@@ -1959,7 +1960,7 @@ kenso ai-line-holds approve --campaign-id <campaign-id> --contact-id <contact-id
 
 List the contacts the AI line check held in a campaign.
 
-Newest hold first, with the reasons and the lines each hold keeps. Pages with `limit` (1 to 200, default 50) and `cursor`. A contact appears until it is approved or regenerated. A campaign outside the workspace is `not_found`. Requires `ReadAccess`.
+Newest hold first, with the reasons and the lines each hold keeps. Pages with `limit` (1 to 200, default 50) and `cursor`. A contact appears until it is approved or regenerated. A campaign outside the workspace is `not_found`. Requires Campaigns view.
 
 - API: `GET /v1/campaigns/{campaignId}/ai-line-holds` (a list: `--limit`, `--cursor`, `--all`)
 - Generated from the API contract
@@ -1984,7 +1985,7 @@ kenso ai-line-holds list --campaign-id <campaign-id> --all
 
 List a contact's AI lines.
 
-One line per AI variable of the contact's campaign: the stored line its next send renders (the newest personalized line, or its rewrite when the prompt rewrites; the segment's prompt before the campaign's). Older runs and replaced lines are not listed. Ordered by variable, at most 200 lines, not paginated. A contact outside the workspace, deleted, or not in a campaign is `not_found`. Requires `ReadAccess`.
+One line per AI variable of the contact's campaign: the stored line its next send renders (the newest personalized line, or its rewrite when the prompt rewrites; the segment's prompt before the campaign's). Older runs and replaced lines are not listed. Ordered by variable, at most 200 lines, not paginated. A contact outside the workspace, deleted, or not in a campaign is `not_found`. Requires Campaigns view.
 
 - Beta: needs the `ai_line_edit` feature flag on the workspace.
 - API: `GET /v1/contacts/{contactId}/ai-lines`
@@ -2004,7 +2005,7 @@ kenso ai-lines list --contact-id <contact-id>
 
 Write a contact's AI lines again.
 
-Clears the contact's personalized lines (and the rewritten lines built on them) and queues a personalization run for that contact alone, charged as one lead. Returns `202` with the run; poll `GET /v1/ai-runs/{aiRunId}`. When the run lands, an approval draft that shows the lead is updated. A lead already sent or exported, with a send queued, or in an unfinished AI run is `409 invalid_state` and nothing changes. AI quota limits answer `429 quota_exceeded` and too few credits `402`, both before anything is cleared, so the lead keeps its lines. Only a full AI run queue (`503`) after the clear leaves the lead without lines until a retry or the next scheduled AI run. Requires `WriteAccess`.
+Clears the contact's personalized lines (and the rewritten lines built on them) and queues a personalization run for that contact alone, charged as one lead. Returns `202` with the run; poll `GET /v1/ai-runs/{aiRunId}`. When the run lands, an approval draft that shows the lead is updated. A lead already sent or exported, with a send queued, or in an unfinished AI run is `409 invalid_state` and nothing changes. AI quota limits answer `429 quota_exceeded` and too few credits `402`, both before anything is cleared, so the lead keeps its lines. Only a full AI run queue (`503`) after the clear leaves the lead without lines until a retry or the next scheduled AI run. Requires Campaigns edit and the `ask` permission.
 
 - Beta: needs the `ai_line_edit` feature flag on the workspace.
 - API: `POST /v1/contacts/{contactId}/ai-lines/regenerate`
@@ -2024,7 +2025,7 @@ kenso ai-lines regenerate --contact-id <contact-id>
 
 Replace the text of one of a contact's AI lines.
 
-The next send of the lead renders the new text, and an approval draft that shows the lead is updated. Steps already sent keep what they sent. `text` is required, at most 4,000 characters; it gets the cleanup a generated line gets (emoji removed, dashes normalized, spaces collapsed) and must be 1 to 1,000 characters after it, else `validation_failed`. Another of the contact's lines that the send does not read (an older run, a personalized line its rewrite replaces) is `409 invalid_state` and nothing changes; list the lines again and edit the one shown. A line that is not the contact's is `not_found`. Requires `WriteAccess`.
+The next send of the lead renders the new text, and an approval draft that shows the lead is updated. Steps already sent keep what they sent. `text` is required, at most 4,000 characters; it gets the cleanup a generated line gets (emoji removed, dashes normalized, spaces collapsed) and must be 1 to 1,000 characters after it, else `validation_failed`. Another of the contact's lines that the send does not read (an older run, a personalized line its rewrite replaces) is `409 invalid_state` and nothing changes; list the lines again and edit the one shown. A line that is not the contact's is `not_found`. Requires Campaigns edit.
 
 - Beta: needs the `ai_line_edit` feature flag on the workspace.
 - API: `PATCH /v1/contacts/{contactId}/ai-lines/{aiLineId}`
@@ -2051,7 +2052,7 @@ kenso ai-lines update --contact-id <contact-id> --ai-line-id <ai-line-id> --data
 
 Queue an AI run for a campaign in the current workspace.
 
-Returns `202` with a run id. Poll `GET /v1/ai-runs/{aiRunId}`. A campaign outside `X-Ken-Workspace-Id` is `not_found` before the run is queued. With `dryRun: true` the request is validated the same way and the answer is `200` with what the run would process: `batchSize` (the requested batch, else the flow's submission limit when `processAll`, else 500), `eligibleCount` (eligible contacts now, in `segmentId` when set), `projectedContactCount` (the lower of the two, an upper bound) and the flow's `blockingGate` and `blockingReason`. Nothing is queued, no quota is reserved and no credits are spent. Requires `WriteAccess`.
+Returns `202` with a run id. Poll `GET /v1/ai-runs/{aiRunId}`. A campaign outside `X-Ken-Workspace-Id` is `not_found` before the run is queued. With `dryRun: true` the request is validated the same way and the answer is `200` with what the run would process: `batchSize` (the requested batch, else the flow's submission limit when `processAll`, else 500), `eligibleCount` (eligible contacts now, in `segmentId` when set), `projectedContactCount` (the lower of the two, an upper bound) and the flow's `blockingGate` and `blockingReason`. Nothing is queued, no quota is reserved and no credits are spent. Requires Campaigns edit and the `ask` permission.
 
 - API: `POST /v1/campaigns/{campaignId}/ai-runs`
 - Generated from the API contract
@@ -2063,7 +2064,7 @@ Returns `202` with a run id. Poll `GET /v1/ai-runs/{aiRunId}`. A campaign outsid
 | `--flow` | string | no | flow (body, string) |
 | `--batch-size` | integer | no | batchSize (body, integer) |
 | `--process-all` | boolean | no | processAll (body, boolean) |
-| `--segment-id` | integer | no | segmentId (body, integer) |
+| `--segment-id` | integer | no | A segment of the campaign. Omit it for every segment; `0` is `400 validation_failed`, not "no segment". |
 | `--provider` | string | no | provider (body, string) |
 | `--model` | string | no | model (body, string) |
 | `--body-dry-run` | boolean | no | True validates the run and returns what it would process (`200`), without queueing it, reserving quota or spending credits. Default false. |
@@ -2082,7 +2083,7 @@ kenso ai-runs create --campaign-id <campaign-id> --data @body.json
 
 Read one AI run.
 
-The run's campaign must belong to `X-Ken-Workspace-Id`. A missing run, or a run outside the workspace, is `not_found`. Requires `ReadAccess`.
+The run's campaign must belong to `X-Ken-Workspace-Id`. A missing run, or a run outside the workspace, is `not_found`. Requires Campaigns view.
 
 - API: `GET /v1/ai-runs/{aiRunId}`
 - Generated from the API contract
@@ -2101,7 +2102,7 @@ kenso ai-runs get --ai-run-id <ai-run-id>
 
 Read AI-run eligibility for a campaign, with an optional invalidation preview.
 
-Replaces eligible counts and the invalidation preview. Pass `flow` and `preview` (`freshness` or `reset`) to include the preview. A campaign outside the workspace is `not_found` before either read. Requires `ReadAccess`.
+Replaces eligible counts and the invalidation preview. Pass `flow` and `preview` (`freshness` or `reset`) to include the preview. A campaign outside the workspace is `not_found` before either read. Requires Campaigns view.
 
 - API: `GET /v1/campaigns/{campaignId}/ai-runs/eligibility`
 - Generated from the API contract
@@ -2111,7 +2112,7 @@ Replaces eligible counts and the invalidation preview. Pass `flow` and `preview`
 | `--campaign-id` | integer | yes | campaignId (path, integer) |
 | `--flow` | string | no | flow (query, string) |
 | `--preview` | string | no | preview (query, string) |
-| `--segment-id` | integer | no | segmentId (query, integer) |
+| `--segment-id` | integer | no | A segment of the campaign. Omit it for every segment; `0` is `400 validation_failed`, not "no segment". |
 | `--each` | string | no | Run once per row of a JSONL or CSV file (- for stdin); row keys fill params and body by name. |
 | `--concurrency` | integer | no | With --each: requests in flight at once (1-16, default 4). |
 
@@ -2289,7 +2290,7 @@ kenso analytics get-deliverability
 
 Return the bounce gates in force and each domain's and inbox's verdict for the last 24 hours.
 
-Read-only (DEV-5210). Counts accepted cold and 1:1 sends and hard bounces over the last 24 hours, as the sequencer's bounce signal does, and judges each row by the gate the sequencer enforces (`Sequencer:SendBlocks:Bounce`): inbox rows by the inbox block gate, domain rows by the campaign pause gate (there is no domain bounce block). A row is `over` when its rate is strictly above `threshold` with at least `minSends` sends and `minBounces` hard bounces, `watch` when it is not over and its rate is at or above 80% of the threshold, and `ok` otherwise. `isSmallSample` marks a row with fewer sends than `minSends`, which cannot be `over`. The sequencer itself judges over `enforcedWindowHours`; `isEnforced` is false while it only records. A mailbox with no managed domain counts toward its address's domain, except on a free-mail provider (gmail.com), where it has an inbox row only. Rates are fractions from 0 to 1. Rows are worst first; `limit` caps each list (1 to 200, default 50).
+Read-only (DEV-5210). Counts accepted cold and 1:1 sends and hard bounces over the last 24 hours, as the sequencer's bounce signal does, and judges each row by the bounce gates the sequencer enforces: inbox rows by the inbox block gate, domain rows by the campaign pause gate (there is no domain bounce block). A row is `over` when its rate is strictly above `threshold` with at least `minSends` sends and `minBounces` hard bounces, `watch` when it is not over and its rate is at or above 80% of the threshold, and `ok` otherwise. `isSmallSample` marks a row with fewer sends than `minSends`, which cannot be `over`. The sequencer itself judges over `enforcedWindowHours`; `isEnforced` is false while it only records. A mailbox with no managed domain counts toward its address's domain, except on a free-mail provider (gmail.com), where it has an inbox row only. Rates are fractions from 0 to 1. Rows are worst first; `limit` caps each list (1 to 200, default 50).
 
 - API: `GET /v1/analytics/deliverability-gates`
 - Generated from the API contract
@@ -2644,7 +2645,7 @@ kenso apollo-lists list
 
 Advance a draft through one AI flow.
 
-Requires `WriteAccess`.
+Requires Campaigns edit.
 
 - API: `POST /v1/approval-tests/{approvalTestId}/advance`
 - Generated from the API contract
@@ -2669,7 +2670,7 @@ kenso approval-tests advance --approval-test-id <approval-test-id> --data @body.
 
 Create an approval draft for a campaign in the current workspace.
 
-Returns `201` and `Location`. Requires `WriteAccess`.
+Returns `201` and `Location`. Requires Campaigns edit and the `share` permission.
 
 - API: `POST /v1/campaigns/{campaignId}/approval-tests`
 - Generated from the API contract
@@ -2699,7 +2700,7 @@ kenso approval-tests create --campaign-id <campaign-id> --data @body.json
 
 Read a draft's client feedback.
 
-Feedback rows have no numeric id, so this returns the full window with no cursor and no total count. Requires `WriteAccess`.
+Feedback rows have no numeric id, so this returns the full window with no cursor and no total count. Requires Campaigns view.
 
 - API: `GET /v1/approval-tests/{approvalTestId}/feedback`
 - Generated from the API contract
@@ -2760,7 +2761,7 @@ kenso approval-tests list --campaign-id <campaign-id> --all
 
 Rotate a draft's share-link token.
 
-Requires `WriteAccess`.
+Requires Campaigns edit and the `share` permission.
 
 - API: `POST /v1/approval-tests/{approvalTestId}/rotate-link`
 - Generated from the API contract
@@ -4070,7 +4071,7 @@ kenso ats-pushes create --data @body.json
 
 Upload a pending attachment for an email message.
 
-Multipart field `file` and form field `messageId` (`msg_`, email only). Caps stay at 5 files, 8 MiB each, and 10 MiB pending. Requires `InboxReplyAccess`.
+Multipart field `file` and form field `messageId` (`msg_`, email only). Caps stay at 5 files, 8 MiB each, and 10 MiB pending. Requires Inbox edit.
 
 - API: `POST /v1/attachments`
 - Generated from the API contract
@@ -4092,7 +4093,7 @@ kenso attachments create --file ./file.csv
 
 Delete a pending attachment that has not been sent.
 
-Returns `204`. A malformed id is `not_found`. Requires `InboxReplyAccess`.
+Returns `204`. A malformed id is `not_found`. Requires Inbox edit.
 
 - API: `DELETE /v1/attachments/{attachmentId}`
 - Generated from the API contract
@@ -4111,7 +4112,7 @@ kenso attachments delete --attachment-id <attachment-id>
 
 Download attachment bytes.
 
-A malformed id is `not_found`. `inline=true` is only honored for an inline image. Requires `ReadAccess`.
+A malformed id is `not_found`. `inline=true` is only honored for an inline image. Requires Inbox view.
 
 - API: `GET /v1/attachments/{attachmentId}/content`
 - Generated from the API contract
@@ -4261,7 +4262,7 @@ kenso auto-pauses list --all
 
 Return autonomous reply settings for the current workspace.
 
-Requires `ReadAccess`.
+Open to any workspace member.
 
 - API: `GET /v1/autonomous-reply-settings`
 - Generated from the API contract
@@ -4279,7 +4280,7 @@ kenso autonomous-reply-settings get
 
 Update autonomous reply settings.
 
-Absent fields stay unchanged. JSON null clears `extraInstructions`. `mode` is `draft` or `autonomous`, or `approve_risky` where the workspace has the `reply_agent_approve_risky` flag on; elsewhere `approve_risky` gets the same `400 validation_failed` on `mode` as an unknown mode. A body without `mode` keeps the stored mode. Requires `WriteAccess`.
+Absent fields stay unchanged. JSON null clears `extraInstructions`. `mode` is `draft` or `autonomous`, or `approve_risky` where the workspace has the `reply_agent_approve_risky` flag on; elsewhere `approve_risky` gets the same `400 validation_failed` on `mode` as an unknown mode. A body without `mode` keeps the stored mode. Requires the `workspace_settings` permission.
 
 - API: `PATCH /v1/autonomous-reply-settings`
 - Generated from the API contract
@@ -4404,7 +4405,7 @@ kenso blitz-people search --data @body.json
 
 Add up to 1,000 blocklist values of one type.
 
-Send `values`, or `entries` (`[{ "value": "...", "reason": "..." }]`) for a reason per value, not both. Optional `reason` applies to every value without its own. Per-value outcomes are `succeeded` or `failed`. Duplicates stay failed with `already_exists` and keep their own reason. A domain a customer account or a blocklist rule already lists becomes `manual` under its id, with the reason sent, and is in `succeeded` with `claimed: true`, as on the single add. A shared mail provider domain (gmail.com, hotmail.co.uk, web.de) fails with `shared_mail_provider`; any other malformed value with `invalid`. To undo the add, bulk-delete only the `succeeded` ids without `claimed: true`: a claimed entry was blocked before the add, and deleting it unblocks the domain. Requires `WriteAccess`.
+Send `values`, or `entries` (`[{ "value": "...", "reason": "..." }]`) for a reason per value, not both. Optional `reason` applies to every value without its own. Per-value outcomes are `succeeded` or `failed`. Duplicates stay failed with `already_exists` and keep their own reason. A domain a customer account or a blocklist rule already lists becomes `manual` under its id, with the reason sent, and is in `succeeded` with `claimed: true`, as on the single add. A shared mail provider domain (gmail.com, hotmail.co.uk, web.de) fails with `shared_mail_provider`; any other malformed value with `invalid`. To undo the add, bulk-delete only the `succeeded` ids without `claimed: true`: a claimed entry was blocked before the add, and deleting it unblocks the domain. Requires the `workspace_settings` permission.
 
 - API: `POST /v1/blocklist-entries/bulk-create`
 - Generated from the API contract
@@ -4427,7 +4428,7 @@ kenso blocklist-entries bulk-create --data @body.json
 
 Remove up to 1,000 blocklist entries by id.
 
-Body `{ "ids": [...] }`. Removes them in one transaction and runs the own-domain and rule reconciles once, so undoing a large upload takes one call per 1,000 entries. To undo a bulk add, send only its `succeeded` ids without `claimed: true`: a claimed entry was blocked before the add (by a customer account or a rule), and a customer entry deleted here stays off. `succeeded` lists every id that is off the blocklist after the call, in request order, including an id already gone. An own-domain entry, and a rule entry while blocklist rules are on, stay and are in `failed` with `invalid_state` and the single delete's message. Requires `WriteAccess`.
+Body `{ "ids": [...] }`. Removes them in one transaction and runs the own-domain and rule reconciles once, so undoing a large upload takes one call per 1,000 entries. To undo a bulk add, send only its `succeeded` ids without `claimed: true`: a claimed entry was blocked before the add (by a customer account or a rule), and a customer entry deleted here stays off. `succeeded` lists every id that is off the blocklist after the call, in request order, including an id already gone. An own-domain entry, and a rule entry while blocklist rules are on, stay and are in `failed` with `invalid_state` and the single delete's message. Requires the `workspace_settings` permission.
 
 - API: `POST /v1/blocklist-entries/bulk-delete`
 - Generated from the API contract
@@ -4448,7 +4449,7 @@ kenso blocklist-entries bulk-delete --data @body.json
 
 Add one email or domain to the blocklist.
 
-Optional `reason` (at most 200 characters) says why the value is blocked. A duplicate entry is `validation_failed` and keeps its own reason. A domain a customer account or a blocklist rule already lists becomes `manual` under its id, with this reason, and comes back with `claimed: true`. A shared mail provider domain (gmail.com, hotmail.co.uk, web.de) is `validation_failed` with detail code `shared_mail_provider`: block those addresses one by one. Requires `WriteAccess`.
+Optional `reason` (at most 200 characters) says why the value is blocked. A duplicate entry is `validation_failed` and keeps its own reason. A domain a customer account or a blocklist rule already lists becomes `manual` under its id, with this reason, and comes back with `claimed: true`. A shared mail provider domain (gmail.com, hotmail.co.uk, web.de) is `validation_failed` with detail code `shared_mail_provider`: block those addresses one by one. Requires the `workspace_settings` permission.
 
 - API: `POST /v1/blocklist-entries`
 - Generated from the API contract
@@ -4472,7 +4473,7 @@ kenso blocklist-entries create --data @body.json
 
 Remove one blocklist entry.
 
-Requires `WriteAccess`. An entry outside the workspace is `not_found`.
+Requires the `workspace_settings` permission. An entry outside the workspace is `not_found`.
 
 - API: `DELETE /v1/blocklist-entries/{entryId}`
 - Generated from the API contract
@@ -4491,7 +4492,7 @@ kenso blocklist-entries delete --entry-id <entry-id>
 
 Import blocklist rows from a CSV file.
 
-Multipart field `file` is a `.csv` with `email` and/or `domain` columns and an optional `reason` column; a cell over 200 characters is cut, never failing the file. Optional form field `reason` (at most 200 characters) applies to every row without its own. Rows already on the blocklist keep their own reason, and a shared mail provider in the `domain` column (gmail.com) is skipped. Requires `WriteAccess`.
+Multipart field `file` is a `.csv` with `email` and/or `domain` columns and an optional `reason` column; a cell over 200 characters is cut, never failing the file. Optional form field `reason` (at most 200 characters) applies to every row without its own. Rows already on the blocklist keep their own reason, and a shared mail provider in the `domain` column (gmail.com) is skipped. Requires the `workspace_settings` permission.
 
 - API: `POST /v1/blocklist-entries/imports`
 - Generated from the API contract
@@ -4513,7 +4514,7 @@ kenso blocklist-entries import --file ./file.csv
 
 List blocklist entries in the current workspace.
 
-Ordered by id, which follows creation: `sort=createdAt` (the default) is oldest first, `sort=-createdAt` newest first; keep the same `sort` while paging. Optional filters: `type` (`email` or `domain`), `value` (an exact match), `q` (a case-insensitive substring of the value or the reason), `source` (comma-separated `manual`, `own_domain`, `customer`, `rule`) and `hasReason`. `includeTotal=true` adds `pagination.total`, every entry the filters match. `includeCounts=true` adds `counts`: the workspace's entries in all, emails, domains, from the CRM (`customer` and `rule`) and with no reason, whatever the filters. Requires `ReadAccess`.
+Ordered by id, which follows creation: `sort=createdAt` (the default) is oldest first, `sort=-createdAt` newest first; keep the same `sort` while paging. Optional filters: `type` (`email` or `domain`), `value` (an exact match), `q` (a case-insensitive substring of the value or the reason), `source` (comma-separated `manual`, `own_domain`, `customer`, `rule`) and `hasReason`. `includeTotal=true` adds `pagination.total`, every entry the filters match. `includeCounts=true` adds `counts`: the workspace's entries in all, emails, domains, from the CRM (`customer` and `rule`) and with no reason, whatever the filters. Open to any workspace member.
 
 - API: `GET /v1/blocklist-entries` (a list: `--limit`, `--cursor`, `--all`)
 - Generated from the API contract
@@ -4546,7 +4547,7 @@ kenso blocklist-entries list --all
 
 Set or clear why a blocklist entry is blocked.
 
-Body `{ "reason": "..." }`, at most 200 characters; `null` or blank clears it. `reason` is required. Requires `WriteAccess`. An entry outside the workspace is `not_found`.
+Body `{ "reason": "..." }`, at most 200 characters; `null` or blank clears it. `reason` is required. Requires the `workspace_settings` permission. An entry outside the workspace is `not_found`.
 
 - API: `PATCH /v1/blocklist-entries/{entryId}`
 - Generated from the API contract
@@ -4619,7 +4620,7 @@ kenso blocklist-rules delete --rule-id <rule-id>
 
 List blocklist rules.
 
-Every rule in `position` order (at most 20), each with `stages`, `accountTypes`, `crmLifecycles`, `crmList` (with the `members` and `readAt` of its last read) and `matches`: the accounts its stages (and release window, `releaseAfterDays`) or account types match now (each once), the domains and people (emails) it blocks and the CRM records it matches, enabled or not. The first enabled rule that matches a domain or email gives its entry the reason. Requires `ReadAccess`.
+Every rule in `position` order (at most 20), each with `stages`, `accountTypes`, `crmLifecycles`, `crmList` (with the `members` and `readAt` of its last read) and `matches`: the accounts its stages (and release window, `releaseAfterDays`) or account types match now (each once), the domains and people (emails) it blocks and the CRM records it matches, enabled or not. The first enabled rule that matches a domain or email gives its entry the reason. Open to any workspace member.
 
 - Beta: needs the `blocklist_rules` feature flag on the workspace.
 - API: `GET /v1/blocklist-rules`
@@ -4638,7 +4639,7 @@ kenso blocklist-rules list
 
 Preview what a blocklist rule would block.
 
-`stages` is a comma-separated list of up to 20 stage keys from `GET /v1/opportunity-stages`; an unknown or archived key is `400 out_of_range`. `accountTypes` is a comma-separated list of account types (`client`, `lost`, `churned`, `partner`, `competitor`, `investor`, `do_not_contact`; `prospect` or an unknown type is `400 out_of_range`). Send at least one of the two, or a CRM criterion: `crmLifecycles` is a comma-separated list of up to 5 CRM lifecycle stages (`lead`, `prospect`, `opportunity`, `customer`, `churned`) and `crmListId` a contact or company list of the connected CRM (`GET /v1/crm-connections/{connectionId}/lists`, at most 10,000 members, read live now and never stored). A CRM criterion while `blocklist_rules_crm` is off is `400 not_enabled`; with no connected CRM `400 invalid_state`; on a CRM Kenso cannot read lists or lifecycle stages from `400 unsupported`; an unknown or too large list `400 out_of_range`; a CRM that is not reachable or rate limited `503` or `429`. Returns the accounts with a live opportunity in one of the stages or of one of the types (each once), the distinct domains and people (emails) a rule would block, the CRM records it matches (`crmRecords`), how many of the domains and people a blocklist entry already lists (`alreadyBlocked`, any source), up to 10 accounts by id with one of their domains, up to 10 CRM records with the email or domain each blocks (`crmSample`), and what is left out: accounts and CRM companies with no domain, CRM contacts with neither a company domain nor an email (`skipped.noEmail`) and free email domains. Optional `releaseAfterDays` (1-3650) previews a release window: an account matched by stage counts only while one of its deals in the stages closed less than that many days ago or has no close date (a match by type or from the CRM never releases), and `skipped.released` counts the accounts it already let go. Never writes. Requires `ReadAccess` (accounts view), since it names accounts.
+`stages` is a comma-separated list of up to 20 stage keys from `GET /v1/opportunity-stages`; an unknown or archived key is `400 out_of_range`. `accountTypes` is a comma-separated list of account types (`client`, `lost`, `churned`, `partner`, `competitor`, `investor`, `do_not_contact`; `prospect` or an unknown type is `400 out_of_range`). Send at least one of the two, or a CRM criterion: `crmLifecycles` is a comma-separated list of up to 5 CRM lifecycle stages (`lead`, `prospect`, `opportunity`, `customer`, `churned`) and `crmListId` a contact or company list of the connected CRM (`GET /v1/crm-connections/{connectionId}/lists`, at most 10,000 members, read live now and never stored). A CRM criterion while `blocklist_rules_crm` is off is `400 not_enabled`; with no connected CRM `400 invalid_state`; on a CRM Kenso cannot read lists or lifecycle stages from `400 unsupported`; an unknown or too large list `400 out_of_range`; a CRM that is not reachable or rate limited `503` or `429`. Returns the accounts with a live opportunity in one of the stages or of one of the types (each once), the distinct domains and people (emails) a rule would block, the CRM records it matches (`crmRecords`), how many of the domains and people a blocklist entry already lists (`alreadyBlocked`, any source), up to 10 accounts by id with one of their domains, up to 10 CRM records with the email or domain each blocks (`crmSample`), and what is left out: accounts and CRM companies with no domain, CRM contacts with neither a company domain nor an email (`skipped.noEmail`) and free email domains. Optional `releaseAfterDays` (1-3650) previews a release window: an account matched by stage counts only while one of its deals in the stages closed less than that many days ago or has no close date (a match by type or from the CRM never releases), and `skipped.released` counts the accounts it already let go. Never writes. Requires Accounts view, since it names accounts.
 
 - Beta: needs the `blocklist_rules` feature flag on the workspace.
 - API: `GET /v1/blocklist-rules/preview`
@@ -5153,6 +5154,101 @@ Return the brand of a verified custom host.
 kenso brands get-by-host
 ```
 
+## browser-runs
+
+### kenso browser-runs get
+
+Return one browser run in full.
+
+The run with its task, identity and inbox, the structured `result`, `quotes` with their URLs, `screenshots` (`url` is the screenshot route), the replay link while it is kept (`replayExpiresAt`), the `submission` (the form URL and the fields sent), the watched domains, the first human reply and its seconds after the submit, and the error of a failed run. A run of another workspace is 404. Requires workflows view.
+
+- Beta: needs the `browser_steps` and `workflows` feature flag on the workspace.
+- API: `GET /v1/browser-runs/{browserRunId}`
+- Generated from the API contract
+
+| Flag | Type | Required | Description |
+| --- | --- | --- | --- |
+| `--browser-run-id` | integer | yes | browserRunId (path, integer) |
+| `--each` | string | no | Run once per row of a JSONL or CSV file (- for stdin); row keys fill params and body by name. |
+| `--concurrency` | integer | no | With --each: requests in flight at once (1-16, default 4). |
+
+```bash
+kenso browser-runs get --browser-run-id <browser-run-id>
+```
+
+### kenso browser-runs list
+
+List the workspace's browser runs, newest first.
+
+Filters: `workflowId`, `runId` (the workflow run), `nodeId` (the browser step), `recordType` and `recordId`, `status` (one of queued, awaiting_approval, declined, running, done, confirmed, unconfirmed, blocked, out_of_browser_time, failed). Items carry no quotes, screenshots or submission: read one run for those. `limit` 1 to 200 (default 50); continue with `pagination.nextCursor`. Requires workflows view.
+
+- Beta: needs the `browser_steps` and `workflows` feature flag on the workspace.
+- API: `GET /v1/browser-runs` (a list: `--limit`, `--cursor`, `--all`)
+- Generated from the API contract
+
+| Flag | Type | Required | Description |
+| --- | --- | --- | --- |
+| `--cursor` | string | no | Start at this cursor (the next: hint of a previous page). |
+| `--limit` | integer | no | 1 to 200, default 50. |
+| `--node-id` | string | no | The browser step's node id in the workflow. |
+| `--record-id` | integer | no | recordId (query, integer) |
+| `--record-type` | string | no | account, person, lead, place or none. |
+| `--run-id` | integer | no | The workflow run the browser runs belong to. |
+| `--status` | string | no | One status: queued, awaiting_approval, declined, running, done, confirmed, unconfirmed, blocked, out_of_browser_time, failed. |
+| `--workflow-id` | integer | no | workflowId (query, integer) |
+| `--all` | boolean | no | Follow every page and stream all items (NDJSON when piped). |
+| `--each` | string | no | Run once per row of a JSONL or CSV file (- for stdin); row keys fill params and body by name. |
+| `--concurrency` | integer | no | With --each: requests in flight at once (1-16, default 4). |
+
+```bash
+kenso browser-runs list
+kenso browser-runs list --all
+```
+
+### kenso browser-runs screenshot
+
+One screenshot of a browser run, as JPEG.
+
+`n` is 1-based, up to the run's `screenshotCount`. 404 when the run, the index or the file is not there. Cached privately for an hour. Requires workflows view.
+
+- Beta: needs the `browser_steps` and `workflows` feature flag on the workspace.
+- API: `GET /v1/browser-runs/{browserRunId}/screenshots/{n}`
+- Generated from the API contract
+
+| Flag | Type | Required | Description |
+| --- | --- | --- | --- |
+| `--browser-run-id` | integer | yes | browserRunId (path, integer) |
+| `--n` | integer | yes | n (path, integer) |
+| `--each` | string | no | Run once per row of a JSONL or CSV file (- for stdin); row keys fill params and body by name. |
+| `--concurrency` | integer | no | With --each: requests in flight at once (1-16, default 4). |
+
+```bash
+kenso browser-runs screenshot --browser-run-id <browser-run-id> --n <n>
+```
+
+### kenso browser-runs summary
+
+Runs by status and reply buckets for one workflow's browser steps.
+
+Over the browser runs of `workflowId` (one step with `nodeId`) created in [`createdAfter`, `createdBefore`) (default the last 30 days, at most 400 days): `runs`, `byStatus`, `replies` (`withinHour`, `withinDay`, `afterDay` from the first human reply after the submit; `noneBeforeTimeout` submitted runs whose watch closed with no human reply; `watching` still open), credits and browser minutes. Requires workflows view.
+
+- Beta: needs the `browser_steps` and `workflows` feature flag on the workspace.
+- API: `GET /v1/browser-runs/summary`
+- Generated from the API contract
+
+| Flag | Type | Required | Description |
+| --- | --- | --- | --- |
+| `--created-after` | string | no | Inclusive; default 30 days before Ken.Scraper.API.Dtos.BrowserRunSummaryRequest.CreatedBefore. |
+| `--created-before` | string | no | Exclusive; default now. |
+| `--node-id` | string | no | One browser step's node id; every browser step of the workflow when absent. |
+| `--workflow-id` | integer | yes | Required: a request without it fails binding with the canonical 400 on `workflowId`; 0 is refused too. |
+| `--each` | string | no | Run once per row of a JSONL or CSV file (- for stdin); row keys fill params and body by name. |
+| `--concurrency` | integer | no | With --each: requests in flight at once (1-16, default 4). |
+
+```bash
+kenso browser-runs summary --workflow-id <workflow-id>
+```
+
 ## bug-reports
 
 ### kenso bug-reports create
@@ -5214,7 +5310,7 @@ kenso build-events append --build-session-id <build-session-id> --data @body.jso
 
 List durable UI events for a build session.
 
-Ordered by `seq`. The cursor is the last returned seq. Read-only. Requires `ReadAccess`.
+Ordered by `seq`. The cursor is the last returned seq. Read-only. Requires Campaigns view.
 
 - API: `GET /v1/build-sessions/{buildSessionId}/events` (a list: `--limit`, `--cursor`, `--all`)
 - Generated from the API contract
@@ -5370,7 +5466,7 @@ kenso build-files search --all
 
 Return the workspace's active build session.
 
-Optional `campaignId` narrows the lookup. Read-only. Requires `ReadAccess`.
+Optional `campaignId` narrows the lookup. Read-only. Requires Campaigns view.
 
 - API: `GET /v1/build-sessions/active`
 - Generated from the API contract
@@ -5389,7 +5485,7 @@ kenso build-sessions active
 
 Return the latest build session for one campaign.
 
-One session, including a completed one. Read-only. Requires `ReadAccess`.
+One session, including a completed one. Read-only. Requires Campaigns view.
 
 - API: `GET /v1/build-sessions/by-campaign`
 - Generated from the API contract
@@ -5483,7 +5579,7 @@ kenso build-sessions feedback --data @body.json
 
 Return one build session.
 
-A missing or cross-workspace id is `not_found`. Read-only. Requires `ReadAccess`.
+A missing or cross-workspace id is `not_found`. Read-only. Requires Campaigns view.
 
 - API: `GET /v1/build-sessions/{buildSessionId}`
 - Generated from the API contract
@@ -5502,7 +5598,7 @@ kenso build-sessions get --build-session-id <build-session-id>
 
 List agent memory for the current workspace.
 
-Memory ids are not numeric, so this returns the matching rows in one window. Read-only. Requires `ReadAccess`.
+Memory ids are not numeric, so this returns the matching rows in one window. Read-only. Requires Campaigns view.
 
 - API: `GET /v1/build-sessions/memory`
 - Generated from the API contract
@@ -6045,7 +6141,7 @@ kenso calendars update --calendar-id <calendar-id> --data @body.json
 
 List a member's Call queue.
 
-Open call tasks that have not expired, assigned to the member, and open call touches (planned, drafted, awaiting approval or failed) on the member's accounts or on accounts with no owner. Each item carries the person or contact's `name`, `title`, `company`, `phone` (the task's, else the person's primary phone, else the contact's), `timeZoneId` and `zoneSource` (account, phone, owner or default), `callableNow` and `opensAt` (when the call can be made: once it is due, inside business hours while Contact limits keep calls to them, and under the calls per person per day limit, else `limitReached` and the next day's window, or local midnight while any time is callable; a snoozed or future call opens at its due time), `reason`, `attempts` and `briefReady`. Callable first, then by `dueAt`, then id. Filters: `assignee` (`me`, the default, or a member id for a workspace admin, else `403`), `due` (`now`, `today` before the end of the local day in the caller's app time zone, else in `timezone`, or `all`, the default). `limit` 1-200 (default 50); `pagination.hasMore` says more exist and there is no cursor. `counts`: `open` and `callableNow` over the whole queue read (at most 500). Requires `ReadAccess` (accounts view).
+Open call tasks that have not expired, assigned to the member, and open call touches (planned, drafted, awaiting approval or failed) on the member's accounts or on accounts with no owner. Each item carries the person or contact's `name`, `title`, `company`, `phone` (the task's, else the person's primary phone, else the contact's), `timeZoneId` and `zoneSource` (account, phone, owner or default), `callableNow` and `opensAt` (when the call can be made: once it is due, inside business hours while Contact limits keep calls to them, and under the calls per person per day limit, else `limitReached` and the next day's window, or local midnight while any time is callable; a snoozed or future call opens at its due time), `reason`, `attempts` and `briefReady`. Callable first, then by `dueAt`, then id. Filters: `assignee` (`me`, the default, or a member id for a workspace admin, else `403`), `due` (`now`, `today` before the end of the local day in the caller's app time zone, else in `timezone`, or `all`, the default). `limit` 1-200 (default 50); `pagination.hasMore` says more exist and there is no cursor. `counts`: `open` and `callableNow` over the whole queue read (at most 500). Requires Accounts view.
 
 - Beta: needs the `calls` feature flag on the workspace.
 - API: `GET /v1/call-queue`
@@ -6115,7 +6211,7 @@ kenso call-sequences replace --campaign-id <campaign-id> --data @body.json
 
 Create a call task.
 
-Body: `personId` or `contactId` (exactly one; a contact's task is also on its person when it has one), `dueAt` (default now, at most 90 days out, else `400 out_of_range`), `title` (1-200), `instructions`, `assigneeMemberId` (default the caller; a member of this workspace, else `400 invalid_member`) and `phone` (any format, stored E.164; a bad number is `400 invalid_phone`; default the person's primary phone when the call is made). The reason is `manual`, `accountId` the person's first account, `expiresAt` a week after `dueAt` (after now for a past `dueAt`). Writes `call.task_created` on the person's timeline. Returns `201`. When the person (else contact) already has an open call task, that task comes back with `200` and `existing: true`, also when another writer wins the race; one past its `expiresAt` is expired instead and a new task created. Under account scope `own`, an open task assigned to someone else is `409 conflict` with detail `call_task_exists` and no task id, and a contact whose person is not on the caller's accounts is `404`. Requires `WriteAccess` (accounts edit).
+Body: `personId` or `contactId` (exactly one; a contact's task is also on its person when it has one), `dueAt` (default now, at most 90 days out, else `400 out_of_range`), `title` (1-200), `instructions`, `assigneeMemberId` (default the caller; a member of this workspace, else `400 invalid_member`) and `phone` (any format, stored E.164; a bad number is `400 invalid_phone`; default the person's primary phone when the call is made). The reason is `manual`, `accountId` the person's first account, `expiresAt` a week after `dueAt` (after now for a past `dueAt`). Writes `call.task_created` on the person's timeline. Returns `201`. When the person (else contact) already has an open call task, that task comes back with `200` and `existing: true`, also when another writer wins the race; one past its `expiresAt` is expired instead and a new task created. Under account scope `own`, an open task assigned to someone else is `409 conflict` with detail `call_task_exists` and no task id, and a contact whose person is not on the caller's accounts is `404`. Requires Accounts edit.
 
 - Beta: needs the `calls` feature flag on the workspace.
 - API: `POST /v1/call-tasks`
@@ -6144,7 +6240,7 @@ kenso call-tasks create --data @body.json
 
 Delete a call task.
 
-Soft delete: the task leaves every list and the Call queue. Returns `204`. Requires `WriteAccess`.
+Soft delete: the task leaves every list and the Call queue. Returns `204`. Requires Accounts edit.
 
 - Beta: needs the `calls` feature flag on the workspace.
 - API: `DELETE /v1/call-tasks/{callTaskId}`
@@ -6164,7 +6260,7 @@ kenso call-tasks delete --call-task-id <call-task-id>
 
 Return one call task.
 
-A task of another workspace, a deleted one, or another member's under account scope `own` is `404`. Requires `ReadAccess`.
+A task of another workspace, a deleted one, or another member's under account scope `own` is `404`. Requires Accounts view.
 
 - Beta: needs the `calls` feature flag on the workspace.
 - API: `GET /v1/call-tasks/{callTaskId}`
@@ -6204,7 +6300,7 @@ kenso call-tasks get-brief --call-task-id <call-task-id>
 
 List call tasks.
 
-Live tasks by `dueAt`, then id. Filters: `assignee` (`me` or a member id; blank is every member, and a member with account scope `own` always gets only their own, so naming another member is `403 permission_denied` with `scope: all`), `status` (open, done, skipped, expired; comma = OR), `due` (`now` due before now, `today` before the end of the local day, overdue included, `overdue` before the local day started), `timezone` (IANA, default UTC, for a caller with no app time zone; the app time zone sets the local day when set), `personId`, `accountId` and `campaignId`. `limit` 1-200 (default 50), `cursor` from `pagination.nextCursor`. Requires `ReadAccess` (accounts view).
+Live tasks by `dueAt`, then id. Filters: `assignee` (`me` or a member id; blank is every member, and a member with account scope `own` always gets only their own, so naming another member is `403 permission_denied` with `scope: all`), `status` (open, done, skipped, expired; comma = OR), `due` (`now` due before now, `today` before the end of the local day, overdue included, `overdue` before the local day started), `timezone` (IANA, default UTC, for a caller with no app time zone; the app time zone sets the local day when set), `personId`, `accountId` and `campaignId`. `limit` 1-200 (default 50), `cursor` from `pagination.nextCursor`. Requires Accounts view.
 
 - Beta: needs the `calls` feature flag on the workspace.
 - API: `GET /v1/call-tasks` (a list: `--limit`, `--cursor`, `--all`)
@@ -6234,7 +6330,7 @@ kenso call-tasks list --all
 
 Skip an open call task.
 
-Body: `reason`, one of `no_phone`, `not_relevant` or `other`. The task becomes `skipped` with `skipReason` and `doneAt`, and leaves the Call queue; `call.task_skipped` goes on the person's timeline. Reopen it with `PATCH``status: open`. A task that is not open is `409 invalid_state`. A task another writer changed while the request ran is `409 conflict` with detail `call_task_changed`: read it again and retry. Requires `WriteAccess`.
+Body: `reason`, one of `no_phone`, `not_relevant` or `other`. The task becomes `skipped` with `skipReason` and `doneAt`, and leaves the Call queue; `call.task_skipped` goes on the person's timeline. Reopen it with `PATCH``status: open`. A task that is not open is `409 invalid_state`. A task another writer changed while the request ran is `409 conflict` with detail `call_task_changed`: read it again and retry. Requires Accounts edit.
 
 - Beta: needs the `calls` feature flag on the workspace.
 - API: `POST /v1/call-tasks/{callTaskId}/skip`
@@ -6258,7 +6354,7 @@ kenso call-tasks skip --call-task-id <call-task-id> --data @body.json
 
 Snooze an open call task.
 
-Body, optional: `until` (in the future, at most 90 days out). Without it the task moves to the next day's calling window in its zone (08:00 local the next weekday while Contact limits keep calls to business hours, else a day from now). `expiresAt` moves with it and `snoozeCount` goes up by one. A task that is not open is `409 invalid_state`. A task another writer changed while the request ran is `409 conflict` with detail `call_task_changed`: read it again and retry. Requires `WriteAccess`.
+Body, optional: `until` (in the future, at most 90 days out). Without it the task moves to the next day's calling window in its zone (08:00 local the next weekday while Contact limits keep calls to business hours, else a day from now). `expiresAt` moves with it and `snoozeCount` goes up by one. A task that is not open is `409 invalid_state`. A task another writer changed while the request ran is `409 conflict` with detail `call_task_changed`: read it again and retry. Requires Accounts edit.
 
 - Beta: needs the `calls` feature flag on the workspace.
 - API: `POST /v1/call-tasks/{callTaskId}/snooze`
@@ -6282,7 +6378,7 @@ kenso call-tasks snooze --call-task-id <call-task-id> --data @body.json
 
 Update a call task. Absent fields stay unchanged.
 
-Fields of an open task: `dueAt` (at most 90 days out; moves `expiresAt` with it), `title`, `instructions`, `assigneeMemberId` (a member of this workspace, not null) and `phone` (null clears; a bad number is `400 invalid_phone`). `status` can only be `open`: it reopens a skipped or expired task, clears its skip reason and done time and keeps it in the queue for another week; a done task stays done (`409 invalid_state`). When the person (else contact) already has another open task, the reopen is `409 conflict` with detail `call_task_exists` and that task's `callTaskId`; one past its `expiresAt` is expired instead. A task another writer changed while the request ran is `409 conflict` with detail `call_task_changed`: read it again and retry. Skip with `POST /v1/call-tasks/{callTaskId}/skip`. Requires `WriteAccess`.
+Fields of an open task: `dueAt` (at most 90 days out; moves `expiresAt` with it), `title`, `instructions`, `assigneeMemberId` (a member of this workspace, not null) and `phone` (null clears; a bad number is `400 invalid_phone`). `status` can only be `open`: it reopens a skipped or expired task, clears its skip reason and done time and keeps it in the queue for another week; a done task stays done (`409 invalid_state`). When the person (else contact) already has another open task, the reopen is `409 conflict` with detail `call_task_exists` and that task's `callTaskId`; one past its `expiresAt` is expired instead. A task another writer changed while the request ran is `409 conflict` with detail `call_task_changed`: read it again and retry. Skip with `POST /v1/call-tasks/{callTaskId}/skip`. Requires Accounts edit.
 
 - Beta: needs the `calls` feature flag on the workspace.
 - API: `PATCH /v1/call-tasks/{callTaskId}`
@@ -6456,7 +6552,7 @@ kenso calling numbers-buy --data @body.json
 
 List the workspace's phone numbers.
 
-Every number not released, newest first, at most five. `unpaid` is true when its monthly credits could not be charged. Requires `ReadAccess`.
+Every number not released, newest first, at most five. `unpaid` is true when its monthly credits could not be charged. Open to any workspace member.
 
 - Beta: needs the `calling` feature flag on the workspace.
 - API: `GET /v1/calling/numbers`
@@ -6518,7 +6614,7 @@ kenso calling numbers-update --number-id <number-id> --data @body.json
 
 Return what a call to a number costs.
 
-`to` is the number to call. `millicreditsPerMinute` is the destination rate plus the rep's leg, and `recordingMillicreditsPerMinute` is added when the call is recorded. A destination Kenso has no price for yet is `priced: false` with null rates; a value that is not a phone number is 400 `invalid_phone`. Requires `ReadAccess`.
+`to` is the number to call. `millicreditsPerMinute` is the destination rate plus the rep's leg, and `recordingMillicreditsPerMinute` is added when the call is recorded. A destination Kenso has no price for yet is `priced: false` with null rates; a value that is not a phone number is 400 `invalid_phone`. Open to any workspace member.
 
 - Beta: needs the `calling` feature flag on the workspace.
 - API: `GET /v1/calling/rates`
@@ -6538,7 +6634,7 @@ kenso calling rates-get
 
 Return the workspace's calling settings.
 
-A workspace that never saved them gets the defaults and `updatedAt` null. Requires `ReadAccess`.
+A workspace that never saved them gets the defaults and `updatedAt` null. Open to any workspace member.
 
 - Beta: needs the `calling` feature flag on the workspace.
 - API: `GET /v1/calling/settings`
@@ -6579,7 +6675,7 @@ kenso calling settings-update --data @body.json
 
 Return the workspace's monthly calling spend limit.
 
-`monthlyLimitMillicredits` null is no limit; a workspace that never set it reads 2,000,000 (2,000 credits) with `isDefault: true`. `spentThisMonthMillicredits` is call minutes and recordings charged this UTC calendar month plus open call holds, the same spend the cap counts; number fees are not in it. Separate from `/v1/spend-limits`. Requires `ReadAccess`.
+`monthlyLimitMillicredits` null is no limit; a workspace that never set it reads 2,000,000 (2,000 credits) with `isDefault: true`. `spentThisMonthMillicredits` is call minutes and recordings charged this UTC calendar month plus open call holds, the same spend the cap counts; number fees are not in it. Separate from `/v1/spend-limits`. Open to any workspace member.
 
 - Beta: needs the `calling` feature flag on the workspace.
 - API: `GET /v1/calling/spend-limit`
@@ -6682,7 +6778,7 @@ kenso calling voicemails-delete --voicemail-id <voicemail-id>
 
 List your voicemail greetings.
 
-Your live greetings, oldest first: the first is the one an `auto` drop plays. `audioUrl` is a 5-minute link to listen to it, absent while Kenso's audio store is not set up. Requires `ReadAccess`.
+Your live greetings, oldest first: the first is the one an `auto` drop plays. `audioUrl` is a 5-minute link to listen to it, absent while Kenso's audio store is not set up. Open to any workspace member.
 
 - Beta: needs the `calling` feature flag on the workspace.
 - API: `GET /v1/calling/voicemails`
@@ -6703,7 +6799,7 @@ kenso calling voicemails-list
 
 Log a call.
 
-Body: `personId`, `contactId` or `phone` (a phone no person or contact holds is `400 person_not_found`), `disposition` (required), `direction`, `startedAt` (default now), `endedAt` or `durationSeconds`, `notes`, `nextStep`, `followUpAt`, `callTaskId` or `touchId`, `recordingUrl` (https), `externalId` and `askedNotToBeCalled`. An API key logs source `api`, anyone else `manual`; the caller is the call's member. `askedNotToBeCalled: true` opts the person out of calls before the call is written (a call with no person is `400`; if the opt-out fails, nothing is logged). A wrong_number disposition never opts out. The disposition closes or retries the call task, completes the touch, and moves the lead (connected: working; meeting_booked: qualified, the account to meeting_booked and the campaign stopped; not_interested: disqualified and the campaign stopped; wrong_number: the number marked invalid and a phone find queued). `followUpAt` queues a follow-up call task. Writes `call.logged` on the person's timeline. Returns `201`; the same `externalId` from the same caller updates that call and returns `200`. Requires `WriteAccess` (accounts edit).
+Body: `personId`, `contactId` or `phone` (a phone no person or contact holds is `400 person_not_found`), `disposition` (required), `direction`, `startedAt` (default now), `endedAt` or `durationSeconds`, `notes`, `nextStep`, `followUpAt`, `callTaskId` or `touchId`, `recordingUrl` (https), `externalId` and `askedNotToBeCalled`. An API key logs source `api`, anyone else `manual`; the caller is the call's member. `askedNotToBeCalled: true` opts the person out of calls before the call is written (a call with no person is `400`; if the opt-out fails, nothing is logged). A wrong_number disposition never opts out. The disposition closes or retries the call task, completes the touch, and moves the lead (connected: working; meeting_booked: qualified, the account to meeting_booked and the campaign stopped; not_interested: disqualified and the campaign stopped; wrong_number: the number marked invalid and a phone find queued). `followUpAt` queues a follow-up call task. Writes `call.logged` on the person's timeline. Returns `201`; the same `externalId` from the same caller updates that call and returns `200`. Requires Accounts edit.
 
 - Beta: needs the `calls` feature flag on the workspace.
 - API: `POST /v1/calls`
@@ -6742,7 +6838,7 @@ kenso calls create --data @body.json
 
 Dial a call task, a call touch, a person or a number.
 
-Body: one of `callTaskId`, `touchId` (an account touch on the call channel; its stakeholder's person is called), `personId` or `phone`, and `force`. The number is the task's, else the person's phone, else the task contact's. A person who asked not to be called is `409 opted_out`, and `force` does not override it. Outside the person's calling hours (the workspace's business hours in their zone) it is `409 outside_calling_hours` with `opensAt` in the error detail; at the workspace's calls per person per day it is `409 limit_reached` unless `force` is true. A connected dialer the caller is linked on places the call (`status: dialing`) and Kenso logs it at once: `callId`, with the task or touch it works and no disposition. `PATCH /v1/calls/{callId}` saves its outcome (closing the task or completing the touch) and the dialer's events fill it in, so one dial is one call. Otherwise `status: tel` with `telHref` and no call is written. Kenso with no number for the person is `409 no_phone`. Requires `WriteAccess` (accounts edit).
+Body: one of `callTaskId`, `touchId` (an account touch on the call channel; its stakeholder's person is called), `personId` or `phone`, and `force`. The number is the task's, else the person's phone, else the task contact's. A person who asked not to be called is `409 opted_out`, and `force` does not override it. Outside the person's calling hours (the workspace's business hours in their zone) it is `409 outside_calling_hours` with `opensAt` in the error detail; at the workspace's calls per person per day it is `409 limit_reached` unless `force` is true. A connected dialer the caller is linked on places the call (`status: dialing`) and Kenso logs it at once: `callId`, with the task or touch it works and no disposition. `PATCH /v1/calls/{callId}` saves its outcome (closing the task or completing the touch) and the dialer's events fill it in, so one dial is one call. Otherwise `status: tel` with `telHref` and no call is written. Kenso with no number for the person is `409 no_phone`. Requires Accounts edit.
 
 - Beta: needs the `calls` feature flag on the workspace.
 - API: `POST /v1/calls/dial`
@@ -6770,7 +6866,7 @@ kenso calls dial --data @body.json
 
 Get a call.
 
-The call with its transcript. Another workspace's or a deleted call is 404. Requires `ReadAccess` (accounts view).
+The call with its transcript. Another workspace's or a deleted call is 404. Requires Accounts view.
 
 - Beta: needs the `calls` feature flag on the workspace.
 - API: `GET /v1/calls/{callId}`
@@ -6790,7 +6886,7 @@ kenso calls get --call-id <call-id>
 
 List calls.
 
-Live calls, newest first (`startedAt`, then id). Filters: `personId`, `accountId`, `memberId` (who made or took the call), `campaignId`, `from` (started at or after) and `to` (started before), `disposition` (comma = OR). `limit` 1-200 (default 50), `cursor` from `pagination.nextCursor`. The list leaves out transcripts. Requires `ReadAccess` (accounts view).
+Live calls, newest first (`startedAt`, then id). Filters: `personId`, `accountId`, `memberId` (who made or took the call), `campaignId`, `from` (started at or after) and `to` (started before), `disposition` (comma = OR). `limit` 1-200 (default 50), `cursor` from `pagination.nextCursor`. The list leaves out transcripts. Requires Accounts view.
 
 - Beta: needs the `calls` feature flag on the workspace.
 - API: `GET /v1/calls` (a list: `--limit`, `--cursor`, `--all`)
@@ -6820,7 +6916,7 @@ kenso calls list --all
 
 Open a call's recording.
 
-Redirects (302) to the recording: a fresh link from the dialer that logged the call while it is still connected, else the https link the call was logged with. No recording is 404. Requires `ReadAccess` (accounts view).
+Redirects (302) to the recording: a fresh link from the dialer that logged the call while it is still connected, else the https link the call was logged with. No recording is 404. Requires Accounts view.
 
 - Beta: needs the `calls` feature flag on the workspace.
 - API: `GET /v1/calls/{callId}/recording`
@@ -6840,7 +6936,7 @@ kenso calls recording --call-id <call-id>
 
 Update a call.
 
-Body: `disposition` (cannot be null), `notes`, `nextStep`, `followUpAt`; absent fields stay, null clears. The first disposition a call gets runs its effects as on create; changing it later writes `call.updated` only. A new `followUpAt` queues a follow-up call task. `askedNotToBeCalled: true` opts the call's person out of calls (a call with no person is `400`). Requires `WriteAccess` (accounts edit).
+Body: `disposition` (cannot be null), `notes`, `nextStep`, `followUpAt`; absent fields stay, null clears. The first disposition a call gets runs its effects as on create; changing it later writes `call.updated` only. A new `followUpAt` queues a follow-up call task. `askedNotToBeCalled: true` opts the call's person out of calls (a call with no person is `400`). Requires Accounts edit.
 
 - Beta: needs the `calls` feature flag on the workspace.
 - API: `PATCH /v1/calls/{callId}`
@@ -7578,7 +7674,7 @@ kenso campaign-video-variables update --campaign-id <campaign-id> --variable-key
 
 Archive a campaign.
 
-Idempotent for an already-archived campaign. A campaign that is still sending returns `409 invalid_state`. Requires `WriteAccess`.
+Idempotent for an already-archived campaign. A campaign that is still sending returns `409 invalid_state`. Requires Campaigns edit.
 
 - API: `POST /v1/campaigns/{campaignId}/archive`
 - Generated from the API contract
@@ -7682,7 +7778,7 @@ kenso campaigns asset-template-put --campaign-id <campaign-id> --data @body.json
 
 Create a campaign in the current workspace.
 
-Returns `201` and `Location`. Requires `ReadAccess`, matching the legacy create. Reserves the `campaignCreate` abuse quota. A sales campaign starts with `stopCompanyOnReply` on. Optional `kind` is `sales` (default) or `recruiting`. A recruiting campaign needs the `recruiting` flag for the workspace, else `400 validation_failed` with detail code `feature_disabled`; it starts with `stopCompanyOnReply`, `groupSameCompanySends` and same-company Cc off, and as a Draft, so its AI build can start. Optional `roleId` names a live role of the workspace (else `404 not_found`) and is only for a recruiting campaign (else `400` with detail code `not_recruiting`).
+Returns `201` and `Location`. Requires Campaigns edit. Reserves the `campaignCreate` abuse quota. A sales campaign starts with `stopCompanyOnReply` on. Optional `kind` is `sales` (default) or `recruiting`. A recruiting campaign needs the `recruiting` flag for the workspace, else `400 validation_failed` with detail code `feature_disabled`; it starts with `stopCompanyOnReply`, `groupSameCompanySends` and same-company Cc off, and as a Draft, so its AI build can start. Optional `roleId` names a live role of the workspace (else `404 not_found`) and is only for a recruiting campaign (else `400` with detail code `not_recruiting`).
 
 - API: `POST /v1/campaigns`
 - Generated from the API contract
@@ -7707,7 +7803,7 @@ kenso campaigns create --data @body.json
 
 Queue lead enrichment for a campaign.
 
-Replaces the legacy campaign enrichment trigger. The request finishes when Search accepts the batches and returns an `enrichment` job. `minConfidence` defaults to 0.5. Requires `WriteAccess`. A campaign outside the workspace is `not_found` before the run.
+Replaces the legacy campaign enrichment trigger. The request finishes when Search accepts the batches and returns an `enrichment` job. `minConfidence` defaults to 0.5. Requires Campaigns edit. A campaign outside the workspace is `not_found` before the run.
 
 - API: `POST /v1/campaigns/{campaignId}/enrichment-runs`
 - Generated from the API contract
@@ -7730,7 +7826,7 @@ kenso campaigns create-enrichment-run --campaign-id <campaign-id> --data @body.j
 
 Soft-delete a campaign.
 
-Requires `ReadAccess`, matching the legacy delete. Returns `204`.
+Requires Campaigns edit. Returns `204`.
 
 - API: `DELETE /v1/campaigns/{campaignId}`
 - Generated from the API contract
@@ -7749,7 +7845,7 @@ kenso campaigns delete --campaign-id <campaign-id>
 
 Duplicate a campaign inside the current workspace.
 
-`includeContacts` copies contacts. The copy stays in this workspace. Returns `201` and `Location`. Requires `WriteAccess`. Reserves the campaign-duplicate abuse quota.
+`includeContacts` copies contacts. The copy stays in this workspace. Returns `201` and `Location`. Requires Campaigns edit. Reserves the campaign-duplicate abuse quota.
 
 - API: `POST /v1/campaigns/{campaignId}/duplicate`
 - Generated from the API contract
@@ -7774,7 +7870,7 @@ kenso campaigns duplicate --campaign-id <campaign-id> --data @body.json
 
 Return one campaign in the current workspace.
 
-A missing or cross-workspace id is `not_found`. Read-only. Requires `ReadAccess`.
+A missing or cross-workspace id is `not_found`. Read-only. Requires Campaigns view.
 
 - API: `GET /v1/campaigns/{campaignId}`
 - Generated from the API contract
@@ -7833,7 +7929,7 @@ kenso campaigns get-autopilot --campaign-id <campaign-id>
 
 Report whether a campaign can launch and how long sending should take.
 
-Replaces `GET /v1/campaigns/{id}/can-launch` and `GET /v1/campaigns/{id}/sending-estimate`. A campaign outside the workspace is `not_found` before either read. Requires `ReadAccess`. `warnings` never change `canLaunch`; `localization_incomplete` (one per enabled language of an `auto` campaign) names the steps with no approved translation and whether those contacts get the source text or are held. `approval_required` means the client was asked and launch answers 409 `approval_required` until they approve; its `kinds` lists what waits (`copy`, `lead_list`, ...). The warning `approval_will_be_requested` names what nobody asked about yet: launch asks the client, then refuses until they approve.
+Replaces `GET /v1/campaigns/{id}/can-launch` and `GET /v1/campaigns/{id}/sending-estimate`. A campaign outside the workspace is `not_found` before either read. Requires Campaigns view. `warnings` never change `canLaunch`; `localization_incomplete` (one per enabled language of an `auto` campaign) names the steps with no approved translation and whether those contacts get the source text or are held. `approval_required` means the client was asked and launch answers 409 `approval_required` until they approve; its `kinds` lists what waits (`copy`, `lead_list`, ...). The warning `approval_will_be_requested` names what nobody asked about yet: launch asks the client, then refuses until they approve.
 
 - API: `GET /v1/campaigns/{campaignId}/launch-readiness`
 - Generated from the API contract
@@ -7852,7 +7948,7 @@ kenso campaigns get-launch-readiness --campaign-id <campaign-id>
 
 Read a campaign's LinkedIn settings.
 
-Replaces `GET /v1/campaigns/{id}/linkedin-config`. A campaign outside the workspace is `not_found`. Requires `ReadAccess`.
+Replaces `GET /v1/campaigns/{id}/linkedin-config`. A campaign outside the workspace is `not_found`. Requires Campaigns view.
 
 - API: `GET /v1/campaigns/{campaignId}/linkedin-settings`
 - Generated from the API contract
@@ -7871,7 +7967,7 @@ kenso campaigns get-linkedin-settings --campaign-id <campaign-id>
 
 Count a campaign's contacts by email security gateway and mailbox host.
 
-Each live contact is judged by its first Safe or Verified email, the one the lead list shows. `gateways` lists every active security gateway and `mailboxProviders` every active mailbox host and forwarder, 0 included, most contacts first. `pendingCount` counts contacts whose domain is not checked for a gateway yet. Counts cover at most 100,000 contacts (`isPartial`). Read-only. A campaign outside the workspace, or a workspace without the `security_gateways` feature, is `not_found`. Requires `ReadAccess`.
+Each live contact is judged by its first Safe or Verified email, the one the lead list shows. `gateways` lists every active security gateway and `mailboxProviders` every active mailbox host and forwarder, 0 included, most contacts first. `pendingCount` counts contacts whose domain is not checked for a gateway yet. Counts cover at most 100,000 contacts (`isPartial`). Read-only. A campaign outside the workspace, or a workspace without the `security_gateways` feature, is `not_found`. Requires Campaigns view.
 
 - Beta: needs the `security_gateways` feature flag on the workspace.
 - API: `GET /v1/campaigns/{campaignId}/mail-providers`
@@ -7911,7 +8007,7 @@ kenso campaigns get-processing-status --campaign-id <campaign-id>
 
 Read whether lead scoring is enabled for a campaign.
 
-Replaces `POST /v1/campaigns/{id}/scoring` for reads. A campaign outside the workspace is `not_found`. Requires `ReadAccess`.
+Replaces `POST /v1/campaigns/{id}/scoring` for reads. A campaign outside the workspace is `not_found`. Requires Campaigns view.
 
 - API: `GET /v1/campaigns/{campaignId}/scoring`
 - Generated from the API contract
@@ -7930,7 +8026,7 @@ kenso campaigns get-scoring --campaign-id <campaign-id>
 
 Return a campaign's sender routing.
 
-DEV-5225. `allInboxes` is the campaign's inbox mode. Each rule sends the first email to prospects on its mailbox provider or security gateway only from its domains and inboxes; a gateway rule wins over a mailbox provider rule, and prospects no rule matches go from the inboxes no rule claims (`everyoneElse`). Per rule and for Everyone else: the campaign's inboxes that can send now (Kenso-sendable, not paused), their summed daily limits, and the leads that can still get an email and match now (at most 100,000 leads read; a lead whose provider is still being detected is in no group). `warnings`: `rule_no_inbox`, `everyone_else_no_inbox`, `rule_slow` (over 5 days at the rule's capacity). Read-only. Needs the workspace's `sender_routing` flag, else `400 validation_failed` with detail code `feature_disabled`. Requires `ReadAccess`. A campaign outside the workspace is `not_found`.
+DEV-5225. `allInboxes` is the campaign's inbox mode. Each rule sends the first email to prospects on its mailbox provider or security gateway only from its domains and inboxes; a gateway rule wins over a mailbox provider rule, and prospects no rule matches go from the inboxes no rule claims (`everyoneElse`). Per rule and for Everyone else: the campaign's inboxes that can send now (Kenso-sendable, not paused), their summed daily limits, and the leads that can still get an email and match now (at most 100,000 leads read; a lead whose provider is still being detected is in no group). `warnings`: `rule_no_inbox`, `everyone_else_no_inbox`, `rule_slow` (over 5 days at the rule's capacity). Read-only. Needs the workspace's `sender_routing` flag, else `400 validation_failed` with detail code `feature_disabled`. Requires Campaigns view. A campaign outside the workspace is `not_found`.
 
 - API: `GET /v1/campaigns/{campaignId}/sender-routing`
 - Generated from the API contract
@@ -7949,7 +8045,7 @@ kenso campaigns get-sender-routing --campaign-id <campaign-id>
 
 Return one campaign's weekly report.
 
-`weekOf` is any date (`YYYY-MM-DD`, from 2000-01-01 to one year from today) in the wanted Monday-to-Sunday week. `timeZone` is an IANA name; without it the campaign's sending time zone is used, else UTC. The week's dates are picked in that time zone; its numbers and `changed` are counted on those UTC days, like the Analytics tab. Without `weekOf` the report covers the latest week that has ended both there and in UTC. `week` and `toDate` are email counts from campaign performance. `toDate` and `segments` run from the campaign's creation (at most 366 days back) to the end of the week. `changed` and `next` are sentences built from data, not AI. `next` is as of the request, in the campaign's sending time zone, and is empty for a week older than the default week. A missing or cross-workspace campaign is `not_found`. Read-only. Requires `ReadAccess`.
+`weekOf` is any date (`YYYY-MM-DD`, from 2000-01-01 to one year from today) in the wanted Monday-to-Sunday week. `timeZone` is an IANA name; without it the campaign's sending time zone is used, else UTC. The week's dates are picked in that time zone; its numbers and `changed` are counted on those UTC days, like the Analytics tab. Without `weekOf` the report covers the latest week that has ended both there and in UTC. `week` and `toDate` are email counts from campaign performance. `toDate` and `segments` run from the campaign's creation (at most 366 days back) to the end of the week. `changed` and `next` are sentences built from data, not AI. `next` is as of the request, in the campaign's sending time zone, and is empty for a week older than the default week. A missing or cross-workspace campaign is `not_found`. Read-only. Requires Campaigns view.
 
 - API: `GET /v1/campaigns/{campaignId}/weekly-report`
 - Generated from the API contract
@@ -7970,7 +8066,7 @@ kenso campaigns get-weekly-report --campaign-id <campaign-id>
 
 Report whether a campaign's workflows can start.
 
-Replaces `startWorkflowReadiness` on the legacy `GET /v1/campaigns/{id}`. Runs the same checks that gate starting enrichment, verification, and AI workflows (imported contacts or an active signal, contact limit, name, schedule, email sequence, AI variables) and returns each one with `isPassed`. Sending launch readiness is `GET .../launch-readiness`. A campaign outside the workspace is `not_found`. Read-only. Requires `ReadAccess`.
+Replaces `startWorkflowReadiness` on the legacy `GET /v1/campaigns/{id}`. Runs the same checks that gate starting enrichment, verification, and AI workflows (imported contacts or an active signal, contact limit, name, schedule, email sequence, AI variables) and returns each one with `isPassed`. Sending launch readiness is `GET .../launch-readiness`. A campaign outside the workspace is `not_found`. Read-only. Requires Campaigns view.
 
 - API: `GET /v1/campaigns/{campaignId}/workflow-readiness`
 - Generated from the API contract
@@ -7989,7 +8085,7 @@ kenso campaigns get-workflow-readiness --campaign-id <campaign-id>
 
 Launch sending for a campaign.
 
-Requires `WriteAccess`. Returns the campaign after the launch command confirms. While the workspace's data is scheduled for deletion or being deleted, returns `409 invalid_state`.
+Requires Campaigns edit and the `launch` permission. Returns the campaign after the launch command confirms. While the workspace's data is scheduled for deletion or being deleted, returns `409 invalid_state`.
 
 - API: `POST /v1/campaigns/{campaignId}/launch`
 - Generated from the API contract
@@ -8008,7 +8104,7 @@ kenso campaigns launch --campaign-id <campaign-id>
 
 List campaigns in the current workspace.
 
-Includes archived campaigns and excludes approval-test drafts. Optional `status` is a comma-separated OR filter. `q` is a case-insensitive substring of the name, or of the owner's first name, last name, full name, or email. Optional `kind` is `sales` or `recruiting`. Each item carries `leadCount`, from one cached count of the workspace. It usually lags new or removed leads by under 15 minutes; on a very large workspace the first list after a quiet period can show an older count, which the next list corrects. A campaign that count has not seen is counted live, and a single-campaign read (`GET /v1/campaigns/{campaignId}`) counts live for a current number. `leadCount` is omitted when that count does not finish in time on a very large workspace. Each item carries `linkedInOnly`, true for a LinkedIn-only campaign, read once for the page. It is only on this list: it is omitted on a single-campaign read and when the read fails. Ordered by id. Read-only. Requires `ReadAccess`.
+Includes archived campaigns and excludes approval-test drafts. Optional `status` is a comma-separated OR filter. `q` is a case-insensitive substring of the name, or of the owner's first name, last name, full name, or email. Optional `kind` is `sales` or `recruiting`. Each item carries `leadCount`, from one cached count of the workspace. It usually lags new or removed leads by under 15 minutes; on a very large workspace the first list after a quiet period can show an older count, which the next list corrects. A campaign that count has not seen is counted live, and a single-campaign read (`GET /v1/campaigns/{campaignId}`) counts live for a current number. `leadCount` is omitted when that count does not finish in time on a very large workspace. Each item carries `linkedInOnly`, true for a LinkedIn-only campaign, read once for the page. It is only on this list: it is omitted on a single-campaign read and when the read fails. Ordered by id. Read-only. Requires Campaigns view.
 
 - API: `GET /v1/campaigns` (a list: `--limit`, `--cursor`, `--all`)
 - Generated from the API contract
@@ -8033,7 +8129,7 @@ kenso campaigns list --all
 
 List the AI workflows attached to a campaign.
 
-Ids: 1 qualification, 2 personalization, 3 rewriting, 4 segmentation, 6 scoring, 8 line check. Read-only. Requires `ReadAccess`. A campaign outside the workspace is `not_found`.
+Ids: 1 qualification, 2 personalization, 3 rewriting, 4 segmentation, 6 scoring, 8 line check. Read-only. Requires Campaigns view. A campaign outside the workspace is `not_found`.
 
 - API: `GET /v1/campaigns/{campaignId}/ai-workflows`
 - Generated from the API contract
@@ -8052,7 +8148,7 @@ kenso campaigns list-ai-workflows --campaign-id <campaign-id>
 
 List inboxes assigned to a campaign.
 
-Requires `ReadAccess`. A campaign outside the workspace is `not_found`.
+Requires Campaigns view. A campaign outside the workspace is `not_found`.
 
 - API: `GET /v1/campaigns/{campaignId}/inboxes`
 - Generated from the API contract
@@ -8071,7 +8167,7 @@ kenso campaigns list-inboxes --campaign-id <campaign-id>
 
 List LinkedIn accounts assigned to a campaign.
 
-Requires `ReadAccess`. A campaign outside the workspace is `not_found`.
+Requires Campaigns view. A campaign outside the workspace is `not_found`.
 
 - API: `GET /v1/campaigns/{campaignId}/linkedin-accounts`
 - Generated from the API contract
@@ -8090,7 +8186,7 @@ kenso campaigns list-linkedin-accounts --campaign-id <campaign-id>
 
 Count a campaign's leads by mailbox provider and security gateway.
 
-DEV-5225. Every active mailbox provider and security gateway with the campaign's leads behind it (0 included), most leads first: the leads that can still get an email, by the domain of the address they are sent to. A lead counts once under its mailbox provider and once under its security gateway. `pendingCount`: provider still being detected. `noProviderCount`: no listed provider. Counts cover at most 100,000 leads (`isPartial`). Read-only. Needs the `sender_routing` flag (`feature_disabled`). Requires `ReadAccess`. A campaign outside the workspace is `not_found`.
+DEV-5225. Every active mailbox provider and security gateway with the campaign's leads behind it (0 included), most leads first: the leads that can still get an email, by the domain of the address they are sent to. A lead counts once under its mailbox provider and once under its security gateway. `pendingCount`: provider still being detected. `noProviderCount`: no listed provider. Counts cover at most 100,000 leads (`isPartial`). Read-only. Needs the `sender_routing` flag (`feature_disabled`). Requires Campaigns view. A campaign outside the workspace is `not_found`.
 
 - API: `GET /v1/campaigns/{campaignId}/recipient-providers`
 - Generated from the API contract
@@ -8109,7 +8205,7 @@ kenso campaigns list-recipient-providers --campaign-id <campaign-id>
 
 Pause sending, processing, and AI workflows together.
 
-Idempotent. A campaign that is already paused returns `200` with the unchanged resource. A subsystem that is not running is left as it is. If any subsystem fails, the action returns that error and the caller can retry. A campaign that is still launching returns `409 invalid_state`. Requires `WriteAccess`.
+Idempotent. A campaign that is already paused returns `200` with the unchanged resource. A subsystem that is not running is left as it is. If any subsystem fails, the action returns that error and the caller can retry. A campaign that is still launching returns `409 invalid_state`. Requires Campaigns edit and the `launch` permission.
 
 - API: `POST /v1/campaigns/{campaignId}/pause`
 - Generated from the API contract
@@ -8128,7 +8224,7 @@ kenso campaigns pause --campaign-id <campaign-id>
 
 Replace the AI workflows attached to a campaign.
 
-Full replace: send every workflow id the campaign should run in `aiWorkflowIds`. Ids not listed are detached, and an empty list detaches all of them. Read the current set first to add one workflow. Ids: 1 qualification, 2 personalization, 3 rewriting, 4 segmentation, 6 scoring, 8 line check. Rewriting runs only when the campaign has rewriting prompts. Line check (8) grades personalization lines before they are saved and holds a contact whose lines fail; a campaign gets it with personalization by default, and detaching it is the opt-out. This route does not add it: keep 8 in the list to keep it on. While the campaign is scheduled, launching, or sending, 1, 2, and 4 must stay as they are and 3 may only be added; any other change to them is `invalid_state` (409) because they gate which contacts may send, so pause first. 6 and 8 can change at any time. No other campaign field changes. Requires `WriteAccess`. A campaign outside the workspace is `not_found` before the write.
+Full replace: send every workflow id the campaign should run in `aiWorkflowIds`. Ids not listed are detached, and an empty list detaches all of them. Read the current set first to add one workflow. Ids: 1 qualification, 2 personalization, 3 rewriting, 4 segmentation, 6 scoring, 8 line check. Rewriting runs only when the campaign has rewriting prompts. Line check (8) grades personalization lines before they are saved and holds a contact whose lines fail; a campaign gets it with personalization by default, and detaching it is the opt-out. This route does not add it: keep 8 in the list to keep it on. While the campaign is scheduled, launching, or sending, 1, 2, and 4 must stay as they are and 3 may only be added; any other change to them is `invalid_state` (409) because they gate which contacts may send, so pause first. 6 and 8 can change at any time. No other campaign field changes. Requires Campaigns edit. A campaign outside the workspace is `not_found` before the write.
 
 - API: `PUT /v1/campaigns/{campaignId}/ai-workflows`
 - Generated from the API contract
@@ -8179,7 +8275,7 @@ kenso campaigns replace-autopilot --campaign-id <campaign-id> --data @body.json
 
 Replace the inboxes assigned to a campaign.
 
-Full replace. Send `inboxIds`, or `assignAllActive` to assign every Kenso-sendable inbox. Either one fixes the pool to that list. `allInboxes: true` turns on live "All inboxes" instead: every inbox a launch would assign (paused inboxes the campaign lacks and blocked Migma senders left out) joins now and inboxes connected later join too; it ignores the other fields and needs the `sender_routing` flag for the workspace, else `400 validation_failed` with detail code `feature_disabled`. Requires `WriteAccess`. A campaign outside the workspace is `not_found` before the write.
+Full replace. Send `inboxIds`, or `assignAllActive` to assign every Kenso-sendable inbox. Either one fixes the pool to that list. `allInboxes: true` turns on live "All inboxes" instead: every inbox a launch would assign (paused inboxes the campaign lacks and blocked Migma senders left out) joins now and inboxes connected later join too; it ignores the other fields and needs the `sender_routing` flag for the workspace, else `400 validation_failed` with detail code `feature_disabled`. Requires Campaigns edit. A campaign outside the workspace is `not_found` before the write.
 
 - API: `PUT /v1/campaigns/{campaignId}/inboxes`
 - Generated from the API contract
@@ -8206,7 +8302,7 @@ kenso campaigns replace-inboxes --campaign-id <campaign-id> --data @body.json
 
 Replace the LinkedIn accounts assigned to a campaign.
 
-Full replace. Send `linkedinAccountIds`, or `assignAllConnected` to assign every Connected LinkedIn seat. Requires `WriteAccess`. A campaign outside the workspace is `not_found` before the write.
+Full replace. Send `linkedinAccountIds`, or `assignAllConnected` to assign every Connected LinkedIn seat. Requires Campaigns edit. A campaign outside the workspace is `not_found` before the write.
 
 - API: `PUT /v1/campaigns/{campaignId}/linkedin-accounts`
 - Generated from the API contract
@@ -8265,7 +8361,7 @@ kenso campaigns replace-linkedin-settings --campaign-id <campaign-id> --data @bo
 
 Turn lead scoring on or off for a campaign.
 
-Requires `WriteAccess`. A campaign outside the workspace is `not_found` before the write.
+Requires Campaigns edit. A campaign outside the workspace is `not_found` before the write.
 
 - API: `PUT /v1/campaigns/{campaignId}/scoring`
 - Generated from the API contract
@@ -8289,7 +8385,7 @@ kenso campaigns replace-scoring --campaign-id <campaign-id> --data @body.json
 
 Replace a campaign's sender routing rules.
 
-DEV-5225. Full replace: `rules` is every rule, `[]` clears them. Each rule names an active mailbox provider or security gateway `provider` slug (one rule per provider) and at least one whole sending domain in `domains` (lowercased when saved; inboxes added on it later join) or single `inboxIds`. Every domain must be the address domain of a workspace inbox and every inbox a workspace inbox, else `400 validation_failed` with detail codes `unknown_provider`, `unsupported_provider`, `duplicate_provider`, `empty_rule`, `unknown_domain` or `unknown_inbox`. Applies to first emails planned from now on and to queued first emails at send time; follow-ups stay on the first email's inbox. Returns the routing as `GET` does. Needs the `sender_routing` flag (`feature_disabled`). Requires `WriteAccess`. A campaign outside the workspace is `not_found` before the write.
+DEV-5225. Full replace: `rules` is every rule, `[]` clears them. Each rule names an active mailbox provider or security gateway `provider` slug (one rule per provider) and at least one whole sending domain in `domains` (lowercased when saved; inboxes added on it later join) or single `inboxIds`. Every domain must be the address domain of a workspace inbox and every inbox a workspace inbox, else `400 validation_failed` with detail codes `unknown_provider`, `unsupported_provider`, `duplicate_provider`, `empty_rule`, `unknown_domain` or `unknown_inbox`. Applies to first emails planned from now on and to queued first emails at send time; follow-ups stay on the first email's inbox. Returns the routing as `GET` does. Needs the `sender_routing` flag (`feature_disabled`). Requires Campaigns edit. A campaign outside the workspace is `not_found` before the write.
 
 - API: `PUT /v1/campaigns/{campaignId}/sender-routing`
 - Generated from the API contract
@@ -8311,7 +8407,7 @@ kenso campaigns replace-sender-routing --campaign-id <campaign-id> --data @body.
 
 Restart a campaign's processing.
 
-Re-runs the processing pipeline from the beginning, to recover a campaign that stalled or errored, or to reprocess after a configuration change. On a draft campaign it starts processing behind the same readiness checks as `resume`, and a draft trigger campaign is `400 validation_failed` (start it with `resume`). An archived campaign is `400 validation_failed`. A campaign with `autoLaunchWhenReady` launches once processing reaches ready. Returns the campaign. Requires `WriteAccess` and the launch permission. While the workspace's data is scheduled for deletion or being deleted, returns `409 invalid_state`.
+Re-runs the processing pipeline from the beginning, to recover a campaign that stalled or errored, or to reprocess after a configuration change. On a draft campaign it starts processing behind the same readiness checks as `resume`, and a draft trigger campaign is `400 validation_failed` (start it with `resume`). An archived campaign is `400 validation_failed`. A campaign with `autoLaunchWhenReady` launches once processing reaches ready. Returns the campaign. Requires Campaigns edit and the `launch` permission. While the workspace's data is scheduled for deletion or being deleted, returns `409 invalid_state`.
 
 - API: `POST /v1/campaigns/{campaignId}/restart`
 - Generated from the API contract
@@ -8330,7 +8426,7 @@ kenso campaigns restart --campaign-id <campaign-id>
 
 Resume sending, processing, and AI workflows together.
 
-Idempotent. A campaign that is already running returns `200` with the resource. A subsystem that was not paused is left as it is. If any subsystem fails, the action returns that error and the caller can retry. A campaign that is still launching returns `409 invalid_state`, and so does every campaign while the workspace's data is scheduled for deletion or being deleted. Requires `WriteAccess`.
+Idempotent. A campaign that is already running returns `200` with the resource. A subsystem that was not paused is left as it is. If any subsystem fails, the action returns that error and the caller can retry. A campaign that is still launching returns `409 invalid_state`, and so does every campaign while the workspace's data is scheduled for deletion or being deleted. Requires Campaigns edit and the `launch` permission.
 
 - API: `POST /v1/campaigns/{campaignId}/resume`
 - Generated from the API contract
@@ -8349,7 +8445,7 @@ kenso campaigns resume --campaign-id <campaign-id>
 
 Re-queue failed enrichment without restarting the campaign.
 
-Deletes failed website and email-finder markers so existing workers pick the contacts up again. Does not restart processing, and does not change qualification, personalization, or sent state. If data or email enrichment is paused, the markers are still cleared and workers wait until resume. Idempotent: clearing nothing is still `200`. An archived campaign is `validation_failed` and is not touched. A campaign outside the workspace is `not_found` before the retry. Requires `WriteAccess`.
+Deletes failed website and email-finder markers so existing workers pick the contacts up again. Does not restart processing, and does not change qualification, personalization, or sent state. If data or email enrichment is paused, the markers are still cleared and workers wait until resume. Idempotent: clearing nothing is still `200`. An archived campaign is `validation_failed` and is not touched. A campaign outside the workspace is `not_found` before the retry. Requires Campaigns edit.
 
 - API: `POST /v1/campaigns/{campaignId}/retry-enrichment`
 - Generated from the API contract
@@ -8368,7 +8464,7 @@ kenso campaigns retry-enrichment --campaign-id <campaign-id>
 
 Score contacts in a campaign.
 
-The run finishes in the request and returns a `lead_scoring` job. Poll it with `GET /v1/jobs/{jobId}?type=lead_scoring`. Scores are `qualityScore` on each contact. Requires `WriteAccess`. A campaign outside the workspace is `not_found` before the run.
+The run finishes in the request and returns a `lead_scoring` job. Poll it with `GET /v1/jobs/{jobId}?type=lead_scoring`. Scores are `qualityScore` on each contact. Requires Campaigns edit and the `ask` permission. A campaign outside the workspace is `not_found` before the run.
 
 - API: `POST /v1/campaigns/{campaignId}/scoring/run`
 - Generated from the API contract
@@ -8391,7 +8487,7 @@ kenso campaigns run-scoring --campaign-id <campaign-id> --data @body.json
 
 Update a campaign's name, contact limit, send schedule, ramp-up, owner, sending switches, same-company rules, account-play protection, new-leads-first order, catch-all lane, language settings, mode, or auto-launch.
 
-Absent fields stay unchanged. `status` is rejected. Unknown JSON members are a 400. A schedule or daily-cap change writes a planner request row (nothing consumes it any more, DEV-1821; gap-fill picks up the change on its next pass); `rampUpDays`, `stopCompanyOnReply` and `groupSameCompanySends` do not, as in the legacy update. `rampUpDays` is 0 (no ramp) to 30 scheduled sending days, else `400 validation_failed`. `stopCompanyOnReply` is the same stored value as `stopSequenceForCompanyOnReply` in the LinkedIn settings; it is written after the other fields. `ownerMemberId` must be an active member of the workspace, else `400 validation_failed` with detail code `not_a_member`. Changing `stopOnReply`, `trackClicks`, `trackOpens`, or `unsubscribeLink` needs the `campaign_send_settings` flag for the workspace, else `400 validation_failed` with detail code `feature_disabled` per field and nothing is written. Sending the stored value is accepted without the flag. `protectAccountPlays` turns skipping people in active account plays on or off for this campaign; people already stopped stay stopped. Requires `WriteAccess`. `newLeadsFirst` true gives first emails the campaign's daily capacity ahead of its follow-ups; it takes effect on the next gap-fill pass. While it is true the response carries `awaitingFirstEmailCount`. `catchAllLaneEnabled` true opts the campaign in to the catch-all lane: the sequencer may also send to unverified CatchAll addresses whose catch-all score clears a bar, capped per campaign and per inbox per day, until the lane's bounce circuit breaker pauses it. It does nothing until Kenso turns the lane on platform-wide. `catchAllLanePausedAt` is system-owned: sending it is an unknown member (`400`). `bookingMeetingTypeId` names a live, enabled round robin meeting type of this workspace that takes this campaign's bookings when the account owner and the sender can't; `null` clears it. `kind` cannot be changed: any value is `400 validation_failed` with detail code `kind_immutable`. `roleId` names a live role of this workspace for a recruiting campaign and needs the `recruiting` flag; `null` clears it. On a sales campaign it is `400` with detail code `not_recruiting`. `excludedCountries` replaces the countries this campaign never sends to: ISO 3166-1 alpha-2 codes or country names, stored as upper-case codes; `[]` clears it. An entry that names no country is `400 validation_failed` with detail code `invalid_country` and nothing is written. Imports drop a contact whose country is listed and the sequencer skips one already on the campaign, from its next pass. The language settings (`sourceLanguage`, `languageMode``source_only` or `auto`, `enabledLanguages`, `formalityOverrides` locale to `formal` or `informal`, and `languageFallback``source` or `hold`) need the `multilingual_outreach` flag for the workspace, else `400 validation_failed` with detail code `feature_disabled` per field sent, even for the stored value. A locale must be a market pack that is not a draft and `sourceLanguage` may also be a language with a primary pack (`en`), else detail code `unknown_language` or `draft_language`; any other bad value is `invalid_value`. `null`, `[]` or `{}` clears `enabledLanguages` or `formalityOverrides`. `mode` is `batch` or `trigger`, else `400 validation_failed`. Batch to trigger converts the campaign to signal-based sending; trigger to batch is `400 validation_failed` with detail code `mode_one_way` and nothing is written. `autoLaunchWhenReady` true launches the campaign once it is ready, with no further confirmation; changing it needs the launch permission (`403 forbidden`), is `400` once the campaign launched or for a trigger or approval-test campaign, and `409 conflict` once auto-launch has run. `mode``trigger` on a batch campaign is `400 validation_failed` on `autoLaunchWhenReady`, and nothing is written, when it comes with `autoLaunchWhenReady` true, or without it while the campaign is set to auto-launch: send `false` in the same request to turn that off.
+Absent fields stay unchanged. `status` is rejected. Unknown JSON members are a 400. A schedule or daily-cap change writes a planner request row (nothing consumes it any more, DEV-1821; gap-fill picks up the change on its next pass); `rampUpDays`, `stopCompanyOnReply` and `groupSameCompanySends` do not, as in the legacy update. `rampUpDays` is 0 (no ramp) to 30 scheduled sending days, else `400 validation_failed`. `stopCompanyOnReply` is the same stored value as `stopSequenceForCompanyOnReply` in the LinkedIn settings; it is written after the other fields. `ownerMemberId` must be an active member of the workspace, else `400 validation_failed` with detail code `not_a_member`. Changing `stopOnReply`, `trackClicks`, `trackOpens`, or `unsubscribeLink` needs the `campaign_send_settings` flag for the workspace, else `400 validation_failed` with detail code `feature_disabled` per field and nothing is written. Sending the stored value is accepted without the flag. `protectAccountPlays` turns skipping people in active account plays on or off for this campaign; people already stopped stay stopped. Requires Campaigns edit. `newLeadsFirst` true gives first emails the campaign's daily capacity ahead of its follow-ups; it takes effect on the next gap-fill pass. While it is true the response carries `awaitingFirstEmailCount`. `catchAllLaneEnabled` true opts the campaign in to the catch-all lane: the sequencer may also send to unverified CatchAll addresses whose catch-all score clears a bar, capped per campaign and per inbox per day, until the lane's bounce circuit breaker pauses it. It does nothing until Kenso turns the lane on platform-wide. `catchAllLanePausedAt` is system-owned: sending it is an unknown member (`400`). `bookingMeetingTypeId` names a live, enabled round robin meeting type of this workspace that takes this campaign's bookings when the account owner and the sender can't; `null` clears it. `kind` cannot be changed: any value is `400 validation_failed` with detail code `kind_immutable`. `roleId` names a live role of this workspace for a recruiting campaign and needs the `recruiting` flag; `null` clears it. On a sales campaign it is `400` with detail code `not_recruiting`. `excludedCountries` replaces the countries this campaign never sends to: ISO 3166-1 alpha-2 codes or country names, stored as upper-case codes; `[]` clears it. An entry that names no country is `400 validation_failed` with detail code `invalid_country` and nothing is written. Imports drop a contact whose country is listed and the sequencer skips one already on the campaign, from its next pass. The language settings (`sourceLanguage`, `languageMode``source_only` or `auto`, `enabledLanguages`, `formalityOverrides` locale to `formal` or `informal`, and `languageFallback``source` or `hold`) need the `multilingual_outreach` flag for the workspace, else `400 validation_failed` with detail code `feature_disabled` per field sent, even for the stored value. A locale must be a market pack that is not a draft and `sourceLanguage` may also be a language with a primary pack (`en`), else detail code `unknown_language` or `draft_language`; any other bad value is `invalid_value`. `null`, `[]` or `{}` clears `enabledLanguages` or `formalityOverrides`. `mode` is `batch` or `trigger`, else `400 validation_failed`. Batch to trigger converts the campaign to signal-based sending; trigger to batch is `400 validation_failed` with detail code `mode_one_way` and nothing is written. `autoLaunchWhenReady` true launches the campaign once it is ready, with no further confirmation; changing it needs the launch permission (`403 forbidden`), is `400` once the campaign launched or for a trigger or approval-test campaign, and `409 conflict` once auto-launch has run. `mode``trigger` on a batch campaign is `400 validation_failed` on `autoLaunchWhenReady`, and nothing is written, when it comes with `autoLaunchWhenReady` true, or without it while the campaign is set to auto-launch: send `false` in the same request to turn that off.
 
 - API: `PATCH /v1/campaigns/{campaignId}`
 - Generated from the API contract
@@ -8485,7 +8581,7 @@ kenso checkout-sessions create --data @body.json
 
 List stage checkpoints for a build session.
 
-Ordered by id. Read-only. Requires `ReadAccess`.
+Ordered by id. Read-only. Requires Campaigns view.
 
 - API: `GET /v1/build-sessions/{buildSessionId}/checkpoints` (a list: `--limit`, `--cursor`, `--all`)
 - Generated from the API contract
@@ -8646,7 +8742,7 @@ kenso cli-logins token --data @body.json
 
 Download a weekly click report CSV.
 
-Streams the clicked-leads CSV of the weekly click-report email whose link carries `reportToken`. Requires `ExportAccess` (Export and Campaigns view) in the workspace and account scope all, because the CSV covers every account. An unknown token, or a token of another workspace, is `404 not_found`; an expired report is `410 gone`. The CSV holds lead PII: `Cache-Control: private, no-store`.
+Streams the clicked-leads CSV of the weekly click-report email whose link carries `reportToken`. Requires Campaigns view and the `export` permission in the workspace and account scope all, because the CSV covers every account. An unknown token, or a token of another workspace, is `404 not_found`; an expired report is `410 gone`. The CSV holds lead PII: `Cache-Control: private, no-store`.
 
 - API: `GET /v1/click-reports/{reportToken}/content`
 - Generated from the API contract
@@ -8984,7 +9080,7 @@ kenso committee-seats delete --seat-id <seat-id>
 
 Return one company in the current workspace.
 
-A missing or cross-workspace id is `not_found`. Requires `ReadAccess`.
+A missing or cross-workspace id is `not_found`. Requires Campaigns view.
 
 - API: `GET /v1/companies/{companyId}`
 - Generated from the API contract
@@ -9003,7 +9099,7 @@ kenso companies get --company-id <company-id>
 
 List companies in the current workspace.
 
-Ordered by id. `q` matches the name. `domain` is an exact match. Requires `ReadAccess`.
+Ordered by id. `q` matches the name. `domain` is an exact match. Requires Campaigns view.
 
 - API: `GET /v1/companies` (a list: `--limit`, `--cursor`, `--all`)
 - Generated from the API contract
@@ -9051,7 +9147,7 @@ kenso company-data get
 
 Return the behavior signals of the person behind a contact.
 
-`workspace` holds this workspace's own evidence: `tags` (such as `cold_responder`, `prefers_linkedin`, `best_window:weekday_morning`, `away_until:2026-11-18`), `signals` (`{key, value, rate, touches, responses}`, rate 0 to 1), `touches` and `computedAt` (rebuilt nightly). `network` has the same fields from every Kenso workspace, anonymous, plus `workspaces` (how many other workspaces touched the person); it never says which workspace, sender, campaign or reply, and it is present only with the `behavior_signals_network` feature and when at least one other workspace touched the person. `email_confirmed`, `email_dead_end` and `left_company` are tagged only for the contact's own email address or its company domain. Absent means null: no `workspace` when the workspace has no profile for the person, and an empty object when the contact has no LinkedIn URL and no email. A contact outside the workspace or deleted is `not_found`. Requires `ReadAccess` and the `behavior_signals` feature.
+`workspace` holds this workspace's own evidence: `tags` (such as `cold_responder`, `prefers_linkedin`, `best_window:weekday_morning`, `away_until:2026-11-18`), `signals` (`{key, value, rate, touches, responses}`, rate 0 to 1), `touches` and `computedAt` (rebuilt nightly). `network` has the same fields from every Kenso workspace, anonymous, plus `workspaces` (how many other workspaces touched the person); it never says which workspace, sender, campaign or reply, and it is present only with the `behavior_signals_network` feature and when at least one other workspace touched the person. `email_confirmed`, `email_dead_end` and `left_company` are tagged only for the contact's own email address or its company domain. Absent means null: no `workspace` when the workspace has no profile for the person, and an empty object when the contact has no LinkedIn URL and no email. A contact outside the workspace or deleted is `not_found`. Requires Campaigns view and the `behavior_signals` feature.
 
 - Beta: needs the `behavior_signals` feature flag on the workspace.
 - API: `GET /v1/contacts/{contactId}/behavior`
@@ -9073,7 +9169,7 @@ kenso contact-behavior get --contact-id <contact-id>
 
 Download a contact export file.
 
-Streams CSV, or a ZIP when a campaign export is one file per segment. Each download is sized from a live count and charged to the export row quota before any row is read; a file over the per-request row cap is `429 quota_exceeded`. Requires `ExportAccess`. A missing or expired export is `not_found`.
+Streams CSV, or a ZIP when a campaign export is one file per segment. Each download is sized from a live count and charged to the export row quota before any row is read; a file over the per-request row cap is `429 quota_exceeded`. Requires Campaigns view and the `export` permission. A missing or expired export is `not_found`.
 
 - API: `GET /v1/contact-exports/{exportId}/content`
 - Generated from the API contract
@@ -9092,7 +9188,7 @@ kenso contact-exports content --export-id <export-id>
 
 Create a contact export and return its job.
 
-`kind` is `contacts` (workspace filters), `campaign`, `clicked`, `advanced`, or `events`. Campaign kinds require `campaignId` in the current workspace. `events` also requires `occurredAfter` and `occurredBefore`. Requires `ExportAccess`. Poll `GET /v1/jobs/{jobId}?type=contact_export`. The job's `downloadUrl` streams the file. Contacts from a Kenso library list are never exported. For kinds `contacts`, `campaign` and `advanced` the job's `excludedLibraryContacts` says how many were left out, including 0. Kind `contacts` also takes `campaignIds` (1 to 50 campaigns of the workspace, not with `campaignId`), `listId` (a contact's import list), `createdAfter` (inclusive) and `createdBefore` (exclusive), `maxRows` (1 to 50000) and `skipRows` (in contact id order). Other kinds refuse them. `readyOnly` still needs one `campaignId`.
+`kind` is `contacts` (workspace filters), `campaign`, `clicked`, `advanced`, or `events`. Campaign kinds require `campaignId` in the current workspace. `events` also requires `occurredAfter` and `occurredBefore`. Requires Campaigns view and the `export` permission. Poll `GET /v1/jobs/{jobId}?type=contact_export`. The job's `downloadUrl` streams the file. Contacts from a Kenso library list are never exported. For kinds `contacts`, `campaign` and `advanced` the job's `excludedLibraryContacts` says how many were left out, including 0. Kind `contacts` also takes `campaignIds` (1 to 50 campaigns of the workspace, not with `campaignId`), `listId` (a contact's import list), `createdAfter` (inclusive) and `createdBefore` (exclusive), `maxRows` (1 to 50000) and `skipRows` (in contact id order). Other kinds refuse them. `readyOnly` still needs one `campaignId`.
 
 - API: `POST /v1/contact-exports`
 - Generated from the API contract
@@ -9140,7 +9236,7 @@ kenso contact-exports create --data @body.json
 
 Write a contact export to a new Google Sheet.
 
-Builds the same rows `GET /v1/contact-exports/{exportId}/content` streams and writes them to a new spreadsheet, `Kenso export - {campaign name or Contacts} - {yyyy-MM-dd}`, in the caller's own Google Drive through their Kenso Workspace Google connection. Cells are written as text, never as formulas, and a cell that starts like a formula (`=`, `@`, a tab or line break, or `+` or `-` that is not a number or phone number) keeps a leading apostrophe, as in the CSV download. A campaign export that is one file per segment is `409 invalid_state`: export one segment at a time. Google refusing to create or write the sheet in the member's Drive is `409 invalid_state` too. No usable Google connection is `409 reconnect_required`; Google failing or rate-limiting is `503 provider_unavailable`. Counts against the same export row limits as the download. Requires `ExportAccess` and the `google_sheets` feature flag (404 without it).
+Builds the same rows `GET /v1/contact-exports/{exportId}/content` streams and writes them to a new spreadsheet, `Kenso export - {campaign name or Contacts} - {yyyy-MM-dd}`, in the caller's own Google Drive through their Kenso Workspace Google connection. Cells are written as text, never as formulas, and a cell that starts like a formula (`=`, `@`, a tab or line break, or `+` or `-` that is not a number or phone number) keeps a leading apostrophe, as in the CSV download. A campaign export that is one file per segment is `409 invalid_state`: export one segment at a time. Google refusing to create or write the sheet in the member's Drive is `409 invalid_state` too. No usable Google connection is `409 reconnect_required`; Google failing or rate-limiting is `503 provider_unavailable`. Counts against the same export row limits as the download. Requires Campaigns view, the `export` permission and the `google_sheets` feature flag (404 without it).
 
 - Beta: needs the `google_sheets` feature flag on the workspace.
 - API: `POST /v1/contact-exports/{exportId}/google-sheet`
@@ -9162,7 +9258,7 @@ kenso contact-exports google-sheet --export-id <export-id>
 
 List contact fields for the column picker, CSV export, and CSV import.
 
-The catalog is static. `usages` is `list`, `export`, and/or `import`. Ordered with `qualityReasoning` beside `qualityScore`. `securityGateway` and `mailboxProvider` are listed only when the workspace has security gateways. `customImage` (an import target) is listed only when the workspace has campaign images. `customVideo` (an import target) is listed only when the workspace has campaign videos. Requires `ReadAccess`.
+The catalog is static. `usages` is `list`, `export`, and/or `import`. Ordered with `qualityReasoning` beside `qualityScore`. `securityGateway` and `mailboxProvider` are listed only when the workspace has security gateways. `customImage` (an import target) is listed only when the workspace has campaign images. `customVideo` (an import target) is listed only when the workspace has campaign videos. Requires Campaigns view.
 
 - API: `GET /v1/contact-fields` (a list: `--limit`, `--cursor`, `--all`)
 - Generated from the API contract
@@ -9186,7 +9282,7 @@ kenso contact-fields list --all
 
 Preview the buyers Ken finds at a list of companies, for a campaign's ICP.
 
-Body: `campaignId` (required; another workspace's campaign is `404`), `companies` (1 to 50, each `{ key?, name?, domain? }` with a name or a domain, else `400 validation_failed` on `companies[i]`) and `perCompany` (1 to 3, default 3). Send a longer list in parts of 50. Example: `{ "campaignId": 812, "companies": [{ "key": "row-2", "name": "Northwind", "domain": "northwind.com" }], "perCompany": 3 }`. A company with a domain is the Kenso Search company that owns it: one Kenso Search also matches by the given name at that domain, else one whose website is the domain's home page. A company with only a page under the domain (`notion.so/...`) does not count, and no name match stands in for it. A company without a domain is found by a name only one company has. Unmatched companies say why (`acme.com is not in Kenso Search`, `could not match notion.so: no company in Kenso Search has it as its own website`, `no domain, name matches 3 companies`). A matched company lists up to `perCompany` people at it in the campaign's ICP (the titles, seniority, functions and exclusions of its live segments), best first, each with a one-line `reason`, and each person once in the whole answer, by Kenso id or LinkedIn URL (Kenso Search can hold one person twice); when the ICP finds too few, Ken fills the company from a looser search and marks those people `weakMatch`. No ICP ranks people by seniority, and `icp` is empty. `signal` is the company's latest hiring, funding or leadership change from the last 90 days. A company Kenso Search does not answer for in time is `failed`; retry it. Each person's `contact` is a `POST /v1/contact-imports``source: search` contact: post the kept ones unchanged to add them (dedupe, blocklist and lead credits apply there). Nothing is stored and nothing is charged; the companies times `perCompany` count against the workspace's `searchBrowseRows` quota (`429 quota_exceeded` past it). Requires `WriteAccess` and the Import feature.
+Body: `campaignId` (required; another workspace's campaign is `404`), `companies` (1 to 50, each `{ key?, name?, domain? }` with a name or a domain, else `400 validation_failed` on `companies[i]`) and `perCompany` (1 to 3, default 3). Send a longer list in parts of 50. Example: `{ "campaignId": 812, "companies": [{ "key": "row-2", "name": "Northwind", "domain": "northwind.com" }], "perCompany": 3 }`. A company with a domain is the Kenso Search company that owns it: one Kenso Search also matches by the given name at that domain, else one whose website is the domain's home page. A company with only a page under the domain (`notion.so/...`) does not count, and no name match stands in for it. A company without a domain is found by a name only one company has. Unmatched companies say why (`acme.com is not in Kenso Search`, `could not match notion.so: no company in Kenso Search has it as its own website`, `no domain, name matches 3 companies`). A matched company lists up to `perCompany` people at it in the campaign's ICP (the titles, seniority, functions and exclusions of its live segments), best first, each with a one-line `reason`, and each person once in the whole answer, by Kenso id or LinkedIn URL (Kenso Search can hold one person twice); when the ICP finds too few, Ken fills the company from a looser search and marks those people `weakMatch`. No ICP ranks people by seniority, and `icp` is empty. `signal` is the company's latest hiring, funding or leadership change from the last 90 days. A company Kenso Search does not answer for in time is `failed`; retry it. Each person's `contact` is a `POST /v1/contact-imports``source: search` contact: post the kept ones unchanged to add them (dedupe, blocklist and lead credits apply there). Nothing is stored and nothing is charged; the companies times `perCompany` count against the workspace's `searchBrowseRows` quota (`429 quota_exceeded` past it). Requires Campaigns edit and the `import` permission.
 
 - Beta: needs the `csv_buyer_preview` feature flag on the workspace.
 - API: `POST /v1/contact-imports/buyer-previews`
@@ -9210,7 +9306,7 @@ kenso contact-imports buyer-preview --data @body.json
 
 Start a contact import and return its job.
 
-JSON `source` is `campaign` (copy from `sourceCampaignId`), `search` (a `contacts` array, at most 1,000), `blitz` (the same `contacts` array, at most 1,000, for people picked in the Blitz tab of Search; the run's surface is Blitz and it counts no Kenso Search work), `loopster` (`records`, 1 to 1,000 people picked in the Loopster tab of Search, as its search returned them, and that search's `searchId`: when a record has no LinkedIn URL, Kenso reads it from a temporary table in the workspace's Loopster account, then trashes the table; the run's surface is Loopster and it counts no Kenso Search work) or `people` (`personIds`, 1 to 1,000 workspace people; each becomes a contact with their name, email, title, LinkedIn URL and the company of their highest-priority account; needs the `accounts` feature and Accounts view, and with account scope `own` takes only people on the caller's accounts), `event` (`eventId`, optional `roles` and `includeAccounts`: an outbound event's attendees with an email or a LinkedIn URL, at most 5,000; rows whose company is a workspace account are left out unless `includeAccounts` is true, and then with account scope `own` only those on the caller's accounts are added; needs the `accounts` and `event_outbound` features and Accounts view) or `sales_navigator` (`linkedinAccountId`, a seat the caller connected, and `url`, a Sales Navigator lead search or lead list; its people with their name, current title, LinkedIn profile and company. One import reads at most 8 pages (about 200 to 400 people): a list it cannot read to the end imports nothing and is `400 validation_failed` with code `incomplete_read` on `url`. Behind the `sales_navigator` feature, a seat without Sales Navigator is `409 sales_navigator_required`). Where the `linkedin_network` feature is on, `linkedin_connections` (`connectionIds`, 1 to 1,000 ids from `GET /v1/linkedin-connections`; each becomes a contact with first and last name, title, headline, LinkedIn URL, seniority and Kenso Search's company name, domain, LinkedIn URL, industry and size; needs Accounts view; elsewhere it is an unknown source). Multipart `source=csv` uploads a CSV file into `campaignId`; its optional form field `columnMappings` (a JSON array of mappings, as for a Google Sheet) sets the columns, and a mapped column the header row lacks is `400 validation_failed`; omitted, the header row is mapped by the import's aliases. Behind the `csv_import_check` feature (a field sent while it is off is `400 validation_failed` on that field) the CSV create also takes the List check choices of a scan: `fixes` (a JSON array of `missingKey`, `invalidEmail`, `noMx`, `catchAll`, `personalEmail`, `roleAddress`, `companyContacted`, `companyCap`) drops the rows the List check flags for them and counts each under its key in the job's `skipped`; `includeRecentlyContacted=true` keeps the rows the campaign's recently-emailed window would skip, for this import only; `cleanup=true` cleans the name, email, title, company, domain, LinkedIn URL and phone cells as the scan's cleanup notes say. Omitted, they are off. JSON `source``google_sheets` (behind the `google_sheets` flag) reads `spreadsheetId` (an id or a Google Sheets URL) and the optional `sheet` with the caller's own Kenso Workspace Google connection; row 1 is the header and `columnMappings` work as for a CSV. No connection is `409 reconnect_required`; a sheet not picked for Kenso is `409 sheet_not_shared`. JSON `source``airtable` (behind the `airtable` flag) reads every record of `tableId` (an id or name) in `baseId`, or of its `viewId` when set, with the workspace's Airtable token: the table's field names, primary field first, are the header and each record is a row of cell text. A table or view of more than 10,000 records is `400 validation_failed` on `tableId`: import it in parts through views. No token is `409 not_connected`; a token without the read scopes or access to the base is `409 scope_required`. JSON `source``saved_list` (behind the `saved_lists` flag; elsewhere it is an unknown source) imports the members of `savedListId`: a list of this workspace (a private one only for its owner), a list shared with it, or a library list. The optional `memberFilters` (`country`, `seniority`, `title`, `industry`, `headcountBand`, `hasSendableEmail`) narrow the members. A company list with `roles` (1 to 20 titles) imports up to 5 people per company found by Kenso Search, for at most 500 companies; without `roles` each company is one company contact. `findPeople` must be absent or false. Members this list already put in the campaign are skipped, so a retry adds only the rest. A library list's cached Safe emails land Safe with no email charge on a paid plan; a Free workspace gets no emails from a library list. A member copied out of a library list follows the same rules in any list. `columnMappings` is refused: the list sets its own columns. More than 100,000 contacts is `400 validation_failed` on `memberFilters`. Every source applies the import's dedupe, blocklist and contact limits. A JSON body over 10 MB is `413`; the multipart CSV upload accepts up to 400 MB. Requires `WriteAccess`. Poll `GET /v1/jobs/{jobId}?type=contact_import`. `linkedin_url` (`url`, optional `linkedinAccountId`, `maxLeads`, `postKinds`) queues a LinkedIn import that needs the `linkedin_url_import` flag. Options (DEV-15): `source=campaign` takes `importLimit` (above 0), `importOffset` (0 or more), `onlyImportQualifiedContacts`, `onlyImportValidContacts`, `deduplicateCampaignIds` (1 to 50 campaigns of the workspace; others are `not_found`), `deduplicationMode` (`none`, `by_email` the default, or `by_data`), `allowReimport`, `copyDataEnrichment` and `copyEmailEnrichment` (keep the source's enrichment results; default false). `source=search` (not `blitz`) takes `importLimit`, `triggerPostProcessing` (default true) and `tagIds` (1 to 50 workspace contact tags put on every imported contact). A multipart CSV takes the form fields `importLimit` and `tagIds` (a JSON array, for example `[3,4]`). An option sent with a source that does not honor it, or with `target=people`, is `400 validation_failed` on that field. `source=segment` copies one segment of the workspace (`sourceSegmentId`, from any campaign) into `campaignId` as a new segment with the source segment's name. `copyQualification`, `copyEmailEnrichment` and `copyEmailVerification` keep the source contacts' AI qualification, found emails and email verification (each default false). `segmentId` is refused (the copy makes its own segment); a segment name already in the campaign is `400`, and another import into it in progress is `409`. `target` is `campaign` (the default) or `people`. With `people` (behind the `lead_intake` feature, `404` when off, and Accounts edit) `campaignId` is optional and ignored: the rows of source `csv` (multipart, form field `target=people`), `search`, `blitz`, `event`, `linkedin_connections`, `sales_navigator`, `google_sheets` or `airtable` are queued and run through person intake as workspace people with source `import`. A row needs an email, a LinkedIn URL, or a name with a business company domain; others are skipped. The job's `personImport` reports the created, updated and skipped counts.
+JSON `source` is `campaign` (copy from `sourceCampaignId`), `search` (a `contacts` array, at most 1,000), `blitz` (the same `contacts` array, at most 1,000, for people picked in the Blitz tab of Search; the run's surface is Blitz and it counts no Kenso Search work), `loopster` (`records`, 1 to 1,000 people picked in the Loopster tab of Search, as its search returned them, and that search's `searchId`: when a record has no LinkedIn URL, Kenso reads it from a temporary table in the workspace's Loopster account, then trashes the table; the run's surface is Loopster and it counts no Kenso Search work) or `people` (`personIds`, 1 to 1,000 workspace people; each becomes a contact with their name, email, title, LinkedIn URL and the company of their highest-priority account; needs the `accounts` feature and Accounts view, and with account scope `own` takes only people on the caller's accounts), `event` (`eventId`, optional `roles` and `includeAccounts`: an outbound event's attendees with an email or a LinkedIn URL, at most 5,000; rows whose company is a workspace account are left out unless `includeAccounts` is true, and then with account scope `own` only those on the caller's accounts are added; needs the `accounts` and `event_outbound` features and Accounts view) or `sales_navigator` (`linkedinAccountId`, a seat the caller connected, and `url`, a Sales Navigator lead search or lead list; its people with their name, current title, LinkedIn profile and company. One import reads at most 8 pages (about 200 to 400 people): a list it cannot read to the end imports nothing and is `400 validation_failed` with code `incomplete_read` on `url`. Behind the `sales_navigator` feature, a seat without Sales Navigator is `409 sales_navigator_required`). Where the `linkedin_network` feature is on, `linkedin_connections` (`connectionIds`, 1 to 1,000 ids from `GET /v1/linkedin-connections`; each becomes a contact with first and last name, title, headline, LinkedIn URL, seniority and Kenso Search's company name, domain, LinkedIn URL, industry and size; needs Accounts view; elsewhere it is an unknown source). Multipart `source=csv` uploads a CSV file into `campaignId`; its optional form field `columnMappings` (a JSON array of mappings, as for a Google Sheet) sets the columns, and a mapped column the header row lacks is `400 validation_failed`; omitted, the header row is mapped by the import's aliases. Behind the `csv_import_check` feature (a field sent while it is off is `400 validation_failed` on that field) the CSV create also takes the List check choices of a scan: `fixes` (a JSON array of `missingKey`, `invalidEmail`, `noMx`, `catchAll`, `personalEmail`, `roleAddress`, `companyContacted`, `companyCap`) drops the rows the List check flags for them and counts each under its key in the job's `skipped`; `includeRecentlyContacted=true` keeps the rows the campaign's recently-emailed window would skip, for this import only; `cleanup=true` cleans the name, email, title, company, domain, LinkedIn URL and phone cells as the scan's cleanup notes say. Omitted, they are off. JSON `source``google_sheets` (behind the `google_sheets` flag) reads `spreadsheetId` (an id or a Google Sheets URL) and the optional `sheet` with the caller's own Kenso Workspace Google connection; row 1 is the header and `columnMappings` work as for a CSV. No connection is `409 reconnect_required`; a sheet not picked for Kenso is `409 sheet_not_shared`. JSON `source``airtable` (behind the `airtable` flag) reads every record of `tableId` (an id or name) in `baseId`, or of its `viewId` when set, with the workspace's Airtable token: the table's field names, primary field first, are the header and each record is a row of cell text. A table or view of more than 10,000 records is `400 validation_failed` on `tableId`: import it in parts through views. No token is `409 not_connected`; a token without the read scopes or access to the base is `409 scope_required`. JSON `source``saved_list` (behind the `saved_lists` flag; elsewhere it is an unknown source) imports the members of `savedListId`: a list of this workspace (a private one only for its owner), a list shared with it, or a library list. The optional `memberFilters` (`country`, `seniority`, `title`, `industry`, `headcountBand`, `hasSendableEmail`) narrow the members. A company list with `roles` (1 to 20 titles) imports up to 5 people per company found by Kenso Search, for at most 500 companies; without `roles` each company is one company contact. `findPeople` must be absent or false. Members this list already put in the campaign are skipped, so a retry adds only the rest. A library list's cached Safe emails land Safe with no email charge on a paid plan; a Free workspace gets no emails from a library list. A member copied out of a library list follows the same rules in any list. `columnMappings` is refused: the list sets its own columns. More than 100,000 contacts is `400 validation_failed` on `memberFilters`. Every source applies the import's dedupe, blocklist and contact limits. A JSON body over 10 MB is `413`; the multipart CSV upload accepts up to 400 MB. Requires Campaigns edit and the `import` permission. Poll `GET /v1/jobs/{jobId}?type=contact_import`. `linkedin_url` (`url`, optional `linkedinAccountId`, `maxLeads`, `postKinds`) queues a LinkedIn import that needs the `linkedin_url_import` flag. Options (DEV-15): `source=campaign` takes `importLimit` (above 0), `importOffset` (0 or more), `onlyImportQualifiedContacts`, `onlyImportValidContacts`, `deduplicateCampaignIds` (1 to 50 campaigns of the workspace; others are `not_found`), `deduplicationMode` (`none`, `by_email` the default, or `by_data`), `allowReimport`, `copyDataEnrichment` and `copyEmailEnrichment` (keep the source's enrichment results; default false). `source=search` (not `blitz`) takes `importLimit`, `triggerPostProcessing` (default true) and `tagIds` (1 to 50 workspace contact tags put on every imported contact). A multipart CSV takes the form fields `importLimit` and `tagIds` (a JSON array, for example `[3,4]`). An option sent with a source that does not honor it, or with `target=people`, is `400 validation_failed` on that field. `source=segment` copies one segment of the workspace (`sourceSegmentId`, from any campaign) into `campaignId` as a new segment with the source segment's name. `copyQualification`, `copyEmailEnrichment` and `copyEmailVerification` keep the source contacts' AI qualification, found emails and email verification (each default false). `segmentId` is refused (the copy makes its own segment); a segment name already in the campaign is `400`, and another import into it in progress is `409`. A campaign or segment copy Kenso cannot start right now (a full import queue, or its job could not be recorded) is `503 service_unavailable`: nothing was copied, so retry it. `target` is `campaign` (the default) or `people`. With `people` (behind the `lead_intake` feature, `404` when off, and Accounts edit) `campaignId` is optional and ignored: the rows of source `csv` (multipart, form field `target=people`), `search`, `blitz`, `event`, `linkedin_connections`, `sales_navigator`, `google_sheets` or `airtable` are queued and run through person intake as workspace people with source `import`. A row needs an email, a LinkedIn URL, or a name with a business company domain; others are skipped. The job's `personImport` reports the created, updated and skipped counts.
 
 - API: `POST /v1/contact-imports`
 - Generated from the API contract
@@ -9389,7 +9485,7 @@ kenso contact-limits update --data @body.json
 
 Soft-delete up to 1,000 contacts by id.
 
-Requires `ReadAccess`, matching `POST /v1/leads/bulk-delete`. Ids outside the workspace are reported in `failed` and are not deleted.
+Requires Campaigns edit. Ids outside the workspace are reported in `failed` and are not deleted.
 
 - API: `POST /v1/contacts/bulk-delete`
 - Generated from the API contract
@@ -9474,7 +9570,7 @@ kenso contacts bulk-resume --data @body.json
 
 Update fields on up to 1,000 contacts in one call.
 
-Each item is a `contactId` plus any fields `PATCH /v1/contacts/{contactId}` accepts, with the same semantics: absent fields stay unchanged, null clears a string. Items run one at a time in request order. A contact outside the workspace is `not_found` and is not written. A field error fails only that item. `results` is in request order; `status` is `updated`, `not_found`, `validation_failed`, `video_in_use` (the lead's video is used by a sent or queued step), or `failed`. The whole request is rejected, with nothing written, when `items` is empty, has more than 1,000 entries, has an entry that is not an object or lacks a positive `contactId`, or repeats a `contactId`. An item's `customVariables` merges as on the single update. Requires `WriteAccess`, matching the single update.
+Each item is a `contactId` plus any fields `PATCH /v1/contacts/{contactId}` accepts, with the same semantics: absent fields stay unchanged, null clears a string. Items run one at a time in request order. A contact outside the workspace is `not_found` and is not written. A field error fails only that item. `results` is in request order; `status` is `updated`, `not_found`, `validation_failed`, `video_in_use` (the lead's video is used by a sent or queued step), or `failed`. The whole request is rejected, with nothing written, when `items` is empty, has more than 1,000 entries, has an entry that is not an object or lacks a positive `contactId`, or repeats a `contactId`. An item's `customVariables` merges as on the single update. Requires Campaigns edit.
 
 - API: `POST /v1/contacts/bulk-update`
 - Generated from the API contract
@@ -9495,7 +9591,7 @@ kenso contacts bulk-update --data @body.json
 
 Add up to 1,000 contacts to a campaign.
 
-Uses the existing campaign lead upsert, in batches of 100. Accepted and updated rows are succeeded. A later batch can fail without rolling back earlier rows; the upsert is safe to retry. `customImageUrl` sets the lead's own image (an empty string clears it): a malformed URL fails its row before anything is written, and a refused image (campaign images off for the workspace) fails its row with the contact's id, the contact itself saved. `customVideo` sets the lead's own video (a share link or embed code; an empty string clears it): a value no supported provider matches fails its row before anything is written, a refused video (campaign videos off) fails its row with the contact's id, and a video a sent or queued step uses fails its row with code `video_in_use`, the contact saved and the old video kept. `customVariables` is an object of string values merged into the contact's custom variables (a null or empty value clears that key on an existing contact); a key new to the campaign joins its catalog with AI context off. A blank, unusable or reserved key, or more than 50 keys, fails its row before anything is written; a batch that would take the campaign past 50 custom variables fails every row in it. `emailValidity` (optional, `safe` for an email you already verified) qualifies a new contact on import in a campaign without AI qualification, spending one contact allowance; omitted keeps a stored verdict on an existing email. `useKenEmail` (optional) on a row with no email takes the address from Kenso's email pool when it holds a recently verified one for the person, free, for the first 25 such rows of the request; a row still without an email is refused unless the campaign is LinkedIn-only. Requires `WriteAccess`. `results` has one item per row in request order: `index`, `status` (`created`, `updated`, `skipped` or `failed`), `id` when saved, and for a skipped or failed row a `reason` (`duplicate`, `blocklisted`, `already_contacted`, `limit_reached`, `invalid_email`, `excluded`, `validation` or `other`) and a `message`. A saved row has `sendable`, false when the contact will not send (added unqualified with no contact allowance left, or do-not-contact).
+Uses the existing campaign lead upsert, in batches of 100. Accepted and updated rows are succeeded. A later batch can fail without rolling back earlier rows; the upsert is safe to retry. `customImageUrl` sets the lead's own image (an empty string clears it): a malformed URL fails its row before anything is written, and a refused image (campaign images off for the workspace) fails its row with the contact's id, the contact itself saved. `customVideo` sets the lead's own video (a share link or embed code; an empty string clears it): a value no supported provider matches fails its row before anything is written, a refused video (campaign videos off) fails its row with the contact's id, and a video a sent or queued step uses fails its row with code `video_in_use`, the contact saved and the old video kept. `customVariables` is an object of string values merged into the contact's custom variables (a null or empty value clears that key on an existing contact); a key new to the campaign joins its catalog with AI context off. A blank, unusable or reserved key, or more than 50 keys, fails its row before anything is written; a batch that would take the campaign past 50 custom variables fails every row in it. `emailValidity` (optional, `safe` for an email you already verified) qualifies a new contact on import in a campaign without AI qualification, spending one contact allowance; omitted keeps a stored verdict on an existing email. `useKenEmail` (optional) on a row with no email takes the address from Kenso's email pool when it holds a recently verified one for the person, free, for the first 25 such rows of the request; a row still without an email is refused unless the campaign is LinkedIn-only. Requires Campaigns edit. `results` has one item per row in request order: `index`, `status` (`created`, `updated`, `skipped` or `failed`), `id` when saved, and for a skipped or failed row a `reason` (`duplicate`, `blocklisted`, `already_contacted`, `limit_reached`, `invalid_email`, `excluded`, `validation` or `other`) and a `message`. A saved row has `sendable`, false when the contact will not send (added unqualified with no contact allowance left, or do-not-contact).
 
 - API: `POST /v1/campaigns/{campaignId}/contacts`
 - Generated from the API contract
@@ -9517,7 +9613,7 @@ kenso contacts create --campaign-id <campaign-id> --data @body.json
 
 Soft-delete one contact.
 
-Requires `WriteAccess`, matching the legacy contact delete.
+Requires Campaigns edit.
 
 - API: `DELETE /v1/contacts/{contactId}`
 - Generated from the API contract
@@ -9536,7 +9632,7 @@ kenso contacts delete --contact-id <contact-id>
 
 List events for one contact.
 
-Event ids are the stored event id, which is a string. Requires `ReadAccess`. A cursor is valid only with the same `limit` that issued it.
+Event ids are the stored event id, which is a string. Requires Campaigns view. A cursor is valid only with the same `limit` that issued it.
 
 - API: `GET /v1/contacts/{contactId}/events` (a list: `--limit`, `--cursor`, `--all`)
 - Generated from the API contract
@@ -9583,6 +9679,8 @@ kenso contacts export --campaign 812 --wait
 
 Return one contact in the current workspace.
 
+Also returns `dataFlags` (flags about the contact's data, as stored) and `personalEmails` (personal addresses a data provider found, newest first, for the reader only: never sent to). The list, search and update responses do not have them.
+
 - API: `GET /v1/contacts/{contactId}`
 - Generated from the API contract
 
@@ -9627,7 +9725,7 @@ kenso contacts import --campaign 812 --file big.csv --server-import --yes
 
 List contacts in the current workspace.
 
-Ordered by id. Requires `ReadAccess`. Each contact on the page counts one row of the workspace's `apiReadRows` quota (DEV-3685); past it, 429 `quota_exceeded` with `Retry-After`.
+Ordered by id. Requires Campaigns view. Each contact on the page counts one row of the workspace's `apiReadRows` quota (DEV-3685); past it, 429 `quota_exceeded` with `Retry-After`.
 
 - API: `GET /v1/contacts` (a list: `--limit`, `--cursor`, `--all`)
 - Generated from the API contract
@@ -9660,7 +9758,7 @@ kenso contacts list --all
 
 List every scraped website page of the contact's company.
 
-One entry per distinct page with its markdown and scrape date. `source` is `archive` for pages copied from the Common Crawl archive (then `scrapedAt` is the archive capture date), `live` for pages Kenso scraped, and `imported` for content supplied in a CSV upload (then `scrapedAt` is the upload time). Ordered home, about, pricing, products, customer pages, careers, then the rest; newest first within a type. Pages without content are left out. At most 50 pages, not paginated. Requires `ReadAccess`.
+One entry per distinct page with its markdown and scrape date. `source` is `archive` for pages copied from the Common Crawl archive (then `scrapedAt` is the archive capture date), `live` for pages Kenso scraped, and `imported` for content supplied in a CSV upload (then `scrapedAt` is the upload time). Ordered home, about, pricing, products, customer pages, careers, then the rest; newest first within a type. Pages without content are left out. At most 50 pages, not paginated. Requires Campaigns view.
 
 - API: `GET /v1/contacts/{contactId}/website-pages`
 - Generated from the API contract
@@ -9793,7 +9891,7 @@ kenso contacts resume --where '{"campaignIds": [812], "q": "acme"}' --yes
 
 Search contacts in the current workspace.
 
-Same filters as the list, plus more than one `campaignIds` value, lead `filters` groups, `readyOnly`, and `contactIds`. `q` is the free-text search. Ordered by id unless `sort` is set, in which case the cursor is an offset into that order. No total count. `readyOnly` requires exactly one campaign id. `securityGateway` and `mailboxProvider` filter on the contact's first Safe or Verified email and need security gateways on the workspace (400 otherwise). Requires `ReadAccess`. Pages count on `apiReadRows` like the list.
+Same filters as the list, plus more than one `campaignIds` value, lead `filters` groups, `readyOnly`, and `contactIds`. `q` is the free-text search. Ordered by id unless `sort` is set, in which case the cursor is an offset into that order. No total count. `readyOnly` requires exactly one campaign id. `securityGateway` and `mailboxProvider` filter on the contact's first Safe or Verified email and need security gateways on the workspace (400 otherwise). Requires Campaigns view. Pages count on `apiReadRows` like the list.
 
 - API: `POST /v1/contacts/search`
 - Generated from the API contract
@@ -10012,7 +10110,7 @@ kenso credit-model-usage create --data @body.json
 
 Return the credit rate card.
 
-The price of every credit action. Static: it does not depend on the workspace and sends no `X-Ken-Workspace-Id`. `millicreditsPerUnit` is per one unit; `unitSize` is the quantity prices are usually quoted for. Domain rows apply per whole dollar of `ceil(registrarUsd x 1.03) + 1`. The `web_scrape` row (per 1,000 pages, at 2x Firecrawl cost) is listed only once Kenso's Firecrawl price is configured, and the `podcast_search` row (per 1,000 Firecrawl credits a podcast lookup uses, at 2x Firecrawl cost) with it. The two places rows (a search page of up to 200 places, and a detail, reviews or photos open past 500 free a day) are listed only while Maps Data can run (MapsData:Enabled with an API key set). Any signed-in person.
+The price of every credit action. Static: it does not depend on the workspace and sends no `X-Ken-Workspace-Id`. `millicreditsPerUnit` is per one unit; `unitSize` is the quantity prices are usually quoted for. Domain rows apply per whole dollar of `ceil(registrarUsd x 1.03) + 1`. The `web_scrape` row (per 1,000 pages, at 2x Firecrawl cost) is listed only once Kenso's Firecrawl price is configured, and the `podcast_search` row (per 1,000 Firecrawl credits a podcast lookup uses, at 2x Firecrawl cost) with it. The two places rows (a search page of up to 200 places, and a detail, reviews or photos open past 500 free a day) are listed only while Maps Data can run (switched on, with an API key set). Any signed-in person.
 
 - API: `GET /v1/credits/rate-card`
 - Generated from the API contract
@@ -10601,7 +10699,7 @@ kenso crm-sync-issues retry --connection-id <connection-id> --issue-id <issue-id
 
 Declare one custom variable.
 
-Returns `201` and `Location`. An existing key is updated. Requires `WriteAccess`.
+Returns `201` and `Location`. An existing key is updated. Requires Campaigns edit.
 
 - API: `POST /v1/campaigns/{campaignId}/custom-variables`
 - Generated from the API contract
@@ -10629,7 +10727,7 @@ kenso custom-variables create --campaign-id <campaign-id> --data @body.json
 
 Remove one custom variable.
 
-Requires `WriteAccess`. Returns `204`.
+Requires Campaigns edit. Returns `204`.
 
 - API: `DELETE /v1/campaigns/{campaignId}/custom-variables/{variableKey}`
 - Generated from the API contract
@@ -10649,7 +10747,7 @@ kenso custom-variables delete --campaign-id <campaign-id> --variable-key <variab
 
 List a campaign's custom variables.
 
-Ordered by key. `q` matches the key or the name. Requires `ReadAccess`.
+Ordered by key. `q` matches the key or the name. Requires Campaigns view.
 
 - API: `GET /v1/campaigns/{campaignId}/custom-variables` (a list: `--limit`, `--cursor`, `--all`)
 - Generated from the API contract
@@ -10673,7 +10771,7 @@ kenso custom-variables list --campaign-id <campaign-id> --all
 
 Update one custom variable.
 
-Absent fields stay unchanged. Requires `WriteAccess`.
+Absent fields stay unchanged. Requires Campaigns edit.
 
 - API: `PATCH /v1/campaigns/{campaignId}/custom-variables/{variableKey}`
 - Generated from the API contract
@@ -11097,7 +11195,7 @@ kenso doctor --profile client-a --output json
 
 Start a domain health check.
 
-Returns `202` with a `domain_health` job. A check already running for the workspace is `409 conflict` and `data.id` is that running job. Requires `WriteAccess`. Example: `{ "domainIds": [4, 9] }`.
+Returns `202` with a `domain_health` job. A check already running for the workspace is `409 conflict` and `data.id` is that running job. Requires Delivery edit. Example: `{ "domainIds": [4, 9] }`.
 
 - API: `POST /v1/domain-health-checks`
 - Generated from the API contract
@@ -11336,7 +11434,7 @@ kenso domain-orders search --data @body.json
 
 Apply one field update to up to 1,000 domains.
 
-Requires `WriteAccess`. Auto-renew requires Delivery edit and the Billing feature. Masking and catch-all require `SuperAdmin`. `websiteMode` (`redirect` or `page`) records the person's answer to "rebuild or redirect"; it cannot be cleared. A `tagIds` entry the workspace has no tag for is `404 not_found`, and nothing is written.
+Requires Delivery edit. Auto-renew requires Delivery edit and the `billing` permission. `websiteMode` (`redirect` or `page`) records the person's answer to "rebuild or redirect"; it cannot be cleared. A `tagIds` entry the workspace has no tag for is `404 not_found`, and nothing is written.
 
 - API: `POST /v1/domains/bulk-update`
 - Generated from the API contract
@@ -11404,7 +11502,7 @@ kenso domains create-inbox --domain-id <domain-id> --data @body.json
 
 Delete a domain.
 
-Returns `204`. Requires `WriteAccess`.
+Returns `204`. Requires Delivery edit.
 
 - API: `DELETE /v1/domains/{domainId}`
 - Generated from the API contract
@@ -11496,7 +11594,7 @@ kenso domains list --all
 
 Update a domain. Absent fields stay unchanged. Null clears text fields and tag ids.
 
-Requires `WriteAccess`. Auto-renew requires Delivery edit and the Billing feature. Masking and catch-all require `SuperAdmin`. `websiteMode` (`redirect` or `page`) records the person's answer to "rebuild or redirect"; it cannot be cleared. A `tagIds` entry the workspace has no tag for is `404 not_found`, and nothing is written.
+Requires Delivery edit. Auto-renew requires Delivery edit and the `billing` permission. `websiteMode` (`redirect` or `page`) records the person's answer to "rebuild or redirect"; it cannot be cleared. A `tagIds` entry the workspace has no tag for is `404 not_found`, and nothing is written.
 
 - API: `PATCH /v1/domains/{domainId}`
 - Generated from the API contract
@@ -11518,7 +11616,7 @@ kenso domains update --domain-id <domain-id> --data @body.json
 
 Verify Kenso tracking DNS for one domain.
 
-Requires `WriteAccess`.
+Requires Delivery edit.
 
 - API: `POST /v1/domains/{domainId}/verify-dns`
 - Generated from the API contract
@@ -11680,7 +11778,7 @@ kenso email-sequences get --campaign-id <campaign-id>
 
 Preview the campaign email sequence for one contact.
 
-Requires `ReadAccess`. Variable types are lowercase snake_case. Each step shows the text dispatch sends the contact: a contact routed to another language gets the approved localization with its `language`, English `mirrorSubject` and `mirrorBody`, and `qaScore`. `language` previews as a contact in that language instead. Pass `contactId`, or `useRandom=true` to preview a random contact of the campaign; with neither the call is `400 validation_failed` on `contactId`. A contact outside the campaign, or a campaign with no contacts to pick, is `404 not_found`. `senderEmailId` previews from that inbox of the campaign, as the test send sends from it: its names, signature and unsubscribe host fill the steps, and `sender` names it. Without it, or with an inbox the campaign does not use, the first sender by email fills them.
+Requires Campaigns view. Variable types are lowercase snake_case. Each step shows the text dispatch sends the contact: a contact routed to another language gets the approved localization with its `language`, English `mirrorSubject` and `mirrorBody`, and `qaScore`. `language` previews as a contact in that language instead. Pass `contactId`, or `useRandom=true` to preview a random contact of the campaign; with neither the call is `400 validation_failed` on `contactId`. A contact outside the campaign, or a campaign with no contacts to pick, is `404 not_found`. `senderEmailId` previews from that inbox of the campaign, as the test send sends from it: its names, signature and unsubscribe host fill the steps, and `sender` names it. Without it, or with an inbox the campaign does not use, the first sender by email fills them.
 
 - API: `GET /v1/campaigns/{campaignId}/email-sequence/preview`
 - Generated from the API contract
@@ -11704,7 +11802,7 @@ kenso email-sequences preview --campaign-id <campaign-id>
 
 Replace the campaign email sequence.
 
-Creates the sequence when none exists. Requires `SequenceEditAccess`. A link the URL reputation check refuses is 400 `validation_failed` with one `link_reputation_blocked` detail per link: `field``steps[i].subject` or `steps[i].body`, `rule`, `stepOrder` and, for a saved step, `stepId`. Send `expectedModifiedAt` (the `modifiedAt` from your last read) so an edit made since is not overwritten.
+Creates the sequence when none exists. Requires Campaigns edit. A link the URL reputation check refuses is 400 `validation_failed` with one `link_reputation_blocked` detail per link: `field``steps[i].subject` or `steps[i].body`, `rule`, `stepOrder` and, for a saved step, `stepId`. Send `expectedModifiedAt` (the `modifiedAt` from your last read) so an edit made since is not overwritten.
 
 - API: `PUT /v1/campaigns/{campaignId}/email-sequence`
 - Generated from the API contract
@@ -11730,7 +11828,7 @@ kenso email-sequences replace --campaign-id <campaign-id> --data @body.json
 
 Send the campaign email sequence to test recipients.
 
-`targetEmails` takes at most 5 valid addresses, none on the workspace blocklist or hard bounced. Once the campaign has inboxes, `senderEmailId` must be one of them. Each recipient x step counts against the workspace's daily test-send emails (429 when used up). Requires `SequenceEditAccess`. Each step goes out as dispatch sends it to the contact, in the contact's language or in `language`; `notes` names a step sent as an approved translation.
+`targetEmails` takes at most 5 valid addresses, none on the workspace blocklist or hard bounced. Once the campaign has inboxes, `senderEmailId` must be one of them. Each recipient x step counts against the workspace's daily test-send emails (429 when used up). Requires Campaigns edit. Each step goes out as dispatch sends it to the contact, in the contact's language or in `language`; `notes` names a step sent as an approved translation.
 
 - API: `POST /v1/campaigns/{campaignId}/email-sequence/test-send`
 - Generated from the API contract
@@ -11758,7 +11856,7 @@ kenso email-sequences test-send --campaign-id <campaign-id> --data @body.json
 
 Email the conversation to support.
 
-Replaces `POST /v1/support-chat/escalate`. The workspace is `X-Ken-Workspace-Id`. Requires `ReadAccess`.
+Replaces `POST /v1/support-chat/escalate`. The workspace is `X-Ken-Workspace-Id`. Requires the `ask` permission.
 
 - API: `POST /v1/support/escalations`
 - Generated from the API contract
@@ -13376,7 +13474,7 @@ kenso inbound-webhooks delete --inbound-webhook-id <inbound-webhook-id>
 
 List recent deliveries for an inbound webhook.
 
-The delivery log has no numeric id, so this window uses `limit` (1 to 100, default 100) and omits `totalCount`. Requires `ReadAccess`.
+The delivery log has no numeric id, so this window uses `limit` (1 to 100, default 100) and omits `totalCount`. Requires the `integrations` permission.
 
 - API: `GET /v1/inbound-webhooks/{inboundWebhookId}/deliveries`
 - Generated from the API contract
@@ -13396,7 +13494,7 @@ kenso inbound-webhooks deliveries --inbound-webhook-id <inbound-webhook-id>
 
 Return one inbound webhook in the current workspace.
 
-A missing or cross-workspace id is `not_found`. Requires `ReadAccess`.
+A missing or cross-workspace id is `not_found`. Requires the `integrations` permission.
 
 - API: `GET /v1/inbound-webhooks/{inboundWebhookId}`
 - Generated from the API contract
@@ -13415,7 +13513,7 @@ kenso inbound-webhooks get --inbound-webhook-id <inbound-webhook-id>
 
 List a campaign's inbound webhooks in the current workspace.
 
-Ordered by id. Read-only. Requires `ReadAccess`.
+Ordered by id. Read-only. Requires the `integrations` permission.
 
 - API: `GET /v1/campaigns/{campaignId}/inbound-webhooks` (a list: `--limit`, `--cursor`, `--all`)
 - Generated from the API contract
@@ -13438,7 +13536,7 @@ kenso inbound-webhooks list --campaign-id <campaign-id> --all
 
 List the workspace's people webhooks.
 
-A people webhook runs lead intake on every delivery: it creates or updates a person (source `form` for the form presets, `visitor` for rb2b and vector, else `webhook`). Ordered by id. A campaign's webhooks are listed under the campaign. Requires the `accounts` and `lead_intake` features. Read-only. Requires `ReadAccess`.
+A people webhook runs lead intake on every delivery: it creates or updates a person (source `form` for the form presets, `visitor` for rb2b and vector, else `webhook`). Ordered by id. A campaign's webhooks are listed under the campaign. Requires the `accounts` and `lead_intake` features. Read-only. Requires the `integrations` permission.
 
 - Beta: needs the `accounts` and `lead_intake` feature flag on the workspace.
 - API: `GET /v1/inbound-webhooks` (a list: `--limit`, `--cursor`, `--all`)
@@ -13626,7 +13724,7 @@ kenso inbox-stock get
 
 Apply one field update to up to 1,000 inboxes.
 
-`paused` pauses or resumes every selected inbox, as on `PATCH /v1/inboxes/{inboxId}`. `profileImageUrl` sets one photo, as on the PATCH, on up to 100 inboxes and takes no other field: `updatedCount` counts the inboxes InboxKit accepted, each other one is in `failed` with the reason. A `tagIds` entry the workspace has no tag for is `404 not_found`, and nothing is written. Needs Delivery edit.
+`paused` pauses or resumes every selected inbox, as on `PATCH /v1/inboxes/{inboxId}`. `profileImageUrl` sets one photo, as on the PATCH, on up to 100 inboxes and takes no other field: `updatedCount` counts the inboxes InboxKit accepted, each other one is in `failed` with the reason. `forwardingDestination` is set or cleared through InboxKit on each inbox the same way: an inbox InboxKit refused, or one not linked to InboxKit, is in `failed` and left out of `updatedCount`. A destination the request cannot take (malformed, or a Kenso-hosted address), or forwarding being unavailable (InboxKit not configured), is `400`, and nothing is written. A `tagIds` entry the workspace has no tag for is `404 not_found`, and nothing is written. An inbox listed in `failed` is never counted in `updatedCount`, and an id sent twice counts once. Needs Delivery edit.
 
 - API: `POST /v1/inboxes/bulk-update`
 - Generated from the API contract
@@ -13728,7 +13826,7 @@ kenso inboxes create-connect-confirmation --data @body.json
 
 Start a Gmail or Microsoft connect.
 
-`provider` is `google` or `microsoft`. `purpose` is `primary` (the caller's own mailbox, through the Kenso Workspace app; `not_found` without Kenso Accounts) or `campaign` (a shared campaign mailbox, through Kenso Mail). Open `authorizationUrl` before `expiresAt`; nothing is stored until the connect finishes. It finishes in the Kenso dashboard (DEV-2228): after consent the provider sends the browser there, and the member who created the session (for an API key, its owner) must be signed in, in this workspace. Anyone else is refused and nothing is connected, so a key that names no member cannot finish a connect. Requires delivery edit, like the legacy `authorize` routes. A client seat (Delivery view, `approve_own_sends`) connects only its own primary inbox: `purpose=campaign` is `403 forbidden` with `own_inbox_only`, and a login email off the workspace's email domain (or a workspace with none) is `409 invalid_state` with `email_domain_mismatch`, whose message says what fixes it, because that mailbox would never be its primary inbox. A grant for any mailbox but the caller's login email waits for `POST /v1/inboxes/connect-confirmations`, which needs delivery edit, so a client seat connects only its login email. Declared `[WorkspaceMember]`; the action decides delivery edit or `approve_own_sends` (DEV-1811). Optional `returnTo` (DEV-1611) is a dashboard path the finished connect lands on, on the dashboard's own origin, with the usual result query (`gmail=connected`, `microsoft=error&reason=...`); for Microsoft the admin-consent return lands there too. Anything but a relative path with one leading `/`, no `//`, backslash or control characters, at most 512 characters, is `validation_failed` on `returnTo`. Without it the connect returns to the app's default page.
+`provider` is `google` or `microsoft`. `purpose` is `primary` (the caller's own mailbox, through the Kenso Workspace app; `not_found` without Kenso Accounts) or `campaign` (a shared campaign mailbox, through Kenso Mail). Open `authorizationUrl` before `expiresAt`; nothing is stored until the connect finishes. It finishes in the Kenso dashboard (DEV-2228): after consent the provider sends the browser there, and the member who created the session (for an API key, its owner) must be signed in, in this workspace. Anyone else is refused and nothing is connected, so a key that names no member cannot finish a connect. Requires delivery edit, like the legacy `authorize` routes. A client seat (Delivery view, `approve_own_sends`) connects only its own primary inbox: `purpose=campaign` is `403 forbidden` with `own_inbox_only`, and a login email off the workspace's email domain (or a workspace with none) is `409 invalid_state` with `email_domain_mismatch`, whose message says what fixes it, because that mailbox would never be its primary inbox. A grant for any mailbox but the caller's login email waits for `POST /v1/inboxes/connect-confirmations`, which needs delivery edit, so a client seat connects only its login email. Any member may call it; the action then checks delivery edit or `approve_own_sends` (DEV-1811). Optional `returnTo` (DEV-1611) is a dashboard path the finished connect lands on, on the dashboard's own origin, with the usual result query (`gmail=connected`, `microsoft=error&reason=...`); for Microsoft the admin-consent return lands there too. Anything but a relative path with one leading `/`, no `//`, backslash or control characters, at most 512 characters, is `validation_failed` on `returnTo`. Without it the connect returns to the app's default page.
 
 - API: `POST /v1/inboxes/connect-sessions`
 - Generated from the API contract
@@ -13810,7 +13908,7 @@ kenso inboxes get --inbox-id <inbox-id>
 
 Return warmup state for one inbox.
 
-`status` and `enabled` come from the live warmup provider's own status, picked in the order pause and resume act on. `status` is `pending` while bought warmup waits to activate, and `paused` when it is paused. An Azure inbox with no warmup subscription is `failed`, because Kenso cannot enroll Azure. `readiness` is the cold-send warmup gate's verdict from provider warmup snapshots: `ready`, `bypassed`, `unconfirmed`, `too_young`, `provider_stale`, or `unavailable`. `enrollmentFailure` (staff only) is why the last pre-warmup provider enrollment failed, its consecutive attempts and the next retry time. Needs Delivery view.
+`status` and `enabled` come from the live warmup provider's own status, picked in the order pause and resume act on. `status` is `pending` while bought warmup waits to activate, and `paused` when it is paused. An Azure inbox with no warmup subscription is `failed`, because Kenso cannot enroll Azure. `readiness` is the cold-send warmup gate's verdict from provider warmup snapshots: `ready`, `bypassed`, `unconfirmed`, `too_young`, `provider_stale`, or `unavailable`. Needs Delivery view.
 
 - API: `GET /v1/inboxes/{inboxId}/warmup`
 - Generated from the API contract
@@ -13879,7 +13977,7 @@ kenso inboxes rename --inbox-id <inbox-id> --data @body.json
 
 Update an inbox. Absent fields stay unchanged. Null clears text fields and forwarding.
 
-`trackOpens` is the owner's Track opens option and exists only on a member's own mailbox (`ownerMemberId` set); on a shared campaign inbox it is `validation_failed`, and anyone but the owner gets `forbidden`. `paused: true` pauses outreach from the inbox and sets `pausedAt` (kept when it is already paused): campaign steps, triggers and approved Accounts 1:1 email wait instead of sending, and new leads are planned on the campaign's other inboxes. `paused: false` resumes it and clears `pausedAt`; held sends go out on the next dispatch. Warmup, reply sync and replies a member sends keep running, and campaign assignments stay. Needs Delivery edit. `profileImageUrl` (https, not null) sets the sender photo: a `POST /v1/inbox-photos` URL as is, any other fetched once (image-from-URL quota), saved only after InboxKit accepts it. Needs the `inbox_photos` flag, else `400` detail code `feature_disabled`, and an inbox Kenso can set (`profilePhotoSupport``google` or `microsoft`), else `400`; either way nothing is written. InboxKit timing out or failing is `503 service_unavailable`: try again. A `tagIds` entry the workspace has no tag for is `404 not_found`, and nothing is written. The update is not atomic: `trackOpens`, then the text fields, then forwarding, then `paused`, then `profileImageUrl` are written in turn, so a failure part-way leaves the earlier ones applied. Each write is idempotent, so retrying the same PATCH is safe.
+`trackOpens` is the owner's Track opens option and exists only on a member's own mailbox (`ownerMemberId` set); on a shared campaign inbox it is `validation_failed`, and anyone but the owner gets `forbidden`. `paused: true` pauses outreach from the inbox and sets `pausedAt` (kept when it is already paused): campaign steps, triggers and approved Accounts 1:1 email wait instead of sending, and new leads are planned on the campaign's other inboxes. `paused: false` resumes it and clears `pausedAt`; held sends go out on the next dispatch. Warmup, reply sync and replies a member sends keep running, and campaign assignments stay. Needs Delivery edit. `profileImageUrl` (https, not null) sets the sender photo: a `POST /v1/inbox-photos` URL as is, any other fetched once (image-from-URL quota), saved only after InboxKit accepts it. Needs the `inbox_photos` flag, else `400` detail code `feature_disabled`, and an inbox Kenso can set (`profilePhotoSupport``google` or `microsoft`), else `400`; either way nothing is written. InboxKit timing out or failing is `503 service_unavailable`: try again. A `tagIds` entry the workspace has no tag for is `404 not_found`, and nothing is written. A `forwardingDestination` the request cannot take (malformed, or a Kenso-hosted address), forwarding being unavailable (InboxKit not configured), or a `forwardingDestination` (set or null) on an inbox not linked to InboxKit, is `400`, and nothing is written either. The update is not atomic: `trackOpens`, then the text fields, then forwarding, then `paused`, then `profileImageUrl` are written in turn, so a failure part-way leaves the earlier ones applied. Each write is idempotent, so retrying the same PATCH is safe.
 
 - API: `PATCH /v1/inboxes/{inboxId}`
 - Generated from the API contract
@@ -14543,7 +14641,7 @@ kenso jobs cancel --job-id <job-id>
 
 Return one job.
 
-Requires `type` because the same numeric id can exist in more than one source. An `inbox_import` job carries `inboxImport` with counts and per-row results; one with no progress for 10 minutes reads `failed` with `error.code``interrupted`. A missing or cross-workspace id is `not_found`, and so is another member's `knowledge_export`. Read-only. Each type needs what its own routes need, as on the list; without it the call is `403 permission_denied`. A scraping job's status read sets `X-Ken-Web-Source` and `X-Ken-Credits-Charged`: Kenso's key charges a job as its reads report progress. A crawl or batch scrape returns one Firecrawl status page (about 10 MB at most) per read: when `output.next` is not null, pass it back as `cursor` to read the following page. Other types ignore `cursor`. A crawl or batch scrape read draws from the Heavy rate-limit class, like the legacy status routes it replaces.
+Requires `type` because the same numeric id can exist in more than one source. An `inbox_import` job carries `inboxImport` with counts and per-row results; one with no progress for 10 minutes reads `failed` with `error.code``interrupted`. A missing or cross-workspace id is `not_found`, and so is another member's `knowledge_export`. Read-only. Each type needs what its own routes need, as on the list; without it the call is `403 permission_denied`. A scraping job's status read sets `X-Ken-Web-Source` and `X-Ken-Credits-Charged`: Kenso's key charges a job as its reads report progress. A crawl or batch scrape returns one Firecrawl status page (about 10 MB at most) per read: when `result.next` is not null, pass it back as `cursor` to read the following page. Other types ignore `cursor`. An `extraction` reads `running` while it runs and `failed` once it failed, with the provider's status body in `result`; only an answer that carries no status is `503 service_unavailable`. A crawl or batch scrape read draws from the Heavy rate-limit class, like the legacy status routes it replaces.
 
 - API: `GET /v1/jobs/{jobId}` (a list: `--limit`, `--cursor`, `--all`)
 - Generated from the API contract
@@ -16522,7 +16620,7 @@ kenso learnings list
 
 Start a hosted connect or reconnect session.
 
-Omit the account id to connect a new seat. `linkedInAccountId` or `linkedinAccountId` reconnects that seat. A client seat (Delivery view, `approve_own_sends`) connects only its own LinkedIn: reconnecting a seat another member connected is `403 forbidden` with `not_your_linkedin`, and a new seat while it holds one is `409 conflict` with `reconnect_instead`. Requires Delivery edit, or `approve_own_sends` (declared `[WorkspaceMember]`; the action decides, DEV-1811). `importConnections: true` on a new seat imports its connections into Accounts once it connects, while `linkedin_connections_import` is on (ignored otherwise); a reconnect ignores it and keeps the stored setting (DEV-5778).
+Omit the account id to connect a new seat. `linkedInAccountId` or `linkedinAccountId` reconnects that seat. A client seat (Delivery view, `approve_own_sends`) connects only its own LinkedIn: reconnecting a seat another member connected is `403 forbidden` with `not_your_linkedin`, and a new seat while it holds one is `409 conflict` with `reconnect_instead`. Requires Delivery edit, or `approve_own_sends` (any member may call it; the action decides, DEV-1811). `importConnections: true` on a new seat imports its connections into Accounts once it connects, while `linkedin_connections_import` is on (ignored otherwise); a reconnect ignores it and keeps the stored setting (DEV-5778).
 
 - API: `POST /v1/linkedin-accounts/connect-sessions`
 - Generated from the API contract
@@ -16684,7 +16782,7 @@ kenso linkedin-accounts update --linkedin-account-id <linkedin-account-id> --dat
 
 List the workspace's LinkedIn connections.
 
-Filters: `linkedinAccountId` (one seat), `icpStatus` (comma = OR: pending, fit, not_fit, unknown), `jobChanged` (`true`: Kenso Search reported a job change within the network's `jobChangeWindowDays`), `seniority` (comma = OR, Kenso Search levels such as entry, senior, manager, director, vp, c_level, owner, partner), `matchStatus` (comma = OR: pending, matched, not_found, failed), `importStatus` (comma = OR: pending, imported, skipped, dismissed; DEV-5778), `companyDomain` (any domain, URL or email; normalized), `q` (name, title or company name contains; at most 300 characters). `sort`: `-createdAt` (default), `-icpScore` (highest first, unscored last), `-connectedAt` (newest first). Each item carries the person (`fullName`, `headline`, `linkedinUrl`, `connectedAt`), Kenso Search's match (`title`, `seniority`, company fields, `jobChangedAt`, `isJobChanged`, previous company and title), the ICP score (`icpStatus`, `icpScore` 0-100, fit at 70, up to 3 `icpReasons`) and `accountId` when a live account the caller can see owns the company domain, and the connections import (`importStatus`, `personId`, `importedAt`, `importSkipCode`, `importAccountId`). `limit` 1-200 (default 50); a cursor is valid only with the same filters and sort. Requires `ReadAccess` and Accounts view.
+Filters: `linkedinAccountId` (one seat), `icpStatus` (comma = OR: pending, fit, not_fit, unknown), `jobChanged` (`true`: Kenso Search reported a job change within the network's `jobChangeWindowDays`), `seniority` (comma = OR, Kenso Search levels such as entry, senior, manager, director, vp, c_level, owner, partner), `matchStatus` (comma = OR: pending, matched, not_found, failed), `importStatus` (comma = OR: pending, imported, skipped, dismissed; DEV-5778), `companyDomain` (any domain, URL or email; normalized), `q` (name, title or company name contains; at most 300 characters). `sort`: `-createdAt` (default), `-icpScore` (highest first, unscored last), `-connectedAt` (newest first). Each item carries the person (`fullName`, `headline`, `linkedinUrl`, `connectedAt`), Kenso Search's match (`title`, `seniority`, company fields, `jobChangedAt`, `isJobChanged`, previous company and title), the ICP score (`icpStatus`, `icpScore` 0-100, fit at 70, up to 3 `icpReasons`) and `accountId` when a live account the caller can see owns the company domain, and the connections import (`importStatus`, `personId`, `importedAt`, `importSkipCode`, `importAccountId`). `limit` 1-200 (default 50); a cursor is valid only with the same filters and sort. Requires Accounts view.
 
 - Beta: needs the one of `linkedin_connections_import`, `linkedin_network` feature flag on the workspace.
 - API: `GET /v1/linkedin-connections` (a list: `--limit`, `--cursor`, `--all`)
@@ -16717,7 +16815,7 @@ kenso linkedin-connections list --all
 
 Promote LinkedIn connections to Accounts.
 
-1 to 100 `connectionIds`. Each matched connection's current company (Kenso Search's company domain) becomes an account, or joins the live account that already owns that domain; connections at one company share one account, and each person becomes a stakeholder (role unknown, source search). A new account starts at `stage` (researching, warming or engaged; default researching) with the caller as owner and queues research; an existing account keeps its stage. `accounts` lists each account with `accountId`, `name`, `domain`, `created`, `research` and `people` (`connectionId`, `personId`, `stakeholderId`, `result` added or already_stakeholder). Connections that were not placed are in `skipped` with a `code`: not_found, not_matched (no Kenso Search match yet), no_company_domain, generic_email_domain, domain_taken (another member's account owns the domain and the caller works only its own accounts), previously_removed (a person removed them from the account; agents and API keys do not re-add them), failed (retry). When none can be placed the answer is `400 validation_failed` with one detail per connection, or 500 when one failed on Kenso's side. Campaign sequences are not touched. Requires `WriteAccess`, Accounts edit and the `accounts` feature.
+1 to 100 `connectionIds`. Each matched connection's current company (Kenso Search's company domain) becomes an account, or joins the live account that already owns that domain; connections at one company share one account, and each person becomes a stakeholder (role unknown, source search). A new account starts at `stage` (researching, warming or engaged; default researching) with the caller as owner and queues research; an existing account keeps its stage. `accounts` lists each account with `accountId`, `name`, `domain`, `created`, `research` and `people` (`connectionId`, `personId`, `stakeholderId`, `result` added or already_stakeholder). Connections that were not placed are in `skipped` with a `code`: not_found, not_matched (no Kenso Search match yet), no_company_domain, generic_email_domain, domain_taken (another member's account owns the domain and the caller works only its own accounts), previously_removed (a person removed them from the account; agents and API keys do not re-add them), failed (retry). When none can be placed the answer is `400 validation_failed` with one detail per connection, or 500 when one failed on Kenso's side. Campaign sequences are not touched. Requires Accounts edit and the `accounts` feature.
 
 - Beta: needs the `accounts` and `linkedin_network` feature flag on the workspace.
 - API: `POST /v1/linkedin-connections/promote`
@@ -16742,7 +16840,7 @@ kenso linkedin-connections promote --data @body.json
 
 Get the inbound connection request settings of the caller's LinkedIn seats.
 
-`seats` lists the live LinkedIn accounts the caller connected, any mode, oldest first; for a workspace admin also the colleagues' seats that are not off, with `isOwnSeat` false (an admin may only switch those off). Each seat has `linkedinAccountId`, `displayName`, `connectedByMemberId`, `seatStatus` (connecting, connected, credentials_error, restricted, disconnected, deleted, connect_failed), its settings (`mode` off, manual or autonomous; `acceptThreshold` 0-100, default 80; `lane` accounts or campaign; `campaignId`; `sendFirstMessage`; `autonomousEnabledByMemberId`, `autonomousEnabledAt` and `autonomousEnabledVia`: app, the client label of the owner's agent such as Claude Code, or api), its scan (`scanStatus` pending, scanning, idle, paused or blocked; `nextScanAt`, `firstScanCompletedAt`, `lastSuccessAt`, `backoffUntil`, `lastError`) and `counts`: one entry per lane (spam, strong, unclear; omitted before triage) and status (pending_triage, awaiting_decision, accept_queued, accepted, ignored, gone, failed) with a nonzero `count`. A seat never configured shows the defaults (mode off). Requires `ReadAccess` and Accounts view.
+`seats` lists the live LinkedIn accounts the caller connected, any mode, oldest first; for a workspace admin also the colleagues' seats that are not off, with `isOwnSeat` false (an admin may only switch those off). Each seat has `linkedinAccountId`, `displayName`, `connectedByMemberId`, `seatStatus` (connecting, connected, credentials_error, restricted, disconnected, deleted, connect_failed), its settings (`mode` off, manual or autonomous; `acceptThreshold` 0-100, default 80; `lane` accounts or campaign; `campaignId`; `sendFirstMessage`; `autonomousEnabledByMemberId`, `autonomousEnabledAt` and `autonomousEnabledVia`: app, the client label of the owner's agent such as Claude Code, or api), its scan (`scanStatus` pending, scanning, idle, paused or blocked; `nextScanAt`, `firstScanCompletedAt`, `lastSuccessAt`, `backoffUntil`, `lastError`) and `counts`: one entry per lane (spam, strong, unclear; omitted before triage) and status (pending_triage, awaiting_decision, accept_queued, accepted, ignored, gone, failed) with a nonzero `count`. A seat never configured shows the defaults (mode off). Requires Accounts view.
 
 - Beta: needs the `linkedin_inbound` feature flag on the workspace.
 - API: `GET /v1/linkedin-inbound`
@@ -16763,7 +16861,7 @@ kenso linkedin-inbound get
 
 Change one seat's inbound connection request settings.
 
-Body (absent fields stay as they are): `mode` (off, manual or autonomous), `acceptThreshold` (0-100, the score at or above which autonomous mode accepts a request by itself), `lane` (accounts or campaign: where accepted leads go), `campaignId` (null clears it) and `sendFirstMessage` (the delayed AI first message, accounts lane only). Lane campaign needs a scheduled or sending campaign of the workspace that sends from this seat (a campaign with no seat list sends from every seat); otherwise `400 validation_failed` with `seat_not_in_campaign` on `campaignId`. Moving to lane accounts does not check the stored campaign, so a seat whose campaign stopped being live can always leave the campaign lane. Only the member who connected the seat may change it; a workspace admin may send exactly `{ "mode": "off" }` for a colleague's seat. Anything else on a colleague's seat is `404 not_found`, so an API key with no user, which connected no seat, changes none. The owner's agent or API key changes the seat as the owner, autonomous mode included (DEV-5878); an agent turns autonomous mode on only when its person asked it to. Its change counts as the owner's: on an autonomous seat Ken then accepts strong fits and sends their AI first messages with no one approving. Turning autonomous mode on, or changing an autonomous seat's other settings, also needs the approve permission, as deciding one request does: without it the answer is `403 permission_denied`. Turning autonomous on stamps `autonomousEnabledVia` (app, the `X-Ken-Client` label, or api), and every save writes a Security audit line naming the caller and its client (DEV-5147). Kenso calls no LinkedIn API here; the background scan reads a seat once it is on. Answers the seat as `linkedin-inbound.get` lists it. Requires `WriteAccess` and Accounts edit.
+Body (absent fields stay as they are): `mode` (off, manual or autonomous), `acceptThreshold` (0-100, the score at or above which autonomous mode accepts a request by itself), `lane` (accounts or campaign: where accepted leads go), `campaignId` (null clears it) and `sendFirstMessage` (the delayed AI first message, accounts lane only). Lane campaign needs a scheduled or sending campaign of the workspace that sends from this seat (a campaign with no seat list sends from every seat); otherwise `400 validation_failed` with `seat_not_in_campaign` on `campaignId`. Moving to lane accounts does not check the stored campaign, so a seat whose campaign stopped being live can always leave the campaign lane. Only the member who connected the seat may change it; a workspace admin may send exactly `{ "mode": "off" }` for a colleague's seat. Anything else on a colleague's seat is `404 not_found`, so an API key with no user, which connected no seat, changes none. The owner's agent or API key changes the seat as the owner, autonomous mode included (DEV-5878); an agent turns autonomous mode on only when its person asked it to. Its change counts as the owner's: on an autonomous seat Ken then accepts strong fits and sends their AI first messages with no one approving. Turning autonomous mode on, or changing an autonomous seat's other settings, also needs the approve permission, as deciding one request does: without it the answer is `403 permission_denied`. Turning autonomous on stamps `autonomousEnabledVia` (app, the `X-Ken-Client` label, or api), and every save writes a Security audit line naming the caller and its client (DEV-5147). Kenso calls no LinkedIn API here; the background scan reads a seat once it is on. Answers the seat as `linkedin-inbound.get` lists it. Requires Accounts edit.
 
 - Beta: needs the `linkedin_inbound` feature flag on the workspace.
 - API: `PATCH /v1/linkedin-inbound/seats/{linkedinAccountId}`
@@ -16794,7 +16892,7 @@ kenso linkedin-inbound-seats update --linkedin-account-id <linkedin-account-id>
 
 Withdraw pending invitations on one of the caller's LinkedIn seats.
 
-Body: `linkedinAccountId` and exactly one of `invitationIds` (1-100 ids from `linkedin-invitations.list`) and `olderThanDays` (1-365: every pending invitation sent more than that many days ago, except those a campaign lane on the seat still waits on, which follow their campaign's own withdraw rule). Nothing reaches LinkedIn now: the withdraws are queued, and the background withdraw sends them paced with the seat's other LinkedIn actions, inside its working hours, at most 25 a day per seat. LinkedIn blocks inviting a withdrawn person again for about three weeks. With ids the answer is `queued` (how many this request queued), `alreadyQueued` (ids already queued, withdrawn or gone, left as they were) and `notFound` (ids never listed on this seat). With days it starts a sweep that reads the seat's whole sent list first (the seat's withdraws wait while it runs) and answers `sweepId`, `olderThanDays` and `status`; a seat's running sweep is answered as it is. Both or neither field is `400 validation_failed`. A seat that is not connected is `409 invalid_state` with `seat_unavailable`. Requires `WriteAccess`, Accounts edit and approve.
+Body: `linkedinAccountId` and exactly one of `invitationIds` (1-100 ids from `linkedin-invitations.list`) and `olderThanDays` (1-365: every pending invitation sent more than that many days ago, except those a campaign lane on the seat still waits on, which follow their campaign's own withdraw rule). Nothing reaches LinkedIn now: the withdraws are queued, and the background withdraw sends them paced with the seat's other LinkedIn actions, inside its working hours, at most 25 a day per seat. LinkedIn blocks inviting a withdrawn person again for about three weeks. With ids the answer is `queued` (how many this request queued), `alreadyQueued` (ids already queued, withdrawn or gone, left as they were) and `notFound` (ids never listed on this seat). With days it starts a sweep that reads the seat's whole sent list first (the seat's withdraws wait while it runs) and answers `sweepId`, `olderThanDays` and `status`; a seat's running sweep is answered as it is. Both or neither field is `400 validation_failed`. A seat that is not connected is `409 invalid_state` with `seat_unavailable`. Requires Accounts edit and the `approve` permission.
 
 - Beta: needs the `linkedin_inbound` feature flag on the workspace.
 - API: `POST /v1/linkedin-invitations/withdrawals`
@@ -16818,7 +16916,7 @@ kenso linkedin-invitation-withdrawals create --data @body.json
 
 List the withdraws asked for on one of the caller's LinkedIn seats.
 
-Latest request first. `linkedinAccountId` is required; `status` filters by withdraw status (comma separated: queued, withdrawn, gone, failed). `data.items` are invitations with their `withdrawal` (`status`, `requestedAt`, `requestedVia`, `requestedByMemberId`, `sweepId`, `withdrawnAt`, `error`). `gone` means the invitation was no longer pending on LinkedIn, most likely accepted. `data.sweeps` are the seat's latest 10 sweeps (`status` running, done or failed, `queued`, `scannedPages`, `error`; a done sweep with `page_cap_reached` stopped before the oldest invitations). `data.pagination` pages the items; `limit` 1-200 (default 50), and a cursor is valid only with the same filters. Read from Kenso, so a disconnected seat still shows its history. Requires `ReadAccess` and Accounts view.
+Latest request first. `linkedinAccountId` is required; `status` filters by withdraw status (comma separated: queued, withdrawn, gone, failed). `data.items` are invitations with their `withdrawal` (`status`, `requestedAt`, `requestedVia`, `requestedByMemberId`, `sweepId`, `withdrawnAt`, `error`). `gone` means the invitation was no longer pending on LinkedIn, most likely accepted. `data.sweeps` are the seat's latest 10 sweeps (`status` running, done or failed, `queued`, `scannedPages`, `error`; a done sweep with `page_cap_reached` stopped before the oldest invitations). `data.pagination` pages the items; `limit` 1-200 (default 50), and a cursor is valid only with the same filters. Read from Kenso, so a disconnected seat still shows its history. Requires Accounts view.
 
 - Beta: needs the `linkedin_inbound` feature flag on the workspace.
 - API: `GET /v1/linkedin-invitations/withdrawals` (a list: `--limit`, `--cursor`, `--all`)
@@ -16845,7 +16943,7 @@ kenso linkedin-invitation-withdrawals list --all
 
 List the pending invitations one of the caller's LinkedIn seats sent.
 
-Read live from LinkedIn, newest first. `linkedinAccountId` is required. Each item carries `invitationId` (what a withdraw takes), the invitee (`providerId`, `name`, and `publicIdentifier` and `profileUrl` when LinkedIn sends them, which is rare), `sentAt`, the campaign lane on the seat that invited the same person (`campaignId`, `contactId`; omitted for an invitation sent outside Kenso) and `withdrawal` once someone asked to withdraw it. `limit` 1-100 (default 50). A seat that is not connected is `409 invalid_state` with `seat_unavailable`. When LinkedIn limits the seat's reads the answer is `429 rate_limited` with a `Retry-After` header in seconds. Requires `ReadAccess` and Accounts view.
+Read live from LinkedIn, newest first. `linkedinAccountId` is required. Each item carries `invitationId` (what a withdraw takes), the invitee (`providerId`, `name`, and `publicIdentifier` and `profileUrl` when LinkedIn sends them, which is rare), `sentAt`, the campaign lane on the seat that invited the same person (`campaignId`, `contactId`; omitted for an invitation sent outside Kenso) and `withdrawal` once someone asked to withdraw it. `limit` 1-100 (default 50). A seat that is not connected is `409 invalid_state` with `seat_unavailable`. When LinkedIn limits the seat's reads the answer is `429 rate_limited` with a `Retry-After` header in seconds. Requires Accounts view.
 
 - Beta: needs the `linkedin_inbound` feature flag on the workspace.
 - API: `GET /v1/linkedin-invitations` (a list: `--limit`, `--cursor`, `--all`)
@@ -16871,7 +16969,7 @@ kenso linkedin-invitations list --all
 
 List companies where ICP-fit connections work that are not accounts yet.
 
-One item per company domain with at least one connection scored fit and no live account owning the domain: `companyDomain`, `companyName`, `kenCompanyId`, `industry`, `employeeCount`, `fitConnectionCount`, `connectionCount`, `topScore` and up to 5 fit `connections`, best score first. Ordered by fit connections, then top score. Promote a company with `linkedin-connections.promote`. `limit` 1-200 (default 50) and `cursor` page by offset. Requires `ReadAccess` and Accounts view.
+One item per company domain with at least one connection scored fit and no live account owning the domain: `companyDomain`, `companyName`, `kenCompanyId`, `industry`, `employeeCount`, `fitConnectionCount`, `connectionCount`, `topScore` and up to 5 fit `connections`, best score first. Ordered by fit connections, then top score. Promote a company with `linkedin-connections.promote`. `limit` 1-200 (default 50) and `cursor` page by offset. Requires Accounts view.
 
 - Beta: needs the `linkedin_network` feature flag on the workspace.
 - API: `GET /v1/linkedin-network/account-suggestions` (a list: `--limit`, `--cursor`, `--all`)
@@ -16894,7 +16992,7 @@ kenso linkedin-network account-suggestions --all
 
 Get the workspace's LinkedIn network: each seat's sync state and the network counts.
 
-`seats` lists every live LinkedIn account of the workspace, any status, oldest first. Each seat has `linkedinAccountId`, `displayName`, `connectedByMemberId`, `seatStatus` (connecting, connected, credentials_error, restricted, disconnected, deleted, connect_failed), `pausedAt`, and its connections sync: `status` (not_started, pending, syncing, synced, paused, blocked), `connectionCount`, `totalCount`, `initialSyncCompletedAt`, `lastSuccessAt`, `nextRunAt`, `backoffUntil` and `lastError` (rate_limited, timeout, http_403 and similar). Workspace counts over live connections: `connectionCount`, `matchedCount`, `pendingCount` (match or score still pending), `icpFitCount` (score 70 or more), `jobChangedCount` (Kenso Search job change within `jobChangeWindowDays`), `jobChangedIcpFitCount` and `seniorJobChangedIcpFitCount` (also vp, c_level, owner or partner). `hasIcp` is false while the workspace has no ICP text; connections are then scored unknown. Requires `ReadAccess` and Accounts view.
+`seats` lists every live LinkedIn account of the workspace, any status, oldest first. Each seat has `linkedinAccountId`, `displayName`, `connectedByMemberId`, `seatStatus` (connecting, connected, credentials_error, restricted, disconnected, deleted, connect_failed), `pausedAt`, and its connections sync: `status` (not_started, pending, syncing, synced, paused, blocked), `connectionCount`, `totalCount`, `initialSyncCompletedAt`, `lastSuccessAt`, `nextRunAt`, `backoffUntil` and `lastError` (rate_limited, timeout, http_403 and similar). Workspace counts over live connections: `connectionCount`, `matchedCount`, `pendingCount` (match or score still pending), `icpFitCount` (score 70 or more), `jobChangedCount` (Kenso Search job change within `jobChangeWindowDays`), `jobChangedIcpFitCount` and `seniorJobChangedIcpFitCount` (also vp, c_level, owner or partner). `hasIcp` is false while the workspace has no ICP text; connections are then scored unknown. Requires Accounts view.
 
 - Beta: needs the one of `linkedin_connections_import`, `linkedin_network` feature flag on the workspace.
 - API: `GET /v1/linkedin-network`
@@ -16913,7 +17011,7 @@ kenso linkedin-network get
 
 Ask for a LinkedIn network sync now.
 
-Body (optional): `linkedinAccountId`, one live LinkedIn account of the workspace (404 `not_found` otherwise). Without it, every connected, unpaused seat. Each seat becomes due for the background sync now, never sooner than its `backoffUntil`; a `blocked` seat stays blocked until it is reconnected. Connections whose Kenso Search match failed are queued to match again, and when the workspace has ICP text, matched connections scored unknown are queued to score again. Kenso does not call LinkedIn in this request: the sync runs in the background, so poll `linkedin-network.get`. Answers 202 with the same model as `linkedin-network.get`. Requires `WriteAccess` and Accounts edit.
+Body (optional): `linkedinAccountId`, one live LinkedIn account of the workspace (404 `not_found` otherwise). Without it, every connected, unpaused seat. Each seat becomes due for the background sync now, never sooner than its `backoffUntil`; a `blocked` seat stays blocked until it is reconnected. Connections whose Kenso Search match failed are queued to match again, and when the workspace has ICP text, matched connections scored unknown are queued to score again. Kenso does not call LinkedIn in this request: the sync runs in the background, so poll `linkedin-network.get`. Answers 202 with the same model as `linkedin-network.get`. Requires Accounts edit.
 
 - Beta: needs the `linkedin_network` feature flag on the workspace.
 - API: `POST /v1/linkedin-network/sync`
@@ -16938,7 +17036,7 @@ kenso linkedin-network sync --data @body.json
 
 Accept or skip a connection request.
 
-Body: `action` (`accept_as_lead`: accept, then hand the person to Accounts or the seat's campaign; `accept_only`: accept and add to the network, nothing else; `skip`: hide it, still pending on LinkedIn) and `updatedAt` from the version the person reviewed (optional; a newer version is `409 conflict` with `concurrent_change`). The same decision as the request's item in Approvals. Only a request on a seat the caller connected can be decided; any other id is `404 not_found`. The seat owner's agent or API key decides as the owner (DEV-5878); an agent decides only when its person asked it to. A key with no user connected no seat, so every id is `404` for it. The decision is recorded as the owner's (`decidedBy` person), with `decidedVia` the `X-Ken-Client` label, or api (DEV-5147): on an autonomous seat its accept's AI first message then goes out with no one approving, as the owner's would; a request with a note still waits for approval. An accept works from awaiting_decision or ignored (a rescued spam item), a skip only from awaiting_decision; anything else is `409 invalid_state` with `invalid_transition`. Accepting on a seat that is not connected is `409 invalid_state` with `seat_unavailable`, and on a seat whose inbound mode is off it is `409 invalid_state` with `seat_off`. An accept queues the request: the paced background accept sends it to LinkedIn later. Unknown actions are `400 validation_failed` with `unknown_action`. Answers the request in its new state. Requires `WriteAccess`, Accounts edit and approve.
+Body: `action` (`accept_as_lead`: accept, then hand the person to Accounts or the seat's campaign; `accept_only`: accept and add to the network, nothing else; `skip`: hide it, still pending on LinkedIn) and `updatedAt` from the version the person reviewed (optional; a newer version is `409 conflict` with `concurrent_change`). The same decision as the request's item in Approvals. Only a request on a seat the caller connected can be decided; any other id is `404 not_found`. The seat owner's agent or API key decides as the owner (DEV-5878); an agent decides only when its person asked it to. A key with no user connected no seat, so every id is `404` for it. The decision is recorded as the owner's (`decidedBy` person), with `decidedVia` the `X-Ken-Client` label, or api (DEV-5147): on an autonomous seat its accept's AI first message then goes out with no one approving, as the owner's would; a request with a note still waits for approval. An accept works from awaiting_decision or ignored (a rescued spam item), a skip only from awaiting_decision; anything else is `409 invalid_state` with `invalid_transition`. Accepting on a seat that is not connected is `409 invalid_state` with `seat_unavailable`, and on a seat whose inbound mode is off it is `409 invalid_state` with `seat_off`. An accept queues the request: the paced background accept sends it to LinkedIn later. Unknown actions are `400 validation_failed` with `unknown_action`. Answers the request in its new state. Requires Accounts edit and the `approve` permission.
 
 - Beta: needs the `linkedin_inbound` feature flag on the workspace.
 - API: `POST /v1/linkedin-requests/{linkedinRequestId}/decisions`
@@ -16963,7 +17061,7 @@ kenso linkedin-requests decide --linkedin-request-id <linkedin-request-id> --dat
 
 List the connection requests on the caller's LinkedIn seats.
 
-Newest first. Filters: `linkedinAccountId` (one of the caller's seats; a colleague's seat lists nothing), `lane` (spam, strong or unclear) and `status` (pending_triage, awaiting_decision, accept_queued, accepted, ignored, gone or failed); `lane=spam&status=ignored` lists the requests Ken hid as spam, which a person can still accept with `linkedin-requests.decide`. Each item carries the person (`fullName`, `headline`, `note`, `linkedinUrl`, `receivedAt`), Kenso Search's match (`matchStatus`, `title`, `seniority`, company fields), the triage (`lane`, `spamCategory` sellers, recruiters_job_seekers, empty_profile or none; `icpScore` 0-100; up to 3 `icpReasons`), the decision (`decision`, `decidedBy` person or autonomous, `decidedByMemberId`, `decidedVia` app, the client label of the owner's agent or api, `decidedAt`), the accept (`acceptedAt`) and the hand-off (`handoffStatus`, `accountId`, `personId`, `contactId`, `campaignId`). `updatedAt` is the decision version. `limit` 1-200 (default 50); a cursor is valid only with the same filters. Requires `ReadAccess` and Accounts view.
+Newest first. Filters: `linkedinAccountId` (one of the caller's seats; a colleague's seat lists nothing), `lane` (spam, strong or unclear) and `status` (pending_triage, awaiting_decision, accept_queued, accepted, ignored, gone or failed); `lane=spam&status=ignored` lists the requests Ken hid as spam, which a person can still accept with `linkedin-requests.decide`. Each item carries the person (`fullName`, `headline`, `note`, `linkedinUrl`, `receivedAt`), Kenso Search's match (`matchStatus`, `title`, `seniority`, company fields), the triage (`lane`, `spamCategory` sellers, recruiters_job_seekers, empty_profile or none; `icpScore` 0-100; up to 3 `icpReasons`), the decision (`decision`, `decidedBy` person or autonomous, `decidedByMemberId`, `decidedVia` app, the client label of the owner's agent or api, `decidedAt`), the accept (`acceptedAt`) and the hand-off (`handoffStatus`, `accountId`, `personId`, `contactId`, `campaignId`). `updatedAt` is the decision version. `limit` 1-200 (default 50); a cursor is valid only with the same filters. Requires Accounts view.
 
 - Beta: needs the `linkedin_inbound` feature flag on the workspace.
 - API: `GET /v1/linkedin-requests` (a list: `--limit`, `--cursor`, `--all`)
@@ -17114,7 +17212,7 @@ kenso linkedin-sequences save-version --campaign-id <campaign-id> --data @body.j
 
 Soft-delete a campaign list that no contact references.
 
-A list that still has contacts, including soft-deleted contacts, is `validation_failed`. Requires `WriteAccess`.
+A list that still has contacts, including soft-deleted contacts, is `validation_failed`. Requires Campaigns edit.
 
 - API: `DELETE /v1/lists/{listId}`
 - Generated from the API contract
@@ -17133,7 +17231,7 @@ kenso lists delete --list-id <list-id>
 
 Return one campaign list in the current workspace.
 
-A missing or cross-workspace id is `not_found`. Requires `ReadAccess`.
+A missing or cross-workspace id is `not_found`. Requires Campaigns view.
 
 - API: `GET /v1/lists/{listId}`
 - Generated from the API contract
@@ -17152,7 +17250,7 @@ kenso lists get --list-id <list-id>
 
 List a campaign's import lists in the current workspace.
 
-Newest first. `limit` and `cursor` page the set. Read-only. Requires `ReadAccess`.
+Newest first. `limit` and `cursor` page the set. Read-only. Requires Campaigns view.
 
 - API: `GET /v1/campaigns/{campaignId}/lists` (a list: `--limit`, `--cursor`, `--all`)
 - Generated from the API contract
@@ -17715,7 +17813,7 @@ kenso me delete-avatar
 
 Return the authenticated caller.
 
-Replaces `GET /v1/me/context`, `GET /v1/users/me`, and `GET /v1/workspaces/me`. Read-only. Requires `ReadAccess`. When `X-Ken-Workspace-Id` is present, `role` is the caller's role in that workspace. A super admin's role stays `super_admin`. `features` is always present: the sorted feature flag keys on for the caller, e.g. `["accounts", "app_v4"]`. The workspace is `X-Ken-Workspace-Id` when the caller may act in it, else the caller's only workspace, else none. Gate UI on it; never on flag rows. `permissions` is always present: the caller's effective permissions in that same workspace (template, pages, features, account scope, monthly credit limit, credits used this month), narrowed by an API key's template. It is null for a super admin, when there is no workspace, while the `permissions` feature flag is off for the workspace (the default), or when permissions could not be evaluated (including an API key that no longer resolves). `hasPaidPlan` is always present: whether that same workspace is on a paid plan, null for a super admin, when there is no workspace, or when the plan could not be read. `role` is deprecated.
+Replaces `GET /v1/me/context`, `GET /v1/users/me`, and `GET /v1/workspaces/me`. Read-only. Open to any signed-in caller. When `X-Ken-Workspace-Id` is present, `role` is the caller's role in that workspace. A Kenso staff caller keeps its own staff role. `features` is always present: the sorted feature flag keys on for the caller, e.g. `["accounts", "studio"]`. The workspace is `X-Ken-Workspace-Id` when the caller may act in it, else the caller's only workspace, else none. Gate UI on it; never on flag rows. `permissions` is always present: the caller's effective permissions in that same workspace (template, pages, features, account scope, monthly credit limit, credits used this month), narrowed by an API key's template. It is null for Kenso staff, when there is no workspace, while the `permissions` feature flag is off for the workspace (the default), or when permissions could not be evaluated (including an API key that no longer resolves). `hasPaidPlan` is always present: whether that same workspace is on a paid plan, null for Kenso staff, when there is no workspace, or when the plan could not be read. `role` is deprecated.
 
 - API: `GET /v1/me`
 - Generated from the API contract
@@ -17771,7 +17869,7 @@ kenso me get-calendar-preferences
 
 Return the caller's notification preferences.
 
-One row per event: `isEnabled` is the Email toggle as before, `channels` holds the In app, Email, Slack and Teams choices (a saved choice, else the event's default) and `surface` is `classic` or `accounts`. Accounts events are listed when the `notifications` feature is on for the workspace or for any other workspace the caller is a member of, since those workspaces email the caller; their In app, Slack and Teams toggles change only where the feature is on. Always-on system events (billing, onboarding, domain import, access requests) are listed only for a super admin, with `isLocked` true; everyone else gets them on their defaults. `dailyBrief` is the brief time and time zone, and `destinations` the caller's email and Slack channel in the workspace. The workspace is `X-Ken-Workspace-Id` when the caller is a member, else the caller's only workspace, else none. Read-only. Requires `ReadAccess`.
+One row per event: `isEnabled` is the Email toggle as before, `channels` holds the In app, Email, Slack and Teams choices (a saved choice, else the event's default) and `surface` is `classic` or `accounts`. Accounts events are listed when the `notifications` feature is on for the workspace or for any other workspace the caller is a member of, since those workspaces email the caller; their In app, Slack and Teams toggles change only where the feature is on. Always-on system events (billing, onboarding, domain import, access requests) are listed only for a super admin, with `isLocked` true; everyone else gets them on their defaults. `dailyBrief` is the brief time and time zone, and `destinations` the caller's email and Slack channel in the workspace. The workspace is `X-Ken-Workspace-Id` when the caller is a member, else the caller's only workspace, else none. Read-only. Open to any workspace member.
 
 - API: `GET /v1/me/notification-preferences`
 - Generated from the API contract
@@ -17807,7 +17905,7 @@ kenso me get-preferences
 
 Return how the caller signs in.
 
-`emailSwitchAvailable` is true when the app may offer to move the caller's Google, Microsoft or LinkedIn sign-in onto an email login (`POST /v1/me/sign-in/switch`): `Auth0:SignInEmailSwitch:Enabled` is on, the caller is a person signed in to the Kenso app (not an API key or an agent), and the account is not a Kenso team or staff one. `409 conflict` when the account no longer signs in with the caller's sign-in: a switch moved it, and the API has not refused that token yet (up to 30 s). Read-only. Requires `ReadAccess`.
+`emailSwitchAvailable` is true when the app may offer to move the caller's Google, Microsoft or LinkedIn sign-in onto an email login (`POST /v1/me/sign-in/switch`): `Auth0:SignInEmailSwitch:Enabled` is on, the caller is a person signed in to the Kenso app (not an API key or an agent), and the account is not a Kenso team or staff one. `409 conflict` when the account no longer signs in with the caller's sign-in: a switch moved it, and the API has not refused that token yet (up to 30 s). Read-only. Open to any workspace member.
 
 - API: `GET /v1/me/sign-in`
 - Generated from the API contract
@@ -17843,7 +17941,7 @@ kenso me get-signature
 
 Connect another Google, LinkedIn or Microsoft work login to the caller's sign-in.
 
-The Kenso app calls it after the member signed in to the other login in its link round-trip, with that login's ID token. Only a person signed in to the Kenso app may link: an API key, an MCP client or an agent gets `403 forbidden`. `403 feature_off` unless the `security_actions` feature is on for the workspace. The token must be one Auth0 issued the Kenso app (signature, issuer, audience), at most ten minutes old (`400 login_expired`), else `400 invalid_login`; the provider must have verified its email (`400 unverified_email`), which may differ from the account's; and the login must be Google, LinkedIn or Microsoft work (`400 provider_not_allowed`). Auth0 never marks an Entra email verified, so a Microsoft work login answers `400 unverified_email` unless `Auth0:SignInEmailSwitch:MicrosoftConnectEnabled` is on (DEV-5799): then it links with an unverified email, which is only a label and finds, binds, grants or accepts nothing; the round-trip's fresh sign-in is the proof. `409 already_linked` when it is the caller's own sign-in, or a retry of the caller's own link that Auth0 made (the account below is closed then). `409 login_in_use` when another Kenso account signs in with that login or holds its address, read before any Auth0 change. The one exception is the account Auth0's signup made for this login during the round-trip: made in the last 30 minutes, after the Auth0 login, with no workspace. Auth0 then folds the login into the caller's, so it signs in to this account, and that account is closed (`previousAccount`). `503` when Auth0 cannot be reached or another switch or link runs; when Auth0 did not answer the link, reload the logins before retrying. Records `sign_in.login_linked` in each of the caller's workspaces. Requires `ReadAccess`.
+The Kenso app calls it after the member signed in to the other login in its link round-trip, with that login's ID token. Only a person signed in to the Kenso app may link: an API key, an MCP client or an agent gets `403 forbidden`. `403 feature_off` unless the `security_actions` feature is on for the workspace. The token must be one Auth0 issued the Kenso app (signature, issuer, audience), at most ten minutes old (`400 login_expired`), else `400 invalid_login`; the provider must have verified its email (`400 unverified_email`), which may differ from the account's; and the login must be Google, LinkedIn or Microsoft work (`400 provider_not_allowed`). Auth0 never marks an Entra email verified, so a Microsoft work login answers `400 unverified_email` unless `Auth0:SignInEmailSwitch:MicrosoftConnectEnabled` is on (DEV-5799): then it links with an unverified email, which is only a label and finds, binds, grants or accepts nothing; the round-trip's fresh sign-in is the proof. `409 already_linked` when it is the caller's own sign-in, or a retry of the caller's own link that Auth0 made (the account below is closed then). `409 login_in_use` when another Kenso account signs in with that login or holds its address, read before any Auth0 change. The one exception is the account Auth0's signup made for this login during the round-trip: made in the last 30 minutes, after the Auth0 login, with no workspace. Auth0 then folds the login into the caller's, so it signs in to this account, and that account is closed (`previousAccount`). `503` when Auth0 cannot be reached or another switch or link runs; when Auth0 did not answer the link, reload the logins before retrying. Records `sign_in.login_linked` in each of the caller's workspaces. Open to any workspace member.
 
 - API: `POST /v1/me/sign-in/link`
 - Generated from the API contract
@@ -17996,7 +18094,7 @@ kenso me register-session --data @body.json
 
 Replace the caller's avatar.
 
-Multipart field `file` must be a non-empty PNG, JPEG, or WebP under 10 MB. Requires `ReadAccess`.
+Multipart field `file` must be a non-empty PNG, JPEG, or WebP under 10 MB. Open to any workspace member.
 
 - API: `PUT /v1/me/avatar`
 - Generated from the API contract
@@ -18017,7 +18115,7 @@ kenso me replace-avatar --file ./file.csv
 
 Schedule deletion of the caller's account in 14 days.
 
-Idempotent while a deletion is already pending. Refused when the caller is the last admin of a workspace. Requires `ReadAccess`.
+Idempotent while a deletion is already pending. Refused when the caller is the last admin of a workspace. Open to any workspace member.
 
 - API: `POST /v1/me/deletion-request`
 - Generated from the API contract
@@ -18095,7 +18193,7 @@ kenso me revoke-session --session-id <session-id>
 
 Move the caller's Google, Microsoft or LinkedIn sign-in onto an email login.
 
-The Kenso app calls it once the confirmation link it sent to the new address is opened, with the Auth0 database login it created for that address. Only a person signed in to the Kenso app may switch: an API key, an MCP client or an agent gets `403 forbidden`. `403 feature_off` unless `Auth0:SignInEmailSwitch:Enabled`. The login must be a verified database login for `email`, made for this account and this sign-in, and the address must not be a Kenso team one; it may be the address the old sign-in uses. Its Auth0 organizations are copied first; then the account moves onto it (same user id, workspaces and roles), and the old sign-in is linked into it when Auth0 verified the old sign-in's address, so it still signs in to this account (`linked`), else blocked, then deleted. A failure before the move leaves the account as it was. `409 email_taken` when another Kenso account uses the address, `409 conflict` when the account changed meanwhile, `503` when Auth0 cannot be reached or another switch runs. The caller's token belongs to the retired sign-in: sign the session out afterwards. Requires `ReadAccess`. Cleanup contract (DEV-4247). The new login: the Kenso app never deletes it, and a retry reuses its marked login while Auth0 still has it. Before this endpoint has read the login as made for this account and the caller's sign-in, with no account on it, it deletes nothing: `403 feature_off`, a `400` for a malformed request or a login Auth0 does not have, `403` for a login made for another account or sign-in, `409` for a login an account holds, a `503` when another switch runs or Auth0 cannot be read, and `404`. After that, every refusal deletes it (`409 conflict` when the account left the caller's sign-in included), unless the switch's lease ran short: then the refusal keeps the login, whatever it answers, since another submit may be moving the account onto it, and a lease found short before the move answers `503`. The old sign-in: when Auth0 does not answer the link, or refuses the block or the delete, it stays marked retired (until Auth0 confirms the link or the block, then `Auth0:SignInEmailSwitch:RetiredFor`), so its tokens reach no account, and `SignInEmailSwitchCleanupJob` on clickevent.processor retries. The `moved_at` stamp (DEV-4247). Once the account is on the new login, and before the old sign-in is linked or retired, the switch writes `app_metadata.ken_sign_in_switch.moved_at` (ISO-8601 UTC) on that login, in one write with its `ken_user_id` and `from_user_id`. It never writes it before the move commits. The Kenso app finishes a switch whose answer it lost only on that stamp. When Auth0 refuses it, the switch still answers `200`, and `SignInEmailSwitchCleanupJob` writes it. A retry for an account already on that login answers `409 conflict` and writes a missing stamp first.
+The Kenso app calls it once the confirmation link it sent to the new address is opened, with the Auth0 database login it created for that address. Only a person signed in to the Kenso app may switch: an API key, an MCP client or an agent gets `403 forbidden`. `403 feature_off` unless `Auth0:SignInEmailSwitch:Enabled`. The login must be a verified database login for `email`, made for this account and this sign-in, and the address must not be a Kenso team one; it may be the address the old sign-in uses. Its Auth0 organizations are copied first; then the account moves onto it (same user id, workspaces and roles), and the old sign-in is linked into it when Auth0 verified the old sign-in's address, so it still signs in to this account (`linked`), else blocked, then deleted. A failure before the move leaves the account as it was. `409 email_taken` when another Kenso account uses the address, `409 conflict` when the account changed meanwhile, `503` when Auth0 cannot be reached or another switch runs. The caller's token belongs to the retired sign-in: sign the session out afterwards. Open to any workspace member. Cleanup contract (DEV-4247). The new login: the Kenso app never deletes it, and a retry reuses its marked login while Auth0 still has it. Before this endpoint has read the login as made for this account and the caller's sign-in, with no account on it, it deletes nothing: `403 feature_off`, a `400` for a malformed request or a login Auth0 does not have, `403` for a login made for another account or sign-in, `409` for a login an account holds, a `503` when another switch runs or Auth0 cannot be read, and `404`. After that, every refusal deletes it (`409 conflict` when the account left the caller's sign-in included), unless the switch's lease ran short: then the refusal keeps the login, whatever it answers, since another submit may be moving the account onto it, and a lease found short before the move answers `503`. The old sign-in: when Auth0 does not answer the link, or refuses the block or the delete, it stays marked retired (until Auth0 confirms the link or the block, then `Auth0:SignInEmailSwitch:RetiredFor`), so its tokens reach no account, and `SignInEmailSwitchCleanupJob` on clickevent.processor retries. The `moved_at` stamp (DEV-4247). Once the account is on the new login, and before the old sign-in is linked or retired, the switch writes `app_metadata.ken_sign_in_switch.moved_at` (ISO-8601 UTC) on that login, in one write with its `ken_user_id` and `from_user_id`. It never writes it before the move commits. The Kenso app finishes a switch whose answer it lost only on that stamp. When Auth0 refuses it, the switch still answers `200`, and `SignInEmailSwitchCleanupJob` writes it. A retry for an account already on that login answers `409 conflict` and writes a missing stamp first.
 
 - API: `POST /v1/me/sign-in/switch`
 - Generated from the API contract
@@ -18118,7 +18216,7 @@ kenso me switch-sign-in --data @body.json
 
 Update the caller's profile.
 
-`linkedinUrl`, `firstName`, `lastName`, `jobTitle`, `timeZone` and `language`: absent is unchanged, null or blank clears it. Values are trimmed. `firstName` and `lastName` are at most 100 characters, `jobTitle` at most 200, `timeZone` must be an IANA id such as `America/New_York`, and `language` a BCP 47 tag such as `fr` or `fr-FR` (stored cased, so `fr-fr` is `fr-FR`; null means en); otherwise `validation_failed` with one detail per field. The time zone is stored and returned only. A name saved here is kept on later sign-ins. Saving a URL may enqueue a best-effort avatar derivation when no photo exists. Requires `ReadAccess` because every role can edit their own profile.
+`linkedinUrl`, `firstName`, `lastName`, `jobTitle`, `timeZone` and `language`: absent is unchanged, null or blank clears it. Values are trimmed. `firstName` and `lastName` are at most 100 characters, `jobTitle` at most 200, `timeZone` must be an IANA id such as `America/New_York`, and `language` a BCP 47 tag such as `fr` or `fr-FR` (stored cased, so `fr-fr` is `fr-FR`; null means en); otherwise `validation_failed` with one detail per field. The time zone is stored and returned only. A name saved here is kept on later sign-ins. Saving a URL may enqueue a best-effort avatar derivation when no photo exists. Open to any workspace member, since everyone can edit their own profile.
 
 - API: `PATCH /v1/me`
 - Generated from the API contract
@@ -18235,7 +18333,7 @@ kenso me update-notification --notification-id <notification-id> --data @body.js
 
 Update the caller's notification preferences.
 
-Send only the changed events. Each item sets `isEnabled` (the Email toggle), `channels` (any of `inApp`, `email`, `slack`, `teams`, `push`), or both; `isEnabled` and `channels.email` must agree. Unknown event keys reject the whole request, and so does an `isLocked` event unless the caller is a super admin (detail code `locked`). In app, Slack, Teams and Push on an Accounts event need the `notifications` feature. `dailyBrief.time` is HH:mm and `dailyBrief.timeZone` an IANA time zone. Returns the updated preferences. Requires `ReadAccess`.
+Send only the changed events. Each item sets `isEnabled` (the Email toggle), `channels` (any of `inApp`, `email`, `slack`, `teams`, `push`), or both; `isEnabled` and `channels.email` must agree. Unknown event keys reject the whole request, and so does an `isLocked` event unless the caller is a super admin (detail code `locked`). In app, Slack, Teams and Push on an Accounts event need the `notifications` feature. `dailyBrief.time` is HH:mm and `dailyBrief.timeZone` an IANA time zone. Returns the updated preferences. Open to any workspace member.
 
 - API: `PATCH /v1/me/notification-preferences`
 - Generated from the API contract
@@ -18952,7 +19050,7 @@ kenso meetings create --data @body.json
 
 Plan the meeting's follow-up now ("Draft follow-up").
 
-No body. For a meeting that got no automatic follow-up: it plans the touch, and Ken's writer drafts it on its next pass as the meeting's owner (poll GET until `status` leaves planned). It skips the held check and the owner's "Draft a follow-up after each call" setting, and keeps every other rule. `201` with the touch when it planned one; `200` with the existing one when the meeting already has it (one per meeting, never redrafted: rewrite it with POST /v1/touches/{touchId}/rewrite). `409 invalid_state` when the meeting gets none, with the reason as `error.details[0].code`: `no_account`, `private`, `no_touch_stage`, `no_notes`, `no_recipient`, `flag_off` (Ken's writer is off for the workspace) or `follow_up_deleted`. Nothing is sent without an approval. Flags `meetings` and `meeting_follow_up`; meetings edit, and never a client seat.
+No body. For a meeting that got no automatic follow-up: it plans the touch, and Ken's writer drafts it on its next pass as the meeting's owner (poll GET until `status` leaves planned). It skips the held check and the owner's "Draft a follow-up after each call" setting, and keeps every other rule. `201` with the touch when it planned one; `200` with the existing one when the meeting already has it (one per meeting, never redrafted: rewrite it with POST /v1/touches/{touchId}/rewrite). `409 invalid_state` when the meeting gets none, with the reason as `error.details[0].code`: `no_account`, `private`, `no_touch_stage`, `no_notes`, `no_recipient`, `recipient_suppressed` (the guest unsubscribed, bounced or is on the blocklist), `flag_off` (Ken's writer is off for the workspace) or `follow_up_deleted`. When you already have an email thread with the guest, the follow-up replies in it from the inbox it lives in (`inReplyToMessageId` and `senderInboxId` on the touch); a member's own mailbox only when it is the meeting owner's. Nothing is sent without an approval. Flags `meetings` and `meeting_follow_up`; meetings edit, and never a client seat.
 
 - Beta: needs the `meeting_follow_up` and `meetings` feature flag on the workspace.
 - API: `POST /v1/meetings/{meetingId}/follow-up`
@@ -19238,6 +19336,29 @@ List the meeting's notes sources, the facts they produced and the new people on
 kenso meetings list-sources --meeting-id <meeting-id>
 ```
 
+### kenso meetings next-step-tasks
+
+Add a meeting's next steps as tasks.
+
+Body `{ "lines": [ { "text": "Send the pilot pricing to Maya", "dueAt": "2026-11-05T09:00:00Z" } ] }`: 1 to 20 lines, each `text` trimmed with whitespace runs made one space, then 1 to 500 characters, `dueAt` optional (without it the task is due now). Each line becomes one touch on the meeting's account: `channel` task, `reason` manual, `meetingId` the meeting, `title` the line (a line over 200 characters is cut at a word with "…" for the title and kept whole as the `body`), created by the caller. Returns `{ "items": [...], "created": 1 }`, each item the touch as GET /v1/touches/{touchId} returns it, in line order, and `created`, the number of tasks this request wrote (always present, `0` included). Safe to retry: a line that already has its task (the same text, ignoring case and spacing) returns it and writes nothing, so a repeated line is one task. A line whose task was deleted stays deleted: it is left out of `items` and listed in `skipped` as `{ "text", "reason": "deleted" }` (`not_visible` for a task on an account you cannot see). `201` when it created a task, `200` when every line already had one. `400 validation_failed` for no lines, more than 20, or a blank or too long line (nothing written); `404` for a meeting you cannot see; `409 invalid_state` with `error.details[0].code``no_account` when the meeting has no account (or one outside your account scope). Nothing is sent. Flags `meetings` and `accounts`; meetings edit and accounts edit, and never a client seat.
+
+- Beta: needs the `accounts` and `meetings` feature flag on the workspace.
+- API: `POST /v1/meetings/{meetingId}/next-step-tasks`
+- Generated from the API contract
+- Request body: json (`kenso describe meetings next-step-tasks` prints its schema)
+
+| Flag | Type | Required | Description |
+| --- | --- | --- | --- |
+| `--meeting-id` | string | yes | meetingId (path, string) |
+| `--data` | json | no | Request body as JSON: inline, @file or - for stdin. Flags win over its keys. |
+| `--each` | string | no | Run once per row of a JSONL or CSV file (- for stdin); row keys fill params and body by name. |
+| `--concurrency` | integer | no | With --each: requests in flight at once (1-16, default 4). |
+
+```bash
+kenso meetings next-step-tasks --meeting-id <meeting-id>
+kenso meetings next-step-tasks --meeting-id <meeting-id> --data @body.json
+```
+
 ### kenso meetings regenerate-notes
 
 Rewrite the meeting's notes in another template.
@@ -19283,6 +19404,33 @@ An attached source loses its transcript and the Knowledge rows it produced; a di
 kenso meetings remove-source --meeting-id <meeting-id> --source-id <source-id>
 ```
 
+### kenso meetings rename-speaker
+
+Rename a transcript speaker: name them as one of the meeting's participants, or type a name.
+
+Body `{ "speaker": "Speaker 2", "participantId": 502 }` or `{ "speaker": "Speaker 2", "name": "Jane Doe" }`. `speaker` is the name the transcript shows now (or the label it had before any rename). `participantId` is one of this meeting's participants (`participants[].id` on `GET /v1/meetings/{meetingId}`): their name and email are kept, and the turns match them by email from then on. Otherwise `name` is a typed name, 1 to 120 characters. Neither clears the rename. Every turn of that speaker changes. `source` picks the transcript (`notetaker` or an import's provider such as `fireflies`); without it, the stored transcript the GET returns. The rename reaches every later read (this route, the live view, the MCP, follow-up drafts, call scoring) but is not retroactive: notes already written keep the old names until they are regenerated. While Kenso is still recording, a rename applies to the stored transcript: the answer is that transcript, not the live lines, and a speaker only the live lines have is 422. The meeting's owner or a workspace admin only (403 `forbidden` otherwise); an agent or an API key renames as its member. Returns the transcript as the GET does, with the new names. 400 `validation_failed` for a missing speaker or a bad name; 404 for a meeting you cannot see or a source with no transcript you may read; 422 `validation_error` for a participant not in this meeting or a speaker no turn has; 409 `conflict` when the transcript kept changing (read it again and retry). Flag `meetings`; meetings edit.
+
+- Beta: needs the `meetings` feature flag on the workspace.
+- API: `PATCH /v1/meetings/{meetingId}/transcript/speakers`
+- Generated from the API contract
+- Request body: json (`kenso describe meetings rename-speaker` prints its schema)
+
+| Flag | Type | Required | Description |
+| --- | --- | --- | --- |
+| `--meeting-id` | string | yes | meetingId (path, string) |
+| `--speaker` | string | no | speaker (body, string) |
+| `--name` | string | no | name (body, string) |
+| `--participant-id` | integer | no | participantId (body, integer) |
+| `--source` | string | no | source (body, string) |
+| `--data` | json | no | Request body as JSON: inline, @file or - for stdin. Flags win over its keys. |
+| `--each` | string | no | Run once per row of a JSONL or CSV file (- for stdin); row keys fill params and body by name. |
+| `--concurrency` | integer | no | With --each: requests in flight at once (1-16, default 4). |
+
+```bash
+kenso meetings rename-speaker --meeting-id <meeting-id>
+kenso meetings rename-speaker --meeting-id <meeting-id> --data @body.json
+```
+
 ### kenso meetings replace-brief
 
 Save a brief you wrote as the meeting's new version.
@@ -19353,9 +19501,9 @@ kenso meetings score-call --meeting-id <meeting-id>
 
 ### kenso meetings update
 
-Move a meeting to another account, clear its account, or make it private or shared.
+Move a meeting to another account, clear its account, make it private or shared, or choose whether the Kenso Notetaker bot joins.
 
-Body: `accountId` (an account you can see, or null to clear it; else `400`; a meeting with no account gets one only from its owner, else `403`) and `isPrivate` (true or false; only the meeting's owner and workspace admins, else `403`). Absent fields stay unchanged, and an unknown field is `400`. Changing the account moves no stage and stops nothing. Making a meeting private writes one `meeting.made_private` timeline row. `409 conflict` when the meeting kept changing while it was saved: read it again and retry. Returns the meeting.
+Body: `accountId` (an account you can see, or null to clear it; else `400`; a meeting with no account gets one only from its owner, else `403`), `isPrivate` (true or false; only the meeting's owner and workspace admins, else `403`) and `botMode` (auto, send or skip, else `400`; only the meeting's owner and workspace admins, else `403`; `403` with detail `feature_disabled` while the workspace does not have the Kenso Notetaker bot; skip takes back a bot waiting to join). Absent fields stay unchanged, and an unknown field is `400`. Changing the account moves no stage and stops nothing. Making a meeting private writes one `meeting.made_private` timeline row. `409 conflict` when the meeting kept changing while it was saved: read it again and retry. Returns the meeting with its capture and bot.
 
 - Beta: needs the `meetings` feature flag on the workspace.
 - API: `PATCH /v1/meetings/{meetingId}`
@@ -19367,6 +19515,7 @@ Body: `accountId` (an account you can see, or null to clear it; else `400`; a me
 | `--meeting-id` | string | yes | meetingId (path, string) |
 | `--account-id` | integer | no | accountId (body, integer) |
 | `--is-private` | boolean | no | isPrivate (body, boolean) |
+| `--bot-mode` | string | no | botMode (body, string) |
 | `--no-is-private` | boolean | no | Send isPrivate as false. |
 | `--data` | json | no | Request body as JSON: inline, @file or - for stdin. Flags win over its keys. |
 | `--each` | string | no | Run once per row of a JSONL or CSV file (- for stdin); row keys fill params and body by name. |
@@ -19635,7 +19784,7 @@ kenso members update --member-id <member-id> --data @body.json
 
 Start Microsoft's admin consent for Teams transcripts.
 
-Returns Microsoft's admin-consent page for the Ken Workspace app with the two Teams transcript permissions (`OnlineMeetings.Read` and `OnlineMeetingTranscript.Read.All`), and when the link expires (7 days, since it is often forwarded to the tenant's Microsoft admin). Open it in the browser; a Microsoft admin of the members' tenant approves. Microsoft then sends the browser back to Ken, which lands on `returnTo` with `teams_consent=granted` (members waiting on the approval are searched again), `teams_consent=denied` (declined, or Microsoft failed) or `teams_consent=invalid` (an expired or altered link). Nothing is stored until then. `returnTo` is a dashboard path (at most 512 characters, a single leading `/`); omitted, `/demo/settings/integrations/teams`. `400 validation_failed` for any other `returnTo`, `503 service_unavailable` while Ken's Microsoft app is not configured. Workspace admins only, as a person in Ken: an agent or an API key gets `403`.
+Returns Microsoft's admin-consent page for the Ken Workspace app with the two Teams transcript permissions (`OnlineMeetings.Read` and `OnlineMeetingTranscript.Read.All`), and when the link expires (7 days, since it is often forwarded to the tenant's Microsoft admin). Open it in the browser; a Microsoft admin of the members' tenant approves. Microsoft then sends the browser back to Ken, which lands on `returnTo` with `teams_consent=granted` (members waiting on the approval are searched again), `teams_consent=denied` (declined, or Microsoft failed) or `teams_consent=invalid` (an expired or altered link). Nothing is stored until then. `returnTo` is a dashboard path (at most 512 characters, a single leading `/`); omitted, `/settings/integrations/teams`. `400 validation_failed` for any other `returnTo`, `503 service_unavailable` while Ken's Microsoft app is not configured. Workspace admins only, as a person in Ken: an agent or an API key gets `403`.
 
 - Beta: needs the `meetings` and `native_transcripts` feature flag on the workspace.
 - API: `POST /v1/integrations/microsoft-teams/admin-consent-sessions`
@@ -19644,7 +19793,7 @@ Returns Microsoft's admin-consent page for the Ken Workspace app with the two Te
 
 | Flag | Type | Required | Description |
 | --- | --- | --- | --- |
-| `--return-to` | string | no | The dashboard path Microsoft's admin-consent page returns to, at most 512 characters, starting with a single `/`. Omitted: `/demo/settings/integrations/teams`. |
+| `--return-to` | string | no | The dashboard path Microsoft's admin-consent page returns to, at most 512 characters, starting with a single `/`. Omitted: `/settings/integrations/teams`. |
 | `--data` | json | no | Request body as JSON: inline, @file or - for stdin. Flags win over its keys. |
 | `--each` | string | no | Run once per row of a JSONL or CSV file (- for stdin); row keys fill params and body by name. |
 | `--concurrency` | integer | no | With --each: requests in flight at once (1-16, default 4). |
@@ -19686,7 +19835,7 @@ kenso migration-connections create --data @body.json
 
 Finish connecting Outreach.
 
-Send the `code`, `state` and `error` Outreach returned, with `provider``outreach`, signed in to the dashboard as the member who started the connect, in the workspace it was started in. `data.returnUrl` is the Kenso app path to land on, `/{workspaceId}/demo/settings/import` with `outreach=connected&connectionId={id}`, or `outreach=error&reason=...` with `provider_error` (declined, or Outreach failed), `exchange_failed`, `scope_required` (a permission was not granted), `key_rejected`, `vendor_error`, `vendor_unavailable`, `not_found`, `run_already_active`, `account_mismatch` (a reconnect of a connection that discovered or ran, with another Outreach organization or one Kenso cannot confirm: add it as a new connection), `discovery_changed` or `save_failed`. A state that is expired, unreadable, or was started by another member or in another workspace is `validation_failed` with `invalid_state` in `error.details[0].code`, and nothing is exchanged. An API key, MCP or agent call is `forbidden`.
+Send the `code`, `state` and `error` Outreach returned, with `provider``outreach`, signed in to the dashboard as the member who started the connect, in the workspace it was started in. `data.returnUrl` is the Kenso app path to land on, `/{workspaceId}/settings/import` with `outreach=connected&connectionId={id}`, or `outreach=error&reason=...` with `provider_error` (declined, or Outreach failed), `exchange_failed`, `scope_required` (a permission was not granted), `key_rejected`, `vendor_error`, `vendor_unavailable`, `not_found`, `run_already_active`, `account_mismatch` (a reconnect of a connection that discovered or ran, with another Outreach organization or one Kenso cannot confirm: add it as a new connection), `discovery_changed` or `save_failed`. A state that is expired, unreadable, or was started by another member or in another workspace is `validation_failed` with `invalid_state` in `error.details[0].code`, and nothing is exchanged. An API key, MCP or agent call is `forbidden`.
 
 - Beta: needs the `migrations` feature flag on the workspace.
 - API: `POST /v1/migration-connections/connect-completions`
@@ -20052,7 +20201,7 @@ kenso migration-vendors list
 
 Create a model configuration for a campaign in the current workspace.
 
-Returns `201` and `Location`. A campaign outside the workspace is `not_found` before the write. Requires `WriteAccess`.
+Returns `201` and `Location`. A campaign outside the workspace is `not_found` before the write. Requires Campaigns edit.
 
 - API: `POST /v1/model-configurations`
 - Generated from the API contract
@@ -20080,7 +20229,7 @@ kenso model-configurations create --data @body.json
 
 Delete a model configuration in the current workspace.
 
-Returns `204`. A configuration outside the workspace is `not_found` before the delete. Requires `WriteAccess`.
+Returns `204`. A configuration outside the workspace is `not_found` before the delete. Requires Campaigns edit.
 
 - API: `DELETE /v1/model-configurations/{modelConfigurationId}`
 - Generated from the API contract
@@ -20099,7 +20248,7 @@ kenso model-configurations delete --model-configuration-id <model-configuration-
 
 Return one model configuration in the current workspace.
 
-A missing id, or one whose campaign is outside the workspace, is `not_found`. Requires `ReadAccess`.
+A missing id, or one whose campaign is outside the workspace, is `not_found`. Requires Campaigns view.
 
 - API: `GET /v1/model-configurations/{modelConfigurationId}`
 - Generated from the API contract
@@ -20118,7 +20267,7 @@ kenso model-configurations get --model-configuration-id <model-configuration-id>
 
 List model configurations for a campaign in the current workspace.
 
-`campaignId` is required. A campaign outside `X-Ken-Workspace-Id` is `not_found` before the list is read. Optional `flow` narrows the page. Requires `ReadAccess`.
+`campaignId` is required. A campaign outside `X-Ken-Workspace-Id` is `not_found` before the list is read. Optional `flow` narrows the page. Requires Campaigns view.
 
 - API: `GET /v1/model-configurations` (a list: `--limit`, `--cursor`, `--all`)
 - Generated from the API contract
@@ -20142,7 +20291,7 @@ kenso model-configurations list --all
 
 Update a model configuration in the current workspace.
 
-Absent fields stay unchanged. A configuration outside the workspace is `not_found` before the write. Requires `WriteAccess`.
+Absent fields stay unchanged. A configuration outside the workspace is `not_found` before the write. Requires Campaigns edit.
 
 - API: `PATCH /v1/model-configurations/{modelConfigurationId}`
 - Generated from the API contract
@@ -20388,7 +20537,7 @@ kenso onboarding get
 
 Update the signed-in user's onboarding progress.
 
-Replaces `PATCH /v1/onboarding/progress`. Null fields are left unchanged. `segment` is `new_to_outbound`, `experienced`, or `expert_ai`. `lane` is `before_launch` or `after_launch`. `answers` is a JSON object that replaces the stored one, at most 262,144 bytes as compact JSON; anything else is `400 validation_failed`. Setting `completedAt` no longer turns `early_access` on: the sample mode is retired (DEV-7366). Saved answers with `mode: recruiting` still turn `recruiting` on for the resolved workspace (DEV-1274). Works before the caller has a workspace. Requires a signed-in user.
+Replaces `PATCH /v1/onboarding/progress`. Null fields are left unchanged. `segment` is `new_to_outbound`, `experienced`, or `expert_ai`. `lane` is `before_launch` or `after_launch`. `answers` is a JSON object that replaces the stored one, at most 262,144 bytes as compact JSON; anything else is `400 validation_failed`. Setting `completedAt` turns no feature flag on. Saved answers with `mode: recruiting` turn `recruiting` on for the resolved workspace (DEV-1274). Works before the caller has a workspace. Requires a signed-in user.
 
 - API: `PATCH /v1/onboarding`
 - Generated from the API contract
@@ -20899,7 +21048,7 @@ kenso optiverse-connection get
 
 Add up to 500 attendees, exhibitors, speakers or sponsors to an outbound event.
 
-Body: `source` (required: csv, url, manual, api, paste, xlsx, pdf or image, or a Find with Ken source: company_people, prospectus, profile_mention, inbox_mention or last_year), `sourceUrl` (http or https, up to 2048 characters) and `items` (1 to 500). Each item has `role` (required: attendee, exhibitor, speaker or sponsor) and any of `fullName`, `firstName`, `lastName`, `title`, `email`, `linkedinUrl`, `companyName` and `companyDomain` (a domain, website URL or work email; without it, a work email's domain is used), and must name a person (a full name, first and last name, email or LinkedIn URL) or a company. Example: `{ "source": "url", "sourceUrl": "https://example.com/speakers", "items": [ { "role": "speaker", "fullName": "Maya Chen", "title": "VP Sales", "companyName": "Northwind", "companyDomain": "northwind.com" } ] }`. Returns 200 with `succeeded`, `failed` and one result per item in request order: `created` (with `id`), `duplicate` (with the `id` of the row already on the event with the same role and the same email, else LinkedIn URL, else name and company, else company; counted in succeeded) or `validation_failed` (with `error`; counted in failed). A duplicate fills the stored row's blank `title` and `companyDomain` from the item, and a filled domain marks the row matched (source `input`), so resending a row with its domain corrects an unmatched one. Rows with no company domain are looked up in Kenso Search during this call: the company by name, the person by first name, last name and company. A failed lookup marks the row `failed` and never fails the request; sending the row again retries it. Another workspace's event is `404`. Requires `WriteAccess`.
+Body: `source` (required: csv, url, manual, api, paste, xlsx, pdf or image, or a Find with Ken source: company_people, prospectus, profile_mention, inbox_mention or last_year), `sourceUrl` (http or https, up to 2048 characters) and `items` (1 to 500). Each item has `role` (required: attendee, exhibitor, speaker or sponsor) and any of `fullName`, `firstName`, `lastName`, `title`, `email`, `linkedinUrl`, `companyName` and `companyDomain` (a domain, website URL or work email; without it, a work email's domain is used), and must name a person (a full name, first and last name, email or LinkedIn URL) or a company. Example: `{ "source": "url", "sourceUrl": "https://example.com/speakers", "items": [ { "role": "speaker", "fullName": "Maya Chen", "title": "VP Sales", "companyName": "Northwind", "companyDomain": "northwind.com" } ] }`. Returns 200 with `succeeded`, `failed` and one result per item in request order: `created` (with `id`), `duplicate` (with the `id` of the row already on the event with the same role and the same email, else LinkedIn URL, else name and company, else company; counted in succeeded) or `validation_failed` (with `error`; counted in failed). A duplicate fills the stored row's blank `title` and `companyDomain` from the item, and a filled domain marks the row matched (source `input`), so resending a row with its domain corrects an unmatched one. Rows with no company domain are looked up in Kenso Search during this call: the company by name, the person by first name, last name and company. A failed lookup marks the row `failed` and never fails the request; sending the row again retries it. Another workspace's event is `404`. Requires Accounts edit.
 
 - Beta: needs the `accounts` and `event_outbound` feature flag on the workspace.
 - API: `POST /v1/outbound-events/{eventId}/attendees/bulk-create`
@@ -20924,7 +21073,7 @@ kenso outbound-event-attendees bulk-create --event-id <event-id> --data @body.js
 
 Remove one attendee, exhibitor, speaker or sponsor from its event.
 
-Soft delete; returns `204`. The same person or company can be added again afterwards. A row of another workspace, or of a deleted event, is `404 not_found`. Requires `WriteAccess`.
+Soft delete; returns `204`. The same person or company can be added again afterwards. A row of another workspace, or of a deleted event, is `404 not_found`. Requires Accounts edit.
 
 - Beta: needs the `accounts` and `event_outbound` feature flag on the workspace.
 - API: `DELETE /v1/outbound-event-attendees/{attendeeId}`
@@ -20944,7 +21093,7 @@ kenso outbound-event-attendees delete --attendee-id <attendee-id>
 
 List an outbound event's attendees, exhibitors, speakers and sponsors.
 
-Filters: `role` (comma = OR: attendee, exhibitor, speaker, sponsor) and `account` (`matched`: the row's company domain belongs to a live account; `unmatched`: every other row). `limit` 1-500 (default 100) and `cursor` page by id, oldest first. Each row carries `account` (the matched account with its stage and this event's Event touch, else null), `personId` (a person in the workspace with the row's email, else its LinkedIn URL) and `stakeholderId` (that person on that account). With account scope `own`, only accounts the caller owns and their people match. Another workspace's event is `404`. Requires `ReadAccess`.
+Filters: `role` (comma = OR: attendee, exhibitor, speaker, sponsor) and `account` (`matched`: the row's company domain belongs to a live account; `unmatched`: every other row). `limit` 1-500 (default 100) and `cursor` page by id, oldest first. Each row carries `account` (the matched account with its stage and this event's Event touch, else null), `personId` (a person in the workspace with the row's email, else its LinkedIn URL) and `stakeholderId` (that person on that account). With account scope `own`, only accounts the caller owns and their people match. Another workspace's event is `404`. Requires Accounts view.
 
 - Beta: needs the `accounts` and `event_outbound` feature flag on the workspace.
 - API: `GET /v1/outbound-events/{eventId}/attendees` (a list: `--limit`, `--cursor`, `--all`)
@@ -20972,7 +21121,7 @@ kenso outbound-event-attendees list --event-id <event-id> --all
 
 Add a suggested event as an outbound event.
 
-Creates a normal outbound event from the suggestion (name, dates, timezone, format, city, venue and url), ready for an attendee list (`POST /v1/outbound-events/{eventId}/extract-attendees` reads its page), and marks the suggestion `added` with that `eventId`. The body is optional: `{ "attendance": "going" }` (or `not_going`) sets the new event's `attendance`; without it the event is not decided (`null`). Any other attendance is `400 validation_failed`. Returns `200` with `{ suggestion, event }`. A suggestion that is not `suggested` (already added or dismissed) is `409 invalid_state`; another workspace's is `404`. Requires `WriteAccess`.
+Creates a normal outbound event from the suggestion (name, dates, timezone, format, city, venue and url), ready for an attendee list (`POST /v1/outbound-events/{eventId}/extract-attendees` reads its page), and marks the suggestion `added` with that `eventId`. The body is optional: `{ "attendance": "going" }` (or `not_going`) sets the new event's `attendance`; without it the event is not decided (`null`). Any other attendance is `400 validation_failed`. Returns `200` with `{ suggestion, event }`. A suggestion that is not `suggested` (already added or dismissed) is `409 invalid_state`; another workspace's is `404`. Requires Accounts edit.
 
 - Beta: needs the `accounts` and `event_outbound` feature flag on the workspace.
 - API: `POST /v1/outbound-event-suggestions/{suggestionId}/accept`
@@ -20996,7 +21145,7 @@ kenso outbound-event-suggestions accept --suggestion-id <suggestion-id> --data @
 
 Dismiss a suggested event, so Ken never suggests it again.
 
-Marks the suggestion `dismissed` and returns it. Kenso keeps its page and its name and start date, so weekly discovery skips the event on every source. A suggestion that is not `suggested` is `409 invalid_state`; another workspace's is `404`. Requires `WriteAccess`.
+Marks the suggestion `dismissed` and returns it. Kenso keeps its page and its name and start date, so weekly discovery skips the event on every source. A suggestion that is not `suggested` is `409 invalid_state`; another workspace's is `404`. Requires Accounts edit.
 
 - Beta: needs the `accounts` and `event_outbound` feature flag on the workspace.
 - API: `POST /v1/outbound-event-suggestions/{suggestionId}/dismiss`
@@ -21016,7 +21165,7 @@ kenso outbound-event-suggestions dismiss --suggestion-id <suggestion-id>
 
 List suggested events in the current workspace, most relevant first.
 
-`status`: `suggested` (default: waiting for a decision; an event that has ended, by today's date in its own `timezone`, else UTC, is left out), `added` or `dismissed`. `limit` 1-200 (default 50) and `cursor` page by `relevance`, then id, both descending. Each suggestion carries `name`, `startsOn`, `endsOn`, `timezone`, `format` (`in_person`, `virtual` or `hybrid`), `city`, `venue`, `url` (the event page), `source` (where Ken found it: `luma`, `dev_events`, `allevents` or `meetup`; `eventbrite`, `tentimes` or `conferenceindex` where Kenso reads them through Firecrawl for the workspace; or `eventbrite` or `linkedin` from a workflow's Apify actor), `sourceUrl` (the listing it was found on; null for an Apify actor's events), `relevance` (0-100), `reason` (one line on why it fits), `accounts` (the workspace's accounts the page names, each `{ accountId, name, role }`), `status`, `eventId` (the event adding it created), `createdAt` and `decidedAt`. Requires `ReadAccess`.
+`status`: `suggested` (default: waiting for a decision; an event that has ended, by today's date in its own `timezone`, else UTC, is left out), `added` or `dismissed`. `limit` 1-200 (default 50) and `cursor` page by `relevance`, then id, both descending. Each suggestion carries `name`, `startsOn`, `endsOn`, `timezone`, `format` (`in_person`, `virtual` or `hybrid`), `city`, `venue`, `url` (the event page), `source` (where Ken found it: `luma`, `dev_events`, `allevents` or `meetup`; `eventbrite`, `tentimes` or `conferenceindex` where Kenso reads them through Firecrawl for the workspace; or `eventbrite` or `linkedin` from a workflow's Apify actor), `sourceUrl` (the listing it was found on; null for an Apify actor's events), `relevance` (0-100), `reason` (one line on why it fits), `accounts` (the workspace's accounts the page names, each `{ accountId, name, role }`), `status`, `eventId` (the event adding it created), `createdAt` and `decidedAt`. Requires Accounts view.
 
 - Beta: needs the `accounts` and `event_outbound` feature flag on the workspace.
 - API: `GET /v1/outbound-event-suggestions` (a list: `--limit`, `--cursor`, `--all`)
@@ -21042,7 +21191,7 @@ kenso outbound-event-suggestions list --all
 
 Create an outbound event.
 
-Body: `name` (required, 1-200 characters after trim), `startsOn` (required, YYYY-MM-DD), `endsOn` (YYYY-MM-DD, default `startsOn`, not before it), `timezone` (IANA, such as `America/Chicago`), `format` (`in_person`, the default, `virtual` or `hybrid`), `attendance` (`going` or `not_going`, default null), `city` and `venue` (up to 200 characters) and `url` (http or https, up to 2048 characters). Example: `{ "name": "SaaStr Annual", "startsOn": "2026-09-09", "endsOn": "2026-09-11", "timezone": "America/Los_Angeles", "city": "San Mateo", "url": "https://www.saastrannual.com" }`. Returns `201` with the event. Requires `WriteAccess`.
+Body: `name` (required, 1-200 characters after trim), `startsOn` (required, YYYY-MM-DD), `endsOn` (YYYY-MM-DD, default `startsOn`, not before it), `timezone` (IANA, such as `America/Chicago`), `format` (`in_person`, the default, `virtual` or `hybrid`), `attendance` (`going` or `not_going`, default null), `city` and `venue` (up to 200 characters) and `url` (http or https, up to 2048 characters). Example: `{ "name": "SaaStr Annual", "startsOn": "2026-09-09", "endsOn": "2026-09-11", "timezone": "America/Los_Angeles", "city": "San Mateo", "url": "https://www.saastrannual.com" }`. Returns `201` with the event. Requires Accounts edit.
 
 - Beta: needs the `accounts` and `event_outbound` feature flag on the workspace.
 - API: `POST /v1/outbound-events`
@@ -21073,7 +21222,7 @@ kenso outbound-events create --data @body.json
 
 Delete an outbound event.
 
-Soft delete; returns `204`. Its rows stop showing in every list. Another workspace's event is `404`. Requires `WriteAccess`.
+Soft delete; returns `204`. Its rows stop showing in every list. Another workspace's event is `404`. Requires Accounts edit.
 
 - Beta: needs the `accounts` and `event_outbound` feature flag on the workspace.
 - API: `DELETE /v1/outbound-events/{eventId}`
@@ -21093,7 +21242,7 @@ kenso outbound-events delete --event-id <event-id>
 
 Read an event page or a pasted list and preview the people or companies it lists.
 
-Body: `url` (the exhibitor, speaker, sponsor or attendee page, an absolute http(s) URL up to 2048 characters) or `text` (a pasted list instead: names, emails, LinkedIn URLs, an email or a page's text, up to 120,000 characters; not both), and `role` (required: attendee, exhibitor, speaker or sponsor, given to every row). Example: `{ "url": "https://example.com/exhibitors", "role": "exhibitor" }` or `{ "text": "Jordan Lee - VP Sales, Acme Robotics", "role": "attendee" }`. A page comes from Kenso's web archive first (`source``archive`), else a live read when the workspace can run one (`live`); otherwise `source` is `none` with no rows. Pasted text is `source``text` with no `url`; a row read from text may also carry an `email`. The model reads the rows, long content in parts of 20,000 characters at once; each row comes back normalized like bulk-create (repeats and rows that fail validation are left out), in order, ready to send to `POST /v1/outbound-events/{eventId}/attendees/bulk-create`. `truncated` is true when the page was too long to read whole, an answer reached the model's output cap (the rows read before it are kept), a part failed while others answered, or the rows reached the cap of 300. Nothing is stored. The model calls are not charged; a live read is charged like any web read of the workspace (an archive read is free). A model failure answers 200 with no rows. Files go to the multipart form of this route (`outbound-events.extract-attendees-from-files`). `mode``prospectus` (DEV-4351; default `attendees`) reads a sponsorship prospectus or a who-attends page for the companies it names (company-only rows, sent to bulk-create with `source``prospectus`), `titleMix` (the job titles it says attendees hold, each with `share` as a fraction or null, largest first, at most 20: send them as `find-company-people`'s `titles`) and `attendeeCount`; a page in this mode is read from the site or Kenso's archive only, never live. Another workspace's event is `404`. Requires `WriteAccess`.
+Body: `url` (the exhibitor, speaker, sponsor or attendee page, an absolute http(s) URL up to 2048 characters) or `text` (a pasted list instead: names, emails, LinkedIn URLs, an email or a page's text, up to 120,000 characters; not both), and `role` (required: attendee, exhibitor, speaker or sponsor, given to every row). Example: `{ "url": "https://example.com/exhibitors", "role": "exhibitor" }` or `{ "text": "Jordan Lee - VP Sales, Acme Robotics", "role": "attendee" }`. A page comes from Kenso's web archive first (`source``archive`), else a live read when the workspace can run one (`live`); otherwise `source` is `none` with no rows. Pasted text is `source``text` with no `url`; a row read from text may also carry an `email`. The model reads the rows, long content in parts of 20,000 characters at once; each row comes back normalized like bulk-create (repeats and rows that fail validation are left out), in order, ready to send to `POST /v1/outbound-events/{eventId}/attendees/bulk-create`. `truncated` is true when the page was too long to read whole, an answer reached the model's output cap (the rows read before it are kept), a part failed while others answered, or the rows reached the cap of 300. Nothing is stored. The model calls are not charged; a live read is charged like any web read of the workspace (an archive read is free). A model failure answers 200 with no rows. Files go to the multipart form of this route (`outbound-events.extract-attendees-from-files`). `mode``prospectus` (DEV-4351; default `attendees`) reads a sponsorship prospectus or a who-attends page for the companies it names (company-only rows, sent to bulk-create with `source``prospectus`), `titleMix` (the job titles it says attendees hold, each with `share` as a fraction or null, largest first, at most 20: send them as `find-company-people`'s `titles`) and `attendeeCount`; a page in this mode is read from the site or Kenso's archive only, never live. Another workspace's event is `404`. Requires Accounts edit.
 
 - Beta: needs the `accounts` and `event_outbound` feature flag on the workspace.
 - API: `POST /v1/outbound-events/{eventId}/extract-attendees`
@@ -21120,7 +21269,7 @@ kenso outbound-events extract-attendees --event-id <event-id> --data @body.json
 
 Read uploaded files (a spreadsheet, PDFs, badge or card photos) and preview the people they list.
 
-Multipart form on the same path as `outbound-events.extract-attendees`: `files` (1 to 10 files) and `role` (required: attendee, exhibitor, speaker or sponsor, given to every row). One entry per file comes back in upload order, each with `kind` (`spreadsheet`, `pdf`, `image` or `other`), `status` (`read`, `skipped` or `failed`) and, unless read, a `reason`. An .xlsx (at most 10 MB, one per request; a second is `extra_spreadsheet`) comes back as `table`: its first visible sheet with a value, the first row as `columns` (at most 50) and up to 5,000 `rows`, each with one cell per column, for column mapping; no model reads it. Hidden rows are left out; hidden columns are kept, in place. A PDF (at most 10 MB, the first 40 pages; at most 120,000 characters across the request's PDFs, a later one is `text_limit`) has its text read by the model like a page; one with no text layer, such as a scan, is `no_text`: send photos of its pages instead. Each JPEG, PNG or WebP image (at most 3.75 MB and 8,000 px on a side; a badge, a business card or a list) is one Claude vision call, at most 3 at a time. A PDF's or image's `rows` are normalized like bulk-create, may carry an `email` (never a phone number), and are ready to send to `POST /v1/outbound-events/{eventId}/attendees/bulk-create` with `source``pdf` or `image` (`xlsx` for a mapped table). Other reasons: `unsupported_type` (HEIC included: send it as JPEG), `too_large`, `too_many_files` (past the tenth), `oversized_image` (over 8,000 px on one side: crop it into parts), `unreadable` (a damaged file or image header) and `extraction_failed` (the model did not answer; try again). `truncated` is true when Kenso read only part of a file. `mode``prospectus` (default `attendees`) reads each PDF or image as a sponsorship prospectus or who-attends page: company-only `rows` (bulk-create `source``prospectus`), `titleMix` and `attendeeCount`, as on `outbound-events.extract-attendees`. Nothing is stored. The model calls are not charged. A request over 52 MB is `413`. Another workspace's event is `404`. Requires `WriteAccess`.
+Multipart form on the same path as `outbound-events.extract-attendees`: `files` (1 to 10 files) and `role` (required: attendee, exhibitor, speaker or sponsor, given to every row). One entry per file comes back in upload order, each with `kind` (`spreadsheet`, `pdf`, `image` or `other`), `status` (`read`, `skipped` or `failed`) and, unless read, a `reason`. An .xlsx (at most 10 MB, one per request; a second is `extra_spreadsheet`) comes back as `table`: its first visible sheet with a value, the first row as `columns` (at most 50) and up to 5,000 `rows`, each with one cell per column, for column mapping; no model reads it. Hidden rows are left out; hidden columns are kept, in place. A PDF (at most 10 MB, the first 40 pages; at most 120,000 characters across the request's PDFs, a later one is `text_limit`) has its text read by the model like a page; one with no text layer, such as a scan, is `no_text`: send photos of its pages instead. Each JPEG, PNG or WebP image (at most 3.75 MB and 8,000 px on a side; a badge, a business card or a list) is one Claude vision call, at most 3 at a time. A PDF's or image's `rows` are normalized like bulk-create, may carry an `email` (never a phone number), and are ready to send to `POST /v1/outbound-events/{eventId}/attendees/bulk-create` with `source``pdf` or `image` (`xlsx` for a mapped table). Other reasons: `unsupported_type` (HEIC included: send it as JPEG), `too_large`, `too_many_files` (past the tenth), `oversized_image` (over 8,000 px on one side: crop it into parts), `unreadable` (a damaged file or image header) and `extraction_failed` (the model did not answer; try again). `truncated` is true when Kenso read only part of a file. `mode``prospectus` (default `attendees`) reads each PDF or image as a sponsorship prospectus or who-attends page: company-only `rows` (bulk-create `source``prospectus`), `titleMix` and `attendeeCount`, as on `outbound-events.extract-attendees`. Nothing is stored. The model calls are not charged. A request over 52 MB is `413`. Another workspace's event is `404`. Requires Accounts edit.
 
 - Beta: needs the `accounts` and `event_outbound` feature flag on the workspace.
 - API: `POST /v1/outbound-events/{eventId}/extract-attendees`
@@ -21145,7 +21294,7 @@ kenso outbound-events extract-attendees-from-files --event-id <event-id> --file
 
 Find people at the event's exhibitor, sponsor and listed companies with Kenso Search.
 
-Body (optional): `titles` (1 to 20 job titles of up to 100 characters, such as a prospectus's `titleMix`; default the roles that staff a booth: sales, marketing, partnerships, business development, account executives, events and founders; Kenso Search matches a current title that holds every word of one), `nearEventCity` (true: only people whose profile city is the event's city; ignored when the event has none), `perCompany` (3 to 10, default 5) and `limit` (1 to 200, default 200). Example: `{ "titles": ["CFO", "Partner"], "perCompany": 3 }`. The companies are the event's exhibitor and sponsor rows and its rows with no person (the companies a prospectus named), sponsors first, at most 100 per call; each is found in Kenso Search by its domain, else by a name only one company has. People already on the event are left out. Each comes back with `source``company_people`, `isLikely` true (they work there and may not go: label them likely and write "your team is exhibiting", never "saw you're attending"), a `reason` and a `row` with the company's role, ready for `POST /v1/outbound-events/{eventId}/attendees/bulk-create` with that source. `companyCount` is how many companies Kenso Search looked at; `truncated` is true when the limit or the 100-company cap cut the list. A Kenso Search failure leaves its companies out with a `note`. Nothing is stored and nothing is charged; each profile returned counts against the workspace's `searchBrowseRows` quota (`429``quota_exceeded` past it). Another workspace's event is `404`. Requires `WriteAccess`.
+Body (optional): `titles` (1 to 20 job titles of up to 100 characters, such as a prospectus's `titleMix`; default the roles that staff a booth: sales, marketing, partnerships, business development, account executives, events and founders; Kenso Search matches a current title that holds every word of one), `nearEventCity` (true: only people whose profile city is the event's city; ignored when the event has none), `perCompany` (3 to 10, default 5) and `limit` (1 to 200, default 200). Example: `{ "titles": ["CFO", "Partner"], "perCompany": 3 }`. The companies are the event's exhibitor and sponsor rows and its rows with no person (the companies a prospectus named), sponsors first, at most 100 per call; each is found in Kenso Search by its domain, else by a name only one company has. People already on the event are left out. Each comes back with `source``company_people`, `isLikely` true (they work there and may not go: label them likely and write "your team is exhibiting", never "saw you're attending"), a `reason` and a `row` with the company's role, ready for `POST /v1/outbound-events/{eventId}/attendees/bulk-create` with that source. `companyCount` is how many companies Kenso Search looked at; `truncated` is true when the limit or the 100-company cap cut the list. A Kenso Search failure leaves its companies out with a `note`. Nothing is stored and nothing is charged; each profile returned counts against the workspace's `searchBrowseRows` quota (`429``quota_exceeded` past it). Another workspace's event is `404`. Requires Accounts edit.
 
 - Beta: needs the `accounts` and `event_outbound` feature flag on the workspace.
 - API: `POST /v1/outbound-events/{eventId}/find-company-people`
@@ -21172,7 +21321,7 @@ kenso outbound-events find-company-people --event-id <event-id> --data @body.jso
 
 Find the previous edition's speaker, sponsor and exhibitor lists and preview their rows, labeled last year.
 
-Body (optional): `url` (the event's site: its home page or a speaker, sponsor or exhibitor page, this year's or last year's, an absolute http(s) URL up to 2048 characters; default the event's `url`, and one of them is required) and `limit` (1 to 500 rows, default 500). Example: `{ "url": "https://kccncna2026.sched.com" }`. Last year is the year before the event's start date (`year`). Ken looks, for free and with no key: first at the link with the year moved back (`kccncna2026.sched.com` is `kccncna2025.sched.com`, an a2z show's `FABTECH2026` is `FABTECH2025`), a past-year page that is often still live; then at the list pages last year's version of the link names, each read live when its address carries last year, else from its latest Wayback Machine copy of last year; with none found, at one Wayback lookup across the site. Common Crawl is not read: its robots.txt closes it to crawlers. At most 4 pages are read (`truncated` when more were found), each with the extract-attendees readers: a platform's own list (Sched, Sessionize, Map Your Show, a2z, ExpoFP, Luma) with no model call, any other page's text by the model. `lists` has each page read: `url` (as published), `archiveUrl` and `capturedAt` (the Wayback copy, null when live), `role`, `reader`, `count` (rows it gave), `truncated` and `note`. Each of `people` has `source``last_year`, `lastYear` true, `isLikely` true, a `reason` (<c>Speaker in 2025 on kccncna2025.sched.com</c>), `pageUrl`, `capturedAt` and a `row` with its role on last year's list, ready for `POST /v1/outbound-events/{eventId}/attendees/bulk-create` with source `last_year`, which labels the row "last year" on the event. Rows already on the event in the same role are left out. Last year's list is a proxy: companies usually come back (63% of FABTECH 2026's exhibitors were there in 2025), people less often (31% of KubeCon NA 2025's speakers spoke in 2024), so write "spoke last year", never "see you there". `truncated` is true when the limit, the page cap or a list's own cap cut the answer. `note` says why nothing came back. Nothing is stored and nothing is charged. Another workspace's event is `404`. Requires `WriteAccess`.
+Body (optional): `url` (the event's site: its home page or a speaker, sponsor or exhibitor page, this year's or last year's, an absolute http(s) URL up to 2048 characters; default the event's `url`, and one of them is required) and `limit` (1 to 500 rows, default 500). Example: `{ "url": "https://kccncna2026.sched.com" }`. Last year is the year before the event's start date (`year`). Ken looks, for free and with no key: first at the link with the year moved back (`kccncna2026.sched.com` is `kccncna2025.sched.com`, an a2z show's `FABTECH2026` is `FABTECH2025`), a past-year page that is often still live; then at the list pages last year's version of the link names, each read live when its address carries last year, else from its latest Wayback Machine copy of last year; with none found, at one Wayback lookup across the site. Common Crawl is not read: its robots.txt closes it to crawlers. At most 4 pages are read (`truncated` when more were found), each with the extract-attendees readers: a platform's own list (Sched, Sessionize, Map Your Show, a2z, ExpoFP, Luma) with no model call, any other page's text by the model. `lists` has each page read: `url` (as published), `archiveUrl` and `capturedAt` (the Wayback copy, null when live), `role`, `reader`, `count` (rows it gave), `truncated` and `note`. Each of `people` has `source``last_year`, `lastYear` true, `isLikely` true, a `reason` (<c>Speaker in 2025 on kccncna2025.sched.com</c>), `pageUrl`, `capturedAt` and a `row` with its role on last year's list, ready for `POST /v1/outbound-events/{eventId}/attendees/bulk-create` with source `last_year`, which labels the row "last year" on the event. Rows already on the event in the same role are left out. Last year's list is a proxy: companies usually come back (63% of FABTECH 2026's exhibitors were there in 2025), people less often (31% of KubeCon NA 2025's speakers spoke in 2024), so write "spoke last year", never "see you there". `truncated` is true when the limit, the page cap or a list's own cap cut the answer. `note` says why nothing came back. Nothing is stored and nothing is charged. Another workspace's event is `404`. Requires Accounts edit.
 
 - Beta: needs the `accounts` and `event_outbound` feature flag on the workspace.
 - API: `POST /v1/outbound-events/{eventId}/find-last-year`
@@ -21197,7 +21346,7 @@ kenso outbound-events find-last-year --event-id <event-id> --data @body.json
 
 Find people who say they are going: inbox replies and Kenso Search profiles that name the event.
 
-Body (optional): `name` (the event name to look for, up to 100 characters; default the event's name without its year, its city or a part in brackets: `Web Summit Lisbon 2026` is `Web Summit`) and `limit` (1 to 100, default 50). First come inbound campaign replies in this workspace's inbox (not bounces or automated replies) from the year before the event until it ends whose own words (the quoted email cut off) name it as somewhere the writer goes ("see you at Slush", or the name before the event's year) and do not decline it ("I won't be at Slush"), with `source``inbox_mention`, the reply's `contactId`, `threadId` and `repliedAt`. Then Kenso Search profiles whose headline, summary or current title name it (`source``profile_mention`; not the organizer's staff, nor a profile naming only a past edition such as "Speaker at Slush 2019"): those naming it with the event's year first, then those naming it alone, unless the name alone is on more than 2,000 profiles (common words), when only the year matches count (`phrase` says what was looked for). LinkedIn posts are not in Kenso Search. `isLikely` is false: they named the event themselves. Every `row` is an attendee, ready for `POST /v1/outbound-events/{eventId}/attendees/bulk-create` with its source; people already on the event are left out. Nothing is stored and nothing is charged; each profile returned counts against the workspace's `searchBrowseRows` quota. Another workspace's event is `404`. Requires `WriteAccess`.
+Body (optional): `name` (the event name to look for, up to 100 characters; default the event's name without its year, its city or a part in brackets: `Web Summit Lisbon 2026` is `Web Summit`) and `limit` (1 to 100, default 50). First come inbound campaign replies in this workspace's inbox (not bounces or automated replies) from the year before the event until it ends whose own words (the quoted email cut off) name it as somewhere the writer goes ("see you at Slush", or the name before the event's year) and do not decline it ("I won't be at Slush"), with `source``inbox_mention`, the reply's `contactId`, `threadId` and `repliedAt`. Then Kenso Search profiles whose headline, summary or current title name it (`source``profile_mention`; not the organizer's staff, nor a profile naming only a past edition such as "Speaker at Slush 2019"): those naming it with the event's year first, then those naming it alone, unless the name alone is on more than 2,000 profiles (common words), when only the year matches count (`phrase` says what was looked for). LinkedIn posts are not in Kenso Search. `isLikely` is false: they named the event themselves. Every `row` is an attendee, ready for `POST /v1/outbound-events/{eventId}/attendees/bulk-create` with its source; people already on the event are left out. Nothing is stored and nothing is charged; each profile returned counts against the workspace's `searchBrowseRows` quota. Another workspace's event is `404`. Requires Accounts edit.
 
 - Beta: needs the `accounts` and `event_outbound` feature flag on the workspace.
 - API: `POST /v1/outbound-events/{eventId}/find-people-going`
@@ -21222,7 +21371,7 @@ kenso outbound-events find-people-going --event-id <event-id> --data @body.json
 
 Return one outbound event with its counts.
 
-Another workspace's event, or a deleted one, is `404 not_found`. Requires `ReadAccess`.
+Another workspace's event, or a deleted one, is `404 not_found`. Requires Accounts view.
 
 - Beta: needs the `accounts` and `event_outbound` feature flag on the workspace.
 - API: `GET /v1/outbound-events/{eventId}`
@@ -21242,7 +21391,7 @@ kenso outbound-events get --event-id <event-id>
 
 Show the LinkedIn attendee reads of an outbound event: the warning, the limits, your seats and the latest reads.
 
-Returns `enabled` (false while reads are switched off: the warning and limits still show, and no read can start), `warning` (to show before every read), `note` (what a read can and cannot do), `limits`, `event` (attendees counted against the event's limit, attendees left, and `nextReadAt` while the gap between reads runs), `seats` (the LinkedIn seats the caller connected here, each with `canRead`, `allowance`, and when it cannot read, `refusal`: seat_unavailable, seat_paused, event_cooldown, event_limit, seat_reads_today or seat_limit, with `message` and `availableAt`) and `reads` (the latest 5, newest first, each with `status` queued, reading, done or failed, `stopReason`, `message` and its preview `rows`, normalized like bulk-create). Another workspace's event is `404`. Requires `ReadAccess`.
+Returns `enabled` (false while reads are switched off: the warning and limits still show, and no read can start), `warning` (to show before every read), `note` (what a read can and cannot do), `limits`, `event` (attendees counted against the event's limit, attendees left, and `nextReadAt` while the gap between reads runs), `seats` (the LinkedIn seats the caller connected here, each with `canRead`, `allowance`, and when it cannot read, `refusal`: seat_unavailable, seat_paused, event_cooldown, event_limit, seat_reads_today or seat_limit, with `message` and `availableAt`) and `reads` (the latest 5, newest first, each with `status` queued, reading, done or failed, `stopReason`, `message` and its preview `rows`, normalized like bulk-create). Another workspace's event is `404`. Requires Accounts view.
 
 - Beta: needs the `accounts` and `event_outbound` feature flag on the workspace.
 - API: `GET /v1/outbound-events/{eventId}/linkedin-attendees`
@@ -21262,7 +21411,7 @@ kenso outbound-events linkedin-attendees --event-id <event-id>
 
 List outbound events in the current workspace, newest first.
 
-`status`: `upcoming` (the event ends today or later, today being the date in the event's own `timezone`, else UTC), `past` (it ended before today) or `all` (default). `limit` 1-200 (default 50) and `cursor` page by id, newest first. Each event carries its `format`, `attendance` (`going`, `not_going` or null), its `status` (`upcoming`, `live` or `past`, from its dates in its own `timezone`, else UTC) and `counts`: live rows, rows per role, distinct companies and distinct live accounts whose domain a row carries (with account scope `own`, only accounts the caller owns). Requires `ReadAccess`.
+`status`: `upcoming` (the event ends today or later, today being the date in the event's own `timezone`, else UTC), `past` (it ended before today) or `all` (default). `limit` 1-200 (default 50) and `cursor` page by id, newest first. Each event carries its `format`, `attendance` (`going`, `not_going` or null), its `status` (`upcoming`, `live` or `past`, from its dates in its own `timezone`, else UTC) and `counts`: live rows, rows per role, distinct companies and distinct live accounts whose domain a row carries (with account scope `own`, only accounts the caller owns). Requires Accounts view.
 
 - Beta: needs the `accounts` and `event_outbound` feature flag on the workspace.
 - API: `GET /v1/outbound-events` (a list: `--limit`, `--cursor`, `--all`)
@@ -21286,7 +21435,7 @@ kenso outbound-events list --all
 
 Plan an Event touch for every target account attending the event.
 
-Body (optional): `dueAt` (ISO 8601; default 09:00 UTC fourteen days before the event starts, or now when that has passed). Example: `{ "dueAt": "2026-10-21T09:00:00Z" }`. Every live account an attendee matches by company domain gets one touch on the `event` channel titled `Meet at {event name}`, with a body naming the event and the account's people on the list, on the stakeholder of its first listed person (speakers first). The touches wait for a person to approve them in Today; approving one marks it done and sends nothing. Accounts in stage `paused`, `not_a_fit` or `lost`, and touches a Contact limits guardrail refuses, are skipped with the reason. A second call finds the touches it made (`touchesExisting`). Then the event's speakers at those accounts become `event` account signals (`signalsCreated`, new ones only). An event that ended before today in its `timezone` (UTC when it has none), so its status is `past`, is `409 invalid_state`. Another workspace's event is `404`. Requires `WriteAccess`.
+Body (optional): `dueAt` (ISO 8601; default 09:00 UTC fourteen days before the event starts, or now when that has passed). Example: `{ "dueAt": "2026-10-21T09:00:00Z" }`. Every live account an attendee matches by company domain gets one touch on the `event` channel titled `Meet at {event name}`, with a body naming the event and the account's people on the list, on the stakeholder of its first listed person (speakers first). The touches wait for a person to approve them in Today; approving one marks it done and sends nothing. Accounts in stage `paused`, `not_a_fit` or `lost`, and touches a Contact limits guardrail refuses, are skipped with the reason. A second call finds the touches it made (`touchesExisting`). Then the event's speakers at those accounts become `event` account signals (`signalsCreated`, new ones only). An event that ended before today in its `timezone` (UTC when it has none), so its status is `past`, is `409 invalid_state`. Another workspace's event is `404`. Requires Accounts edit.
 
 - Beta: needs the `accounts` and `event_outbound` feature flag on the workspace.
 - API: `POST /v1/outbound-events/{eventId}/plan-touches`
@@ -21310,7 +21459,7 @@ kenso outbound-events plan-touches --event-id <event-id> --data @body.json
 
 Read an event's page and preview the event fields it states, to fill the New event form.
 
-Body: `url` (required: the event's page, an absolute http(s) URL up to 2048 characters, such as a Luma, Eventbrite or Sched link or the conference's own site). Example: `{ "url": "https://lu.ma/revops-mixer" }`. The page is read straight from the site (robots.txt obeyed, never Firecrawl). Each field comes from the first source that states it: the page's schema.org Event (`json_ld`), then Luma's or Eventbrite's own page data (`luma`, `eventbrite`, which add the IANA `timezone`); only when neither names an event does one Claude Haiku call read the page's text (`model`; not charged). Returns 200 with `url` (the page that answered), `platform` (`luma`, `eventbrite`, `sched` or null), `event` (`name`, `startsOn`, `endsOn`, `timezone`, `format`, `city`, `venue` and `url`, the body `outbound-events.create` takes; a field the page does not state is absent), `sources` (per field, where it came from), `missing` (the fields to fill in by hand; no city or venue for a virtual event), `pages` (the site's speaker, sponsor, exhibitor and attendee pages, each with `url`, `role` and `label`, to read with `outbound-events.extract-attendees` once the event exists; a Luma event offers its hosts and featured guests) and `note` (why the page could not be read or named no event, else absent). A page that cannot be read answers 200 with only `event.url` and the note. Nothing is stored. Each call counts on the workspace's `outboundEventLinkPreviews` quota (30 an hour, 200 a day; past it, `429 quota_exceeded` with `Retry-After`). Requires `WriteAccess`.
+Body: `url` (required: the event's page, an absolute http(s) URL up to 2048 characters, such as a Luma, Eventbrite or Sched link or the conference's own site). Example: `{ "url": "https://lu.ma/revops-mixer" }`. The page is read straight from the site (robots.txt obeyed, never Firecrawl). Each field comes from the first source that states it: the page's schema.org Event (`json_ld`), then Luma's or Eventbrite's own page data (`luma`, `eventbrite`, which add the IANA `timezone`); only when neither names an event does one Claude Haiku call read the page's text (`model`; not charged). Returns 200 with `url` (the page that answered), `platform` (`luma`, `eventbrite`, `sched` or null), `event` (`name`, `startsOn`, `endsOn`, `timezone`, `format`, `city`, `venue` and `url`, the body `outbound-events.create` takes; a field the page does not state is absent), `sources` (per field, where it came from), `missing` (the fields to fill in by hand; no city or venue for a virtual event), `pages` (the site's speaker, sponsor, exhibitor and attendee pages, each with `url`, `role` and `label`, to read with `outbound-events.extract-attendees` once the event exists; a Luma event offers its hosts and featured guests) and `note` (why the page could not be read or named no event, else absent). A page that cannot be read answers 200 with only `event.url` and the note. Nothing is stored. Each call counts on the workspace's `outboundEventLinkPreviews` quota (30 an hour, 200 a day; past it, `429 quota_exceeded` with `Retry-After`). Requires Accounts edit.
 
 - Beta: needs the `accounts` and `event_outbound` feature flag on the workspace.
 - API: `POST /v1/outbound-events/preview-from-link`
@@ -21333,7 +21482,7 @@ kenso outbound-events preview-from-link --data @body.json
 
 Start reading a LinkedIn event's attendees through one of your seats.
 
-Body: `url` (required: the event's page, `https://www.linkedin.com/events/...`, or its attendee search link), `linkedInAccountId` (required: a LinkedIn seat the caller connected in this workspace, connected and not paused) and `acceptWarning` (required, true: the caller read the warning from `GET /v1/outbound-events/{eventId}/linkedin-attendees`). Example: `{ "url": "https://www.linkedin.com/events/7212345678901234567/", "linkedInAccountId": 6, "acceptWarning": true }`. Automated reads break LinkedIn's User Agreement (section 8.2) and can get the seat restricted. The seat must already attend the event on LinkedIn; Ken never clicks Attend. Returns `202` with the queued read. Ken.EventProcesor reads the seat's classic people search filtered by the event, 10 people a page, at least 30 seconds apart, within the seat's search budget, and keeps the people as the read's preview: nothing is added to the event until you send the rows you keep to bulk-create. Hard limits: 100 attendees a read; one read of an event every 24 hours and 300 attendees per event; 2 reads and 200 attendees per seat per UTC day. The first rate limit or restriction sign stops the read and pauses event reads on the seat for 72 hours. An empty first page ends the read with `no_attendees`: the seat is not attending, or LinkedIn does not list attendees to it. Errors: `400 validation_failed` for a missing or non-event `url` (`invalid_linkedin_event_url`), a missing seat, a seat that is not yours or not usable (`linkedin_account_unavailable`) or `acceptWarning` not true (`warning_not_accepted`); `409 invalid_state` when reads are switched off (`switched_off`) or a limit refuses the read (the detail code is the limit, with a message saying when it lifts). Another workspace's event is `404`. Requires `WriteAccess`.
+Body: `url` (required: the event's page, `https://www.linkedin.com/events/...`, or its attendee search link), `linkedInAccountId` (required: a LinkedIn seat the caller connected in this workspace, connected and not paused) and `acceptWarning` (required, true: the caller read the warning from `GET /v1/outbound-events/{eventId}/linkedin-attendees`). Example: `{ "url": "https://www.linkedin.com/events/7212345678901234567/", "linkedInAccountId": 6, "acceptWarning": true }`. Automated reads break LinkedIn's User Agreement (section 8.2) and can get the seat restricted. The seat must already attend the event on LinkedIn; Ken never clicks Attend. Returns `202` with the queued read. Ken.EventProcesor reads the seat's classic people search filtered by the event, 10 people a page, at least 30 seconds apart, within the seat's search budget, and keeps the people as the read's preview: nothing is added to the event until you send the rows you keep to bulk-create. Hard limits: 100 attendees a read; one read of an event every 24 hours and 300 attendees per event; 2 reads and 200 attendees per seat per UTC day. The first rate limit or restriction sign stops the read and pauses event reads on the seat for 72 hours. An empty first page ends the read with `no_attendees`: the seat is not attending, or LinkedIn does not list attendees to it. Errors: `400 validation_failed` for a missing or non-event `url` (`invalid_linkedin_event_url`), a missing seat, a seat that is not yours or not usable (`linkedin_account_unavailable`) or `acceptWarning` not true (`warning_not_accepted`); `409 invalid_state` when reads are switched off (`switched_off`) or a limit refuses the read (the detail code is the limit, with a message saying when it lifts). Another workspace's event is `404`. Requires Accounts edit.
 
 - Beta: needs the `accounts` and `event_outbound` feature flag on the workspace.
 - API: `POST /v1/outbound-events/{eventId}/read-linkedin-attendees`
@@ -21360,7 +21509,7 @@ kenso outbound-events read-linkedin-attendees --event-id <event-id> --data @body
 
 Update an outbound event. Absent fields stay unchanged.
 
-`name`, `startsOn` and `format` cannot be null. `endsOn` null resets it to `startsOn`; the end cannot be before the start. `attendance`, `timezone`, `city`, `venue` and `url` accept null to clear. Same limits as create. Example: `{ "endsOn": "2026-09-12", "venue": null }`. Another workspace's event is `404`. Requires `WriteAccess`.
+`name`, `startsOn` and `format` cannot be null. `endsOn` null resets it to `startsOn`; the end cannot be before the start. `attendance`, `timezone`, `city`, `venue` and `url` accept null to clear. Same limits as create. Example: `{ "endsOn": "2026-09-12", "venue": null }`. Another workspace's event is `404`. Requires Accounts edit.
 
 - Beta: needs the `accounts` and `event_outbound` feature flag on the workspace.
 - API: `PATCH /v1/outbound-events/{eventId}`
@@ -21394,7 +21543,7 @@ kenso outbound-events update --event-id <event-id> --data @body.json
 
 Return what people see on one domain: its website mode and each hostname's page status.
 
-`mode` is `unset` (nobody answered: the domain keeps its redirect), `redirect` or `page`. `currentVersionId` is the workspace's live page version, null until the first publish. `hostnames` lists the apex first, then `www`, each with `attachPath` (`worker_route`, `custom_hostname` or null when unsupported), `dnsWriter`, `status` (`detached`, `attaching`, `active`, `detaching` or `failed`), `sslStatus`, `unsupportedReason` and `checkedAt`; empty until Kenso has checked the domain. Requires `ReadAccess` and the `domain_pages` feature.
+`mode` is `unset` (nobody answered: the domain keeps its redirect), `redirect` or `page`. `currentVersionId` is the workspace's live page version, null until the first publish. `hostnames` lists the apex first, then `www`, each with `attachPath` (`worker_route`, `custom_hostname` or null when unsupported), `dnsWriter`, `status` (`detached`, `attaching`, `active`, `detaching` or `failed`), `sslStatus`, `unsupportedReason` and `checkedAt`; empty until Kenso has checked the domain. Requires Delivery view and the `domain_pages` feature.
 
 - Beta: needs the `domain_pages` feature flag on the workspace.
 - API: `GET /v1/domains/{domainId}/website`
@@ -21546,7 +21695,7 @@ kenso outbound-site versions-restore --version-id <version-id>
 
 Return a person's activity timeline: what is planned next and what already happened.
 
-The same rows, parameters and shape as `accounts.activity`, for one person: their touches on the accounts the caller can see, the activity events naming them, and every email and LinkedIn message to or from them (`message_sent` and `message_received` rows with `message`). An account's timeline is the union of its people's. As there, message text comes only to a caller who may view the Inbox. `category` (comma = OR) and `limit` (1-500, default 100) work as there. An unknown or deleted person, another workspace's, or with account scope `own` a person on none of the caller's accounts, is `404 not_found`. A merged person is `404` with detail `person_merged` and `mergedIntoId`. Requires `ReadAccess`.
+The same rows, parameters and shape as `accounts.activity`, for one person: their touches on the accounts the caller can see, the activity events naming them, and every email and LinkedIn message to or from them (`message_sent` and `message_received` rows with `message`). An account's timeline is the union of its people's. As there, message text comes only to a caller who may view the Inbox. `category` (comma = OR) and `limit` (1-500, default 100) work as there. An unknown or deleted person, another workspace's, or with account scope `own` a person on none of the caller's accounts, is `404 not_found`. A merged person is `404` with detail `person_merged` and `mergedIntoId`. Requires Accounts view.
 
 - Beta: needs the `accounts` feature flag on the workspace.
 - API: `GET /v1/people/{personId}/activity`
@@ -21568,7 +21717,7 @@ kenso people activity --person-id <person-id>
 
 Create or match up to 200 people, each optionally onto an account.
 
-Body: `rows` (1-200) of `{ person | personId, accountId | accountDomain, role, priority }`, and `findEmails`. Each row runs in its own transaction: an invalid row writes nothing and comes back `invalid` with an `error`; the rest go on. A role address (support@, info@, no-reply@) is not the person's own email: it matches the person who holds it and never fills onto one. A new person with a LinkedIn URL or Kenso person id is created without it; one with a real first and last name (as on `people.create`) matches the same full name on the row's account, else is created there without it, and without an account is `invalid`, because only the name would find them again. Those rows carry `emailDropped: role_address`. A row with only the address is `invalid`; both invalid cases carry `reason: role_address`. A person with the same email, else LinkedIn URL, else Kenso person id, is `matched` and only their blank fields fill; a row with none of them matches the same full name on the same account; else the person is `created`. A row with only a name needs a live account, else it is `invalid`. `accountDomain` resolves to the live account with that registrable domain (unknown: `account_not_found`; a person with an email, LinkedIn URL or Kenso person id is still written). A batch never creates accounts. Places are user writes (`source: csv`), so role and priority pin; a place a person removed is reported `previously_removed`, never forced. Re-sending the same rows creates nothing. `findEmails: true` queues a find for each created or matched person without an email, and `paused` is true when they wait for credits; if queueing fails, the rows still come back with `emailFind: not_requested`. With account scope `own`, every row must name one of the caller's accounts, and a `personId` must be a person they can see; other rows are `invalid`. A match on none of their accounts that comes back `previously_removed` is left untouched and has no `personId`, and finds go only to people on one of their accounts. Requires `WriteAccess`.
+Body: `rows` (1-200) of `{ person | personId, accountId | accountDomain, role, priority }`, and `findEmails`. Each row runs in its own transaction: an invalid row writes nothing and comes back `invalid` with an `error`; the rest go on. A role address (support@, info@, no-reply@) is not the person's own email: it matches the person who holds it and never fills onto one. A new person with a LinkedIn URL or Kenso person id is created without it; one with a real first and last name (as on `people.create`) matches the same full name on the row's account, else is created there without it, and without an account is `invalid`, because only the name would find them again. Those rows carry `emailDropped: role_address`. A row with only the address is `invalid`; both invalid cases carry `reason: role_address`. A person with the same email, else LinkedIn URL, else Kenso person id, is `matched` and only their blank fields fill; a row with none of them matches the same full name on the same account; else the person is `created`. A row with only a name needs a live account, else it is `invalid`. `accountDomain` resolves to the live account with that registrable domain (unknown: `account_not_found`; a person with an email, LinkedIn URL or Kenso person id is still written). A batch never creates accounts. Places are user writes (`source: csv`), so role and priority pin; a place a person removed is reported `previously_removed`, never forced. Re-sending the same rows creates nothing. `findEmails: true` queues a find for each created or matched person without an email, and `paused` is true when they wait for credits; if queueing fails, the rows still come back with `emailFind: not_requested`. With account scope `own`, every row must name one of the caller's accounts, and a `personId` must be a person they can see; other rows are `invalid`. A match on none of their accounts that comes back `previously_removed` is left untouched and has no `personId`, and finds go only to people on one of their accounts. Requires Accounts edit.
 
 - Beta: needs the `accounts` feature flag on the workspace.
 - API: `POST /v1/people/batch`
@@ -21592,7 +21741,7 @@ kenso people batch --data @body.json
 
 Create one person on no account.
 
-Body: `fullName` (required), `firstName`, `lastName`, `title`, `email`, `linkedinUrl`, `kenPersonId`, `ownerMemberId`, `leadStatus`, `phones` (as on `people.update`). The first and latest source are `manual` for a person and `api` for an API key or agent. Email is trimmed and lower-cased; the LinkedIn URL is normalized like the `linkedinUrl` filter. A live person with the same email or LinkedIn URL is `409 conflict` with detail `person_exists` and their `personId`: use them instead of creating a twin. A name-only match is not a duplicate. A role address (a shared mailbox such as support@, info@, no-reply@) is not a person: a person who already holds it is still `409 person_exists`. Else with a `linkedinUrl`, a `kenPersonId` or a real first and last name (both parts, from `firstName` and `lastName` or `fullName`, neither a role word such as support or team, the address's local part or a label of its domain, nor an initial only; intake also checks the company name it is sent) the person is created without it and the answer carries `emailDropped: role_address`; with none of them it is `422 role_address`. No email find starts. Returns `201` with `accounts: []`. With account scope `own` it is `403``permission_denied` with `scope: all`: add the person to one of your accounts instead. Requires `WriteAccess`.
+Body: `fullName` (required), `firstName`, `lastName`, `title`, `email`, `linkedinUrl`, `kenPersonId`, `ownerMemberId`, `leadStatus`, `phones` (as on `people.update`). The first and latest source are `manual` for a person and `api` for an API key or agent. Email is trimmed and lower-cased; the LinkedIn URL is normalized like the `linkedinUrl` filter. A live person with the same email or LinkedIn URL is `409 conflict` with detail `person_exists` and their `personId`: use them instead of creating a twin. A name-only match is not a duplicate. A role address (a shared mailbox such as support@, info@, no-reply@) is not a person: a person who already holds it is still `409 person_exists`. Else with a `linkedinUrl`, a `kenPersonId` or a real first and last name (both parts, from `firstName` and `lastName` or `fullName`, neither a role word such as support or team, the address's local part or a label of its domain, nor an initial only; intake also checks the company name it is sent) the person is created without it and the answer carries `emailDropped: role_address`; with none of them it is `422 role_address`. No email find starts. Returns `201` with `accounts: []`. With account scope `own` it is `403``permission_denied` with `scope: all`: add the person to one of your accounts instead. Requires Accounts edit.
 
 - Beta: needs the `accounts` feature flag on the workspace.
 - API: `POST /v1/people`
@@ -21623,7 +21772,7 @@ kenso people create --data @body.json
 
 Delete a person who is on no live account.
 
-Soft delete: the person leaves every list, search and find-or-create match, so the same email can be added again as a new person, and Kenso never re-adds them. A person still on an account is `409 conflict` with detail `person_on_accounts` and `accounts` (`accountId`, `name`, `stakeholderId`): remove them from each first. Cancels their active email find. Returns `204`. With account scope `own` it is `403``permission_denied` with `scope: all`. Requires `WriteAccess`.
+Soft delete: the person leaves every list, search and find-or-create match, so the same email can be added again as a new person, and Kenso never re-adds them. A person still on an account is `409 conflict` with detail `person_on_accounts` and `accounts` (`accountId`, `name`, `stakeholderId`): remove them from each first. Cancels their active email find. Returns `204`. With account scope `own` it is `403``permission_denied` with `scope: all`. Requires Accounts edit.
 
 - Beta: needs the `accounts` feature flag on the workspace.
 - API: `DELETE /v1/people/{personId}`
@@ -21643,7 +21792,7 @@ kenso people delete --person-id <person-id>
 
 Remove the photo uploaded for a person.
 
-The person shows their LinkedIn photo again (`photoSource: linkedin`) when Kenso has one, else no photo. Removing a photo the person does not have changes nothing. A merged person is `404``person_merged`. Returns the person. Requires `WriteAccess`.
+The person shows their LinkedIn photo again (`photoSource: linkedin`) when Kenso has one, else no photo. Removing a photo the person does not have changes nothing. A merged person is `404``person_merged`. Returns the person. Requires Accounts edit.
 
 - Beta: needs the `accounts` feature flag on the workspace.
 - API: `DELETE /v1/people/{personId}/photo`
@@ -21663,7 +21812,7 @@ kenso people delete-photo --person-id <person-id>
 
 List the open merge suggestions for this person.
 
-Ken suggests that two people may be one human when lead intake creates a person with the same name on the email domain of a person who has another email, or when the nightly sweep finds the same email apart from dots and plus tags, the same phone, the same name on the same account, or the same name and email domain. Each item carries `id`, `todayItemId` (`merge_suggestion_{id}`), `personId`, `otherPersonId`, `reasons` (`email_local_part`, `phone`, `name_account`, `name_domain`), `foundBy` (`intake` or `sweep`), `createdAt` and `otherPerson` (the person summary), newest first. Merge with `people.merge`, which closes the suggestion; "Not a duplicate" is <c>PATCH /v1/today/items/{todayItemId}</c> with `state: done`, and Ken never suggests that pair again. A merged person is `404``person_merged`. With account scope `own`, suggestions whose other person is on none of the caller's accounts are left out. Behind the `lead_intake` feature (404 when off). Requires `ReadAccess`.
+Ken suggests that two people may be one human when lead intake creates a person with the same name on the email domain of a person who has another email, or when the nightly sweep finds the same email apart from dots and plus tags, the same phone, the same name on the same account, or the same name and email domain. Each item carries `id`, `todayItemId` (`merge_suggestion_{id}`), `personId`, `otherPersonId`, `reasons` (`email_local_part`, `phone`, `name_account`, `name_domain`), `foundBy` (`intake` or `sweep`), `createdAt` and `otherPerson` (the person summary), newest first. Merge with `people.merge`, which closes the suggestion; "Not a duplicate" is <c>PATCH /v1/today/items/{todayItemId}</c> with `state: done`, and Ken never suggests that pair again. A merged person is `404``person_merged`. With account scope `own`, suggestions whose other person is on none of the caller's accounts are left out. Behind the `lead_intake` feature (404 when off). Requires Accounts view.
 
 - Beta: needs the `accounts` and `lead_intake` feature flag on the workspace.
 - API: `GET /v1/people/{personId}/duplicates`
@@ -21683,7 +21832,7 @@ kenso people duplicates --person-id <person-id>
 
 Export the people the filters match as CSV.
 
-Body: the `people.search` filters and `sort`, no paging. Answers a streamed `text/csv` with the header `full_name,first_name,last_name,title,email,linkedin_url,accounts,added_by,added_at`. `accounts` reads `Acme (evaluator, P2); Globex (user)`; `added_by` is Ken, User, API key or Workflow; `added_at` is the UTC date. Cells that start like a formula are neutralized. More than 50,000 rows is `400 validation_failed` with detail `too_many_rows`: narrow the filters. Each export writes an audit-log entry with the filters and the row count. People made from Kenso library list contacts are never exported; the response header `X-Ken-Excluded-Library-People` says how many the filters matched, including 0. With account scope `own`, only people on the caller's accounts, each with only those accounts. Requires `ExportAccess`.
+Body: the `people.search` filters and `sort`, no paging. Answers a streamed `text/csv` with the header `full_name,first_name,last_name,title,email,linkedin_url,accounts,added_by,added_at`. `accounts` reads `Acme (evaluator, P2); Globex (user)`; `added_by` is Ken, User, API key or Workflow; `added_at` is the UTC date. Cells that start like a formula are neutralized. More than 50,000 rows is `400 validation_failed` with detail `too_many_rows`: narrow the filters. Each export writes an audit-log entry with the filters and the row count. People made from Kenso library list contacts are never exported; the response header `X-Ken-Excluded-Library-People` says how many the filters matched, including 0. With account scope `own`, only people on the caller's accounts, each with only those accounts. Requires Accounts view and the `export` permission.
 
 - Beta: needs the `accounts` feature flag on the workspace.
 - API: `POST /v1/people/export`
@@ -21714,7 +21863,7 @@ kenso people export --data @body.json
 
 Queue a find for the email of each person without one.
 
-Body: `personIds` (1-500) and `accountId` (optional: the account whose domain to search). Skips people not in the workspace (`not_found`), with an email (`has_email`) or with a find already running (`active_find`). `estimate.maxCredits` is the most this can cost, 1 credit per queued find, charged only when an email is found. Out of credits, the finds wait as paused and `paused` is true. Returns `202`; the person's `emailFind` shows progress. With account scope `own`, people on none of the caller's accounts are skipped as `not_found`. Requires `WriteAccess`.
+Body: `personIds` (1-500) and `accountId` (optional: the account whose domain to search). Skips people not in the workspace (`not_found`), with an email (`has_email`) or with a find already running (`active_find`). `estimate.maxCredits` is the most this can cost, 1 credit per queued find, charged only when an email is found. Out of credits, the finds wait as paused and `paused` is true. Returns `202`; the person's `emailFind` shows progress. With account scope `own`, people on none of the caller's accounts are skipped as `not_found`. Requires Accounts edit.
 
 - Beta: needs the `accounts` feature flag on the workspace.
 - API: `POST /v1/people/email-finds`
@@ -21737,7 +21886,7 @@ kenso people find-emails --data @body.json
 
 Queue a find for the phone of each person without one.
 
-Body: `personIds` (1-500). Returns `202` with how many people were `queued`, `alreadyHavePhone` (a valid phone, nothing queued), `alreadyQueued` (a find already queued, running or paused) and `skipped` (not in the workspace), and `personIds` naming the people of each. A find is charged only when a number is found, at the provider's cost; out of credits, the finds wait as paused. The person's `phoneFind` shows progress, and a found number joins `phones`. With account scope `own`, people on none of the caller's accounts are skipped. Behind the `calls` feature (404 when off). Requires `WriteAccess`.
+Body: `personIds` (1-500). Returns `202` with how many people were `queued`, `alreadyHavePhone` (a valid phone, nothing queued), `alreadyQueued` (a find already queued, running or paused) and `skipped` (not in the workspace), and `personIds` naming the people of each. A find is charged only when a number is found, at the provider's cost; out of credits, the finds wait as paused. The person's `phoneFind` shows progress, and a found number joins `phones`. With account scope `own`, people on none of the caller's accounts are skipped. Behind the `calls` feature (404 when off). Requires Accounts edit.
 
 - Beta: needs the `accounts` and `calls` feature flag on the workspace.
 - API: `POST /v1/people/phone-finds`
@@ -21759,7 +21908,7 @@ kenso people find-phones --data @body.json
 
 Return one person with the accounts they are a stakeholder on.
 
-Each account carries the person's `stakeholderId`, `role`, `priority` and `coverage` there, highest priority first. `emailFind` is the newest find of their email. `tagIds` are the tags they carry; a champion carries the Champion tag. A merged person is `404` with detail `person_merged` and `mergedIntoId`, the person to read instead. Requires `ReadAccess`.
+Each account carries the person's `stakeholderId`, `role`, `priority` and `coverage` there, highest priority first. `emailFind` is the newest find of their email. `tagIds` are the tags they carry; a champion carries the Champion tag. A merged person is `404` with detail `person_merged` and `mergedIntoId`, the person to read instead. Requires Accounts view.
 
 - Beta: needs the `accounts` feature flag on the workspace.
 - API: `GET /v1/people/{personId}`
@@ -21779,7 +21928,7 @@ kenso people get --person-id <person-id>
 
 Return a person's research: the latest run's status and the latest finished research.
 
-Query (optional): `mode`, `light` or `heavy`, to read only that mode's runs (a newer Light run otherwise shows instead of the Heavy research); without it, runs of either mode. `status` is the latest run's: `none` (never researched), `queued`, `running`, `succeeded`, `no_data` (Ken found no data on the person, so nothing was written) or `failed` with `errorCode` (`person_deleted`, `source_unavailable`, `model_failed`, `invalid_output`, `timeout`). `mode` is the latest run's (`light` or `heavy`), `requestedAt` when it was opened. The rest comes from the latest succeeded run, so research stays visible while a new run is in progress or after one found nothing: `researchedMode`, `researchedAt`, `summary`, `worthKnowing` (points worth knowing before outreach, each `{text, sourceIds}`), `careerMoves` (newest first, `{text, date, companyName, title, sourceIds}`, date `YYYY`, `YYYY-MM` or `YYYY-MM-DD`) and `sources` (`{id, kind, title, url, date}`, kind `linkedin_profile`, `work_history`, `campaign_contact` or `linkedin_post`, and on Heavy `web`, `x`, `instagram`, `facebook`, `news` or `podcast`). Heavy research adds `webFindings` (`{text, kind, url, sourceIds}`, kind and url of the first source), `firecrawlCredits` and, when the web part is missing, `webNote` (for example "Web research unavailable: Firecrawl ..."). Every finding cites the ids of the sources it came from. An unknown or deleted person, another workspace's, or with account scope `own` a person on none of the caller's accounts, is `404 not_found`. A merged person is `404` with detail `person_merged` and `mergedIntoId`. Requires `ReadAccess` and the `accounts_research` feature.
+Query (optional): `mode`, `light` or `heavy`, to read only that mode's runs (a newer Light run otherwise shows instead of the Heavy research); without it, runs of either mode. `status` is the latest run's: `none` (never researched), `queued`, `running`, `succeeded`, `no_data` (Ken found no data on the person, so nothing was written) or `failed` with `errorCode` (`person_deleted`, `source_unavailable`, `model_failed`, `invalid_output`, `timeout`). `mode` is the latest run's (`light` or `heavy`), `requestedAt` when it was opened. The rest comes from the latest succeeded run, so research stays visible while a new run is in progress or after one found nothing: `researchedMode`, `researchedAt`, `summary`, `worthKnowing` (points worth knowing before outreach, each `{text, sourceIds}`), `careerMoves` (newest first, `{text, date, companyName, title, sourceIds}`, date `YYYY`, `YYYY-MM` or `YYYY-MM-DD`) and `sources` (`{id, kind, title, url, date}`, kind `linkedin_profile`, `work_history`, `campaign_contact` or `linkedin_post`, and on Heavy `web`, `x`, `instagram`, `facebook`, `news` or `podcast`). Heavy research adds `webFindings` (`{text, kind, url, sourceIds}`, kind and url of the first source), `firecrawlCredits` and, when the web part is missing, `webNote` (for example "Web research unavailable: Firecrawl ..."). Every finding cites the ids of the sources it came from. An unknown or deleted person, another workspace's, or with account scope `own` a person on none of the caller's accounts, is `404 not_found`. A merged person is `404` with detail `person_merged` and `mergedIntoId`. Requires Accounts view and the `accounts_research` feature.
 
 - Beta: needs the `accounts` and `accounts_research` feature flag on the workspace.
 - API: `GET /v1/people/{personId}/research`
@@ -21823,7 +21972,7 @@ kenso people import --file people.jsonl --dry-run
 
 Take in one person from your own source: match, place on their company's account, assign an owner.
 
-Body: `email`, `linkedinUrl`, or a name (`fullName`, or `firstName` and `lastName`) with a business `companyDomain` (else `400``identity_required`); `title`, `companyName`, `phone` (a bad number is `400``invalid_phone`), `source` (`api` default, `workflow` or `manual`; any other is `400``invalid_source`), `sourceDetail`, `ownerMemberId` (a member, else `400``invalid_member`), `leadStatus` (default `new`), `customFields` (person custom field keys; unknown keys are ignored) and `createAccount`. A person with the same email, else LinkedIn URL, else the same name on the domain and no email, is matched: only their blank fields fill, pinned fields never change, the phone is added and the latest source updates. Else the person is created with lead status new and a score. A business domain with no account gets one (stage researching, source inbound, no research credits) unless `createAccount` is false or the workspace's intake settings say no; the person joins that account. Owner: the person's, else the account's, the CRM contact's, `ownerMemberId`, the workspace default, then the round robin. A new person adds a new_lead row to the owner's Today and notifies them. Returns `person`, `created`, `matchedBy` (email, linkedin_url, name_domain or none), `accountId`, `accountCreated` and `suggestedDuplicateOfPersonId` (same name on the domain with another email). A role address (support@, info@, no-reply@) matches the person who holds it but never fills onto one. With a LinkedIn URL or a real first and last name (as on `people.create`) the person comes in without it, matched later by that name on the address's domain, and the answer carries `emailDropped: role_address`; with neither and no match it is `422 role_address` and nothing is written. 600 calls an hour per workspace; the next is `429` with `Retry-After`. With account scope `own` it is `403``permission_denied` with `scope: all`. Behind the `lead_intake` feature (404 when off). Requires `WriteAccess`.
+Body: `email`, `linkedinUrl`, or a name (`fullName`, or `firstName` and `lastName`) with a business `companyDomain` (else `400``identity_required`); `title`, `companyName`, `phone` (a bad number is `400``invalid_phone`), `source` (`api` default, `workflow` or `manual`; any other is `400``invalid_source`), `sourceDetail`, `ownerMemberId` (a member, else `400``invalid_member`), `leadStatus` (default `new`), `customFields` (person custom field keys; unknown keys are ignored) and `createAccount`. A person with the same email, else LinkedIn URL, else the same name on the domain and no email, is matched: only their blank fields fill, pinned fields never change, the phone is added and the latest source updates. Else the person is created with lead status new and a score. A business domain with no account gets one (stage researching, source inbound, no research credits) unless `createAccount` is false or the workspace's intake settings say no; the person joins that account. Owner: the person's, else the account's, the CRM contact's, `ownerMemberId`, the workspace default, then the round robin. A new person adds a new_lead row to the owner's Today and notifies them. Returns `person`, `created`, `matchedBy` (email, linkedin_url, name_domain or none), `accountId`, `accountCreated` and `suggestedDuplicateOfPersonId` (same name on the domain with another email). A role address (support@, info@, no-reply@) matches the person who holds it but never fills onto one. With a LinkedIn URL or a real first and last name (as on `people.create`) the person comes in without it, matched later by that name on the address's domain, and the answer carries `emailDropped: role_address`; with neither and no match it is `422 role_address` and nothing is written. 600 calls an hour per workspace; the next is `429` with `Retry-After`. With account scope `own` it is `403``permission_denied` with `scope: all`. Behind the `lead_intake` feature (404 when off). Requires Accounts edit.
 
 - Beta: needs the `accounts` and `lead_intake` feature flag on the workspace.
 - API: `POST /v1/people/intake`
@@ -21862,7 +22011,7 @@ kenso people intake --data @body.json
 
 List people in the current workspace.
 
-Filters: `email`, `linkedinUrl` (any profile URL shape; normalized), `q` (name or email contains), `ownerMemberId`, `leadStatus` (comma list: new, working, qualified, disqualified, nurture), `source` (comma list on the latest source), `tagIds` (comma list of tag ids: people carrying any of them; `GET /v1/tags?systemKey=champion` gives the Champion tag), `behaviorTags` (repeatable: people whose behavior tags include any, for example `behaviorTags=cold_responder&behaviorTags=prefers_linkedin`; needs the `behavior_signals` feature; `email_confirmed`, `email_dead_end` and `left_company` cannot be filtered). `sort`: `-createdAt` (default), `name` (A-Z, unnamed last), `-score` (highest first, unscored last), `-latestSourceAt` (newest first, none last). Each person carries `ownerMemberId`, `leadStatus`, `score`, `phones`, `phone` (the first valid one), `firstSource`, `latestSource` and `tagIds`. Requires `ReadAccess`.
+Filters: `email`, `linkedinUrl` (any profile URL shape; normalized), `q` (name or email contains), `ownerMemberId`, `leadStatus` (comma list: new, working, qualified, disqualified, nurture), `source` (comma list on the latest source), `tagIds` (comma list of tag ids: people carrying any of them; `GET /v1/tags?systemKey=champion` gives the Champion tag), `behaviorTags` (repeatable: people whose behavior tags include any, for example `behaviorTags=cold_responder&behaviorTags=prefers_linkedin`; needs the `behavior_signals` feature; `email_confirmed`, `email_dead_end` and `left_company` cannot be filtered). `sort`: `-createdAt` (default), `name` (A-Z, unnamed last), `-score` (highest first, unscored last), `-latestSourceAt` (newest first, none last). Each person carries `ownerMemberId`, `leadStatus`, `score`, `phones`, `phone` (the first valid one), `firstSource`, `latestSource` and `tagIds`. Requires Accounts view.
 
 - Beta: needs the `accounts` feature flag on the workspace.
 - API: `GET /v1/people` (a list: `--limit`, `--cursor`, `--all`)
@@ -21894,7 +22043,7 @@ kenso people list --all
 
 Merge this person into another person.
 
-Body: `intoPersonId`, the person to keep. In one transaction the kept person keeps every value it has and takes this person's values for its blank fields; this person's account places move to it (on a shared account the two places combine, with touches, reports and seats re-pointed); removal history moves too; this person's active email find is cancelled. This person then reads as `404``person_merged` with `mergedIntoId`. Merging into the same, a deleted or a merged person is `400 validation_failed`. Returns the kept person. With account scope `own` it is `403``permission_denied` with `scope: all`. Requires `WriteAccess`.
+Body: `intoPersonId`, the person to keep. In one transaction the kept person keeps every value it has and takes this person's values for its blank fields; this person's account places move to it (on a shared account the two places combine, with touches, reports and seats re-pointed); removal history moves too; this person's active email find is cancelled. This person then reads as `404``person_merged` with `mergedIntoId`. Merging into the same, a deleted or a merged person is `400 validation_failed`. Returns the kept person. With account scope `own` it is `403``permission_denied` with `scope: all`. Requires Accounts edit.
 
 - Beta: needs the `accounts` feature flag on the workspace.
 - API: `POST /v1/people/{personId}/merge`
@@ -21918,7 +22067,7 @@ kenso people merge --person-id <person-id> --data @body.json
 
 Upload or replace a person's photo.
 
-Multipart field `file`: a non-empty PNG, JPEG or WebP under 10 MB, checked by type, extension and content (else `400``validation_failed`). Kenso stores it and serves it from `/media`; it shows as `photoUrl` with `photoSource: upload`, ahead of the person's LinkedIn photo, and replaces an earlier upload. A merged person is `404``person_merged`. Returns the person. Requires `WriteAccess`.
+Multipart field `file`: a non-empty PNG, JPEG or WebP under 10 MB, checked by type, extension and content (else `400``validation_failed`). Kenso stores it and serves it from `/media`; it shows as `photoUrl` with `photoSource: upload`, ahead of the person's LinkedIn photo, and replaces an earlier upload. A merged person is `404``person_merged`. Returns the person. Requires Accounts edit.
 
 - Beta: needs the `accounts` feature flag on the workspace.
 - API: `PUT /v1/people/{personId}/photo`
@@ -21965,7 +22114,7 @@ kenso people research --person-id <person-id> --data @body.json
 
 Search people in the current workspace with filters.
 
-Body, every field optional: `q` (full name, email or title contains), `accountIds` (on any of these accounts, up to 100), `onAccount` (`any` default, `none` on no live account, `some` on at least one), `roles` (holds one of these roles on some live account), `hasEmail`, `addedBy` (who created the person: user, agent, api_key, system, workflow), `ownerMemberId`, `leadStatus` (list), `source` (list, on the latest source), `tagIds` (carries any of these tags, up to 100), `sort` (`-createdAt` default, `name` A-Z with unnamed people last, `-score` highest first with unscored last, or `-latestSourceAt` newest first with none last), `limit` (1-200, default 50), `cursor`, `includeTotal`. Lists OR within themselves; filters AND together. Each row embeds its live accounts (with `stakeholderId`, `role`, `priority`, `coverage`), `emailFind` and `tagIds`. Deleted and merged people never appear. With account scope `own`, only people on the caller's accounts, each with only those accounts. Requires `ReadAccess`.
+Body, every field optional: `q` (full name, email or title contains), `accountIds` (on any of these accounts, up to 100), `onAccount` (`any` default, `none` on no live account, `some` on at least one), `roles` (holds one of these roles on some live account), `hasEmail`, `addedBy` (who created the person: user, agent, api_key, system, workflow), `ownerMemberId`, `leadStatus` (list), `source` (list, on the latest source), `tagIds` (carries any of these tags, up to 100), `sort` (`-createdAt` default, `name` A-Z with unnamed people last, `-score` highest first with unscored last, or `-latestSourceAt` newest first with none last), `limit` (1-200, default 50), `cursor`, `includeTotal`. Lists OR within themselves; filters AND together. Each row embeds its live accounts (with `stakeholderId`, `role`, `priority`, `coverage`), `emailFind` and `tagIds`. Deleted and merged people never appear. With account scope `own`, only people on the caller's accounts, each with only those accounts. Requires Accounts view.
 
 - Beta: needs the `accounts` feature flag on the workspace.
 - API: `POST /v1/people/search`
@@ -22000,7 +22149,7 @@ kenso people search --data @body.json
 
 Update person fields. Absent fields stay unchanged; null clears.
 
-Fields: fullName, firstName, lastName, title, email, linkedinUrl, kenPersonId, `ownerMemberId` (a workspace member, else `400``invalid_member`), `leadStatus` (new, working, qualified, disqualified, nurture), `phones` (`[{ number, kind }]`, up to 20; replaces the list, so send every number to keep; a number the person has keeps when it was added; a number marked invalid (a wrong number) stays even when left out, after the numbers sent; a bad number is `400``invalid_phone`; to add or remove one number use `PATCH /v1/people/{personId}/phones`), `phoneOptOut` (true: the person asked not to be called; it records now and the caller as `phoneOptOutAt`, keeping an earlier opt-out's time; false clears it; Kenso's dialer never calls an opted-out person). `score` and the sources are read-only. An owner or status change writes `person.owner_changed` or `person.lead_status_changed` with before and after; each new number writes `person.phone_added`. An email or LinkedIn URL another person holds is `409 conflict` (`email_taken`, `linkedin_url_taken`) with that `personId`, which is left out when account scope `own` hides that person. A person keeps at least one of fullName, email, linkedinUrl. Pinned fields need `overwritePinned: true`. A merged person is `404``person_merged`. Requires `WriteAccess`.
+Fields: fullName, firstName, lastName, title, email, linkedinUrl, kenPersonId, `ownerMemberId` (a workspace member, else `400``invalid_member`), `leadStatus` (new, working, qualified, disqualified, nurture), `phones` (`[{ number, kind }]`, up to 20; replaces the list, so send every number to keep; a number the person has keeps when it was added; a number marked invalid (a wrong number) stays even when left out, after the numbers sent; a bad number is `400``invalid_phone`; to add or remove one number use `PATCH /v1/people/{personId}/phones`), `phoneOptOut` (true: the person asked not to be called; it records now and the caller as `phoneOptOutAt`, keeping an earlier opt-out's time; false clears it; Kenso's dialer never calls an opted-out person). `score` and the sources are read-only. An owner or status change writes `person.owner_changed` or `person.lead_status_changed` with before and after; each new number writes `person.phone_added`. An email or LinkedIn URL another person holds is `409 conflict` (`email_taken`, `linkedin_url_taken`) with that `personId`, which is left out when account scope `own` hides that person. A person keeps at least one of fullName, email, linkedinUrl. Pinned fields need `overwritePinned: true`. A merged person is `404``person_merged`. Requires Accounts edit.
 
 - Beta: needs the `accounts` feature flag on the workspace.
 - API: `PATCH /v1/people/{personId}`
@@ -22040,7 +22189,7 @@ kenso people update --person-id <person-id> --data @body.json
 
 Add, remove or reorder a person's phones without resending the list.
 
-Body, at least one of: `add` (`[{ number, kind }]`, up to 20; a new number goes after the person's phones, recorded as added now by `manual` for a person or `api` for an API key or agent, and writes `person.phone_added`; a number the person has keeps its entry and takes the `kind` sent, and a number marked invalid (a wrong number) stays marked; `400``out_of_range` when the person would end up with more than 20 phones, wrong numbers included), `remove` (up to 20 numbers; a valid number is removed; a number marked invalid stays, so a known wrong number is never added back; a number the person does not have is ignored), `primary` (a valid number the person has after `add` and `remove`; it moves first and becomes `phone`, else `400``unknown_phone`). Applied as remove, then add, then primary, to the phones stored when the write runs, so two edits at once both land. Numbers are normalized like `people.update` phones; a bad one is `400``invalid_phone` naming it. Phones a person set need `overwritePinned: true` from an API key or agent. A merged person is `404``person_merged`. Returns the person, like `people.update`. Requires `WriteAccess`.
+Body, at least one of: `add` (`[{ number, kind }]`, up to 20; a new number goes after the person's phones, recorded as added now by `manual` for a person or `api` for an API key or agent, and writes `person.phone_added`; a number the person has keeps its entry and takes the `kind` sent, and a number marked invalid (a wrong number) stays marked; `400``out_of_range` when the person would end up with more than 20 phones, wrong numbers included), `remove` (up to 20 numbers; a valid number is removed; a number marked invalid stays, so a known wrong number is never added back; a number the person does not have is ignored), `primary` (a valid number the person has after `add` and `remove`; it moves first and becomes `phone`, else `400``unknown_phone`). Applied as remove, then add, then primary, to the phones stored when the write runs, so two edits at once both land. Numbers are normalized like `people.update` phones; a bad one is `400``invalid_phone` naming it. Phones a person set need `overwritePinned: true` from an API key or agent. A merged person is `404``person_merged`. Returns the person, like `people.update`. Requires Accounts edit.
 
 - Beta: needs the `accounts` feature flag on the workspace.
 - API: `PATCH /v1/people/{personId}/phones`
@@ -22359,7 +22508,7 @@ kenso permission-templates update --template-id <template-id> --data @body.json
 
 Return a person's behavior signals.
 
-The same body as `contact-behavior.get` for the person's LinkedIn profile (else their email): `workspace` and, with the `behavior_signals_network` feature, `network` with `workspaces` (other workspaces only). Address tags (`email_confirmed`, `email_dead_end`, `left_company`) are never on a person: read them on a contact. Absent means null. An unknown or deleted person, another workspace's, or with account scope `own` a person on none of the caller's accounts, is `404 not_found`; a merged person is `404` with detail `person_merged` and `mergedIntoId`. Requires `ReadAccess` and the `accounts` and `behavior_signals` features.
+The same body as `contact-behavior.get` for the person's LinkedIn profile (else their email): `workspace` and, with the `behavior_signals_network` feature, `network` with `workspaces` (other workspaces only). Address tags (`email_confirmed`, `email_dead_end`, `left_company`) are never on a person: read them on a contact. Absent means null. An unknown or deleted person, another workspace's, or with account scope `own` a person on none of the caller's accounts, is `404 not_found`; a merged person is `404` with detail `person_merged` and `mergedIntoId`. Requires Accounts view and the `accounts` and `behavior_signals` features.
 
 - Beta: needs the `accounts` and `behavior_signals` feature flag on the workspace.
 - API: `GET /v1/people/{personId}/behavior`
@@ -22381,7 +22530,7 @@ kenso person-behavior get --person-id <person-id>
 
 Start an inbox placement test for a campaign.
 
-Requires Delivery edit. Exactly one of `domainId` or `inboxId` is required unless `randomScope` is true. Example: `{ "campaignId": 812, "inboxId": 44 }`. Kenso pays for each test, so each call counts against a per-workspace budget: `placementTestCreates` (5 a minute, 20 a day, 50 in 30 days; a Free plan gets 1, 2 and 5), over it `429 rate_limited` with `Retry-After`. Where `placement_tests_public` is on, the budget is `placementTestCreatesPublic` (2 a day, 8 in 30 days, on every plan), over it `429 quota_exceeded` naming the limit, with `Retry-After`. Super admins are exempt. `openPixel: true` sends the copy with the campaign open pixel on `link.` or `unsub.` of the test's sending domain, whichever serves it; `openPixelHost` names the host used. No serving host, plain-text copy, or a test with the other pixel setting already running for the campaign and domain is `409 invalid_state`.
+Requires Delivery edit. Exactly one of `domainId` or `inboxId` is required unless `randomScope` is true. Example: `{ "campaignId": 812, "inboxId": 44 }`. Kenso pays for each test, so each call counts against a per-workspace budget: `placementTestCreates` (5 a minute, 20 a day, 50 in 30 days; a Free plan gets 1, 2 and 5), over it `429 rate_limited` with `Retry-After`. Where `placement_tests_public` is on, the budget is `placementTestCreatesPublic` (2 a day, 8 in 30 days, on every plan), over it `429 quota_exceeded` naming the limit, with `Retry-After`. Kenso staff are exempt. `openPixel: true` sends the copy with the campaign open pixel on `link.` or `unsub.` of the test's sending domain, whichever serves it; `openPixelHost` names the host used. No serving host, plain-text copy, or a test with the other pixel setting already running for the campaign and domain is `409 invalid_state`.
 
 - API: `POST /v1/placement-tests`
 - Generated from the API contract
@@ -22418,7 +22567,7 @@ kenso placement-tests create --data @body.json
 
 Return one placement test with its full results.
 
-Adds what the list leaves out: `type`, `startedAt`, `sentCount`, `senderInboxIds`, the `subject` and `body` sent, `counts`, per `providers`, per `senders`, per `seeds` (masked addresses), InboxKit `errors`, and up to 10 `earlierTests` of the test's own campaign and domain (whichever are set) for a trend; a shared weekly test trends with the campaign that owns it, and an inbox test without a domain has none. Result fields are omitted until the test completes. Rates are fractions from 0 to 1. Requires `ReadAccess`. A test outside the workspace is `not_found`.
+Adds what the list leaves out: `type`, `startedAt`, `sentCount`, `senderInboxIds`, the `subject` and `body` sent, `counts`, per `providers`, per `senders`, per `seeds` (masked addresses), InboxKit `errors`, and up to 10 `earlierTests` of the test's own campaign and domain (whichever are set) for a trend; a shared weekly test trends with the campaign that owns it, and an inbox test without a domain has none. Result fields are omitted until the test completes. Rates are fractions from 0 to 1. Requires Delivery view. A test outside the workspace is `not_found`.
 
 - API: `GET /v1/placement-tests/{placementTestId}`
 - Generated from the API contract
@@ -22437,7 +22586,7 @@ kenso placement-tests get --placement-test-id <placement-test-id>
 
 List placement tests for a campaign, newest first.
 
-Requires `campaignId`. Default sort is `-createdAt`. Rates are fractions from 0 to 1. Requires `ReadAccess`. A campaign outside the workspace is `not_found`.
+Requires `campaignId`. Default sort is `-createdAt`. Rates are fractions from 0 to 1. Requires Delivery view. A campaign outside the workspace is `not_found`.
 
 - API: `GET /v1/placement-tests` (a list: `--limit`, `--cursor`, `--all`)
 - Generated from the API contract
@@ -22480,7 +22629,7 @@ kenso portal-sessions create
 
 Create a prompt template in the current workspace.
 
-Returns `201` and `Location`. `scope=workspace` is owned by the workspace header. Qualification prompts keep `IQualificationWorkflowSyncService` in sync. A campaign or model configuration outside the workspace is `not_found` before the write. Requires `WriteAccess`.
+Returns `201` and `Location`. `scope=workspace` is owned by the workspace header. Qualification prompts keep `IQualificationWorkflowSyncService` in sync. A campaign or model configuration outside the workspace is `not_found` before the write. Requires Campaigns edit.
 
 - API: `POST /v1/prompt-templates`
 - Generated from the API contract
@@ -22507,7 +22656,7 @@ kenso prompt-templates create --data @body.json
 
 Delete a prompt template in the current workspace.
 
-Returns `204`. A template outside the workspace is `not_found` and is not deleted. Requires `WriteAccess`.
+Returns `204`. A template outside the workspace is `not_found` and is not deleted. Requires Campaigns edit.
 
 - API: `DELETE /v1/prompt-templates/{templateId}`
 - Generated from the API contract
@@ -22526,7 +22675,7 @@ kenso prompt-templates delete --template-id <template-id>
 
 Return one prompt template visible in the current workspace.
 
-A missing or cross-workspace id is `not_found`. Requires `ReadAccess`.
+A missing or cross-workspace id is `not_found`. Requires Campaigns view.
 
 - API: `GET /v1/prompt-templates/{templateId}`
 - Generated from the API contract
@@ -22545,7 +22694,7 @@ kenso prompt-templates get --template-id <template-id>
 
 List prompt templates visible in the current workspace.
 
-Ordered by id. Optional `flow` and `scope` narrow the page. `q` matches the name. Workspace-scoped rows are limited to `X-Ken-Workspace-Id`. Requires `ReadAccess`.
+Ordered by id. Optional `flow` and `scope` narrow the page. `q` matches the name. Workspace-scoped rows are limited to `X-Ken-Workspace-Id`. Requires Campaigns view.
 
 - API: `GET /v1/prompt-templates` (a list: `--limit`, `--cursor`, `--all`)
 - Generated from the API contract
@@ -22570,7 +22719,7 @@ kenso prompt-templates list --all
 
 Update a prompt template in the current workspace.
 
-Absent fields stay unchanged. `null` clears `description` and `modelConfigurationId`. A template outside the workspace is `not_found` before the write. Qualification prompt edits keep `IQualificationWorkflowSyncService` in sync. Requires `WriteAccess`.
+Absent fields stay unchanged. `null` clears `description` and `modelConfigurationId`. A template outside the workspace is `not_found` before the write. Qualification prompt edits keep `IQualificationWorkflowSyncService` in sync. Requires Campaigns edit.
 
 - API: `PATCH /v1/prompt-templates/{templateId}`
 - Generated from the API contract
@@ -22594,7 +22743,7 @@ kenso prompt-templates update --template-id <template-id> --data @body.json
 
 Return one prompt version for a segment in the current workspace.
 
-A missing segment or version is `not_found`. Requires `ReadAccess`.
+A missing segment or version is `not_found`. Requires Campaigns view.
 
 - API: `GET /v1/segments/{segmentId}/prompt-versions/{versionId}`
 - Generated from the API contract
@@ -22614,7 +22763,7 @@ kenso prompt-versions get --segment-id <segment-id> --version-id <version-id>
 
 List prompt versions for a segment in the current workspace.
 
-A segment outside `X-Ken-Workspace-Id` is `not_found` before versions are read. Requires `ReadAccess`.
+A segment outside `X-Ken-Workspace-Id` is `not_found` before versions are read. Requires Campaigns view.
 
 - API: `GET /v1/segments/{segmentId}/prompt-versions` (a list: `--limit`, `--cursor`, `--all`)
 - Generated from the API contract
@@ -22637,7 +22786,7 @@ kenso prompt-versions list --segment-id <segment-id> --all
 
 Restore a prompt version for a segment in the current workspace.
 
-Qualification and scoring workflow sync stay inside the existing revert command. A segment outside the workspace is `not_found` before the write. `dryRun` returns what the restore would clear and does not write. A restore that would clear campaign AI output returns `409 conflict` with `error.impact` until `confirm` is true. The body is optional. Requires `WriteAccess`.
+Qualification and scoring workflow sync stay inside the existing revert command. A segment outside the workspace is `not_found` before the write. `dryRun` returns what the restore would clear and does not write. A restore that would clear campaign AI output returns `409 conflict` with `error.impact` until `confirm` is true. The body is optional. Requires Campaigns edit.
 
 - API: `POST /v1/segments/{segmentId}/prompt-versions/{versionId}/restore`
 - Generated from the API contract
@@ -22666,7 +22815,7 @@ kenso prompt-versions restore --segment-id <segment-id> --version-id <version-id
 
 Create a prompt in the current workspace.
 
-Returns `201` and `Location`. `campaignId` or `segmentId` is required so the prompt stays in the workspace. `confirm=true` is required when the write would refresh cached AI results. Requires `WriteAccess`.
+Returns `201` and `Location`. `campaignId` or `segmentId` is required so the prompt stays in the workspace. `confirm=true` is required when the write would refresh cached AI results. Requires Campaigns edit.
 
 - API: `POST /v1/prompts`
 - Generated from the API contract
@@ -22707,7 +22856,7 @@ kenso prompts create --confirm --data @body.json
 
 Delete a prompt.
 
-Returns `204`. `confirm=true` is required when deletion would refresh cached AI results. Requires `WriteAccess`.
+Returns `204`. `confirm=true` is required when deletion would refresh cached AI results. Requires Campaigns edit.
 
 - API: `DELETE /v1/prompts/{promptId}`
 - Generated from the API contract
@@ -22728,7 +22877,7 @@ kenso prompts delete --prompt-id <prompt-id> --confirm
 
 Return one prompt in the current workspace.
 
-A missing or cross-workspace id is `not_found`. Requires `ReadAccess`.
+A missing or cross-workspace id is `not_found`. Requires Campaigns view.
 
 - API: `GET /v1/prompts/{promptId}`
 - Generated from the API contract
@@ -22771,7 +22920,7 @@ kenso prompts link-knowledge-prompt --prompt-id <prompt-id> --data @body.json
 
 List prompts in the current workspace.
 
-Ordered by id. Optional `campaignId`, `segmentId`, and `flow` narrow the page. `q` matches the name. Requires `ReadAccess`.
+Ordered by id. Optional `campaignId`, `segmentId`, and `flow` narrow the page. `q` matches the name. Requires Campaigns view.
 
 - API: `GET /v1/prompts` (a list: `--limit`, `--cursor`, `--all`)
 - Generated from the API contract
@@ -22797,7 +22946,7 @@ kenso prompts list --all
 
 Run a prompt test against live model calls.
 
-Samples contacts in the campaign and runs the requested flow. This spends model usage. A missing campaign is `not_found`. Requires `PromptTestAccess`.
+Samples contacts in the campaign and runs the requested flow. This spends model usage. A missing campaign is `not_found`. Requires Campaigns edit and the `ask` permission.
 
 - API: `POST /v1/prompts/test`
 - Generated from the API contract
@@ -22842,7 +22991,7 @@ kenso prompts unlink-knowledge-prompt --prompt-id <prompt-id>
 
 Update a prompt.
 
-Absent fields stay unchanged. JSON null clears a text field or `promptTemplateId`. `segmentId` cannot change on this route, and `campaignId` cannot be cleared on a prompt without a segment (`400`: it would belong to no workspace). `confirm=true` is required when the write would refresh cached AI results. Requires `WriteAccess`.
+Absent fields stay unchanged. JSON null clears a text field or `promptTemplateId`. `segmentId` cannot change on this route, and `campaignId` cannot be cleared on a prompt without a segment (`400`: it would belong to no workspace). `confirm=true` is required when the write would refresh cached AI results. Requires Campaigns edit.
 
 - API: `PATCH /v1/prompts/{promptId}`
 - Generated from the API contract
@@ -22907,7 +23056,7 @@ kenso provider-keys delete --provider <provider>
 
 List every provider and the workspace's key status.
 
-Returns every catalogue provider, live and coming soon, in one list. This is a catalogue, not a cursor API: `pagination.nextCursor` is null and `pagination.hasMore` is false. Never returns a key or any prefix of one; `keySuffix` is the last four characters. AI providers also carry `inFlightAiBatchCount`, the workspace's AI batches still running on that key, and a `blitz` or `moltsets` key carries `quota`. `openai` is left out while `sign_in_with_chatgpt` is off for the caller, unless the workspace already saved an OpenAI key. That saved key can be changed, verified and deleted, but not replaced: `PUT openai` answers 409 even though the entry may read `live`. Any workspace member may call it. Requires `ReadAccess`.
+Returns every catalogue provider, live and coming soon, in one list. This is a catalogue, not a cursor API: `pagination.nextCursor` is null and `pagination.hasMore` is false. Never returns a key or any prefix of one; `keySuffix` is the last four characters. AI providers also carry `inFlightAiBatchCount`, the workspace's AI batches still running on that key, and a `blitz` or `moltsets` key carries `quota`. `openai` is left out while `sign_in_with_chatgpt` is off for the caller, unless the workspace already saved an OpenAI key. That saved key can be changed, verified and deleted, but not replaced: `PUT openai` answers 409 even though the entry may read `live`. Requires the `integrations` permission.
 
 - API: `GET /v1/provider-keys`
 - Generated from the API contract
@@ -23256,7 +23405,7 @@ kenso public-shares submit --token <token> --data @body.json
 
 Create a reply template.
 
-The author is the caller: `user` for a person in the dashboard, `agent` for an agent, an MCP token or an API key. `authorSource``agent` only lowers a person to `agent`. Requires Inbox edit access and the workspace settings permission (owners, admins and editors by default).
+The author is the caller: `user` for a person in the dashboard, `agent` for an agent, an MCP token or an API key. `authorSource``agent` only lowers a person to `agent`. Requires Inbox edit and the `workspace_settings` permission (owners, admins and editors by default).
 
 - API: `POST /v1/reply-templates`
 - Generated from the API contract
@@ -23281,7 +23430,7 @@ kenso reply-templates create --data @body.json
 
 Delete a reply template.
 
-Returns `204`. The author is the caller, as on create. An agent, an MCP token or an API key cannot delete a human-written template. Requires Inbox edit access and the workspace settings permission (owners, admins and editors by default).
+Returns `204`. The author is the caller, as on create. An agent, an MCP token or an API key cannot delete a human-written template. Requires Inbox edit and the `workspace_settings` permission (owners, admins and editors by default).
 
 - API: `DELETE /v1/reply-templates/{replyTemplateId}`
 - Generated from the API contract
@@ -23301,7 +23450,7 @@ kenso reply-templates delete --reply-template-id <reply-template-id>
 
 Return one reply template in the current workspace.
 
-A missing or cross-workspace id is `not_found`. Requires `ReadAccess`.
+A missing or cross-workspace id is `not_found`. Requires Inbox view.
 
 - API: `GET /v1/reply-templates/{replyTemplateId}`
 - Generated from the API contract
@@ -23320,7 +23469,7 @@ kenso reply-templates get --reply-template-id <reply-template-id>
 
 List reply templates in the current workspace.
 
-Ordered by id. Requires `ReadAccess`.
+Ordered by id. Requires Inbox view.
 
 - API: `GET /v1/reply-templates` (a list: `--limit`, `--cursor`, `--all`)
 - Generated from the API contract
@@ -23342,7 +23491,7 @@ kenso reply-templates list --all
 
 Update a reply template.
 
-Only the fields sent are written; absent fields keep their stored value. JSON null clears `description`. The author is the caller, as on create, and a person's write records `user`. An agent, an MCP token or an API key cannot edit a human-written template. Requires Inbox edit access and the workspace settings permission (owners, admins and editors by default).
+Only the fields sent are written; absent fields keep their stored value. JSON null clears `description`. The author is the caller, as on create, and a person's write records `user`. An agent, an MCP token or an API key cannot edit a human-written template. Requires Inbox edit and the `workspace_settings` permission (owners, admins and editors by default).
 
 - API: `PATCH /v1/reply-templates/{replyTemplateId}`
 - Generated from the API contract
@@ -23985,7 +24134,7 @@ kenso saved-lists create-source --saved-list-id <saved-list-id> --data @body.jso
 
 Add a CSV's rows to a saved list.
 
-Multipart: the CSV in field `file` (at most 400 MB and 100,000 rows) and, optionally, `columnMappings`: the JSON array the contact-import upload takes, for example `[{"csvColumn":"Email","targetField":"email"},{"csvColumn":"Deal size","targetField":"custom_variable","customVariableName":"deal_size"}]`. Without it the columns map by their headers, as on the campaign upload. Optional List check fields, behind the `csv_import_check` feature (a field sent while it is off is `400 validation_failed` on that field): `fixes`, a JSON array of the fixes left on in a `POST /v1/contact-imports/scans` with target `saved_list` (`blocklist`, `invalidEmail`, `noMx`, `catchAll`, `personalEmail`, `roleAddress`; `missingKey` is accepted and changes nothing), for example `["blocklist","invalidEmail","noMx"]`: the rows the check flags for them are skipped; and `cleanup` (`true` runs every cell of a field with its own cleaner through the import cleaner first). A row already on the list, or a repeat of a row that was kept, still merges into its member with all its addresses: the fixes skip rows, they never strip one address from a merging row. Kenso checks the file and answers 202 with a `csv` source in `pending`, then adds the rows in the background: read the source until it is `done` or `failed`; its `parameters` then carry `rowCount`, `inserted`, `merged` and `rejected` (rows with no LinkedIn URL, email or name and company domain; for a company list, no domain or company page; and the rows a chosen fix skipped, which `skips` counts by fix key), plus the `fixes` and `cleanup` sent. Uploaded emails enter unverified, every phone is kept, and personal columns (birth date, gender, age, personal email and the like) are never stored. Only the workspace's own lists: a shared or library list is 404. Requires Search edit and the Import feature.
+Multipart: the CSV in field `file` (at most 400 MB and 100,000 rows) and, optionally, `columnMappings`: the JSON array the contact-import upload takes, for example `[{"csvColumn":"Email","targetField":"email"},{"csvColumn":"Deal size","targetField":"custom_variable","customVariableName":"deal_size"}]`. Without it the columns map by their headers, as on the campaign upload. Optional List check fields, behind the `csv_import_check` feature (a field sent while it is off is `400 validation_failed` on that field): `fixes`, a JSON array of the fixes left on in a `POST /v1/contact-imports/scans` with target `saved_list` (`blocklist`, `invalidEmail`, `noMx`, `catchAll`, `personalEmail`, `roleAddress`; `missingKey` is accepted and changes nothing), for example `["blocklist","invalidEmail","noMx"]`: the rows the check flags for them are skipped; and `cleanup` (`true` runs every cell of a field with its own cleaner through the import cleaner first). A row already on the list, or a repeat of a row that was kept, still merges into its member with all its addresses: the fixes skip rows, they never strip one address from a merging row. Kenso checks the file and answers 202 with a `csv` source in `pending`, then adds the rows in the background: read the source until it is `done` or `failed`; its `parameters` then carry `rowCount`, `inserted`, `merged` and `rejected` (rows with no LinkedIn URL, email or name and company domain; for a company list, no domain or company page; and the rows a chosen fix skipped, which `skips` counts by fix key), plus the `fixes` and `cleanup` sent. Uploaded emails enter unverified, every phone is kept, and personal columns (birth date, gender, age, personal email and the like) are never stored. Only the workspace's own lists: a shared or library list is 404. Requires Search edit and the `import` permission.
 
 - Beta: needs the `saved_lists` feature flag on the workspace.
 - API: `POST /v1/saved-lists/{savedListId}/uploads`
@@ -24416,7 +24565,7 @@ kenso saved-searches update --saved-search-id <saved-search-id>
 
 Cancel a scheduled message that has not started sending.
 
-Requires `InboxReplyAccess`. A missing id is `not_found`. A row that is already sending, sent, cancelled, or failed is `invalid_state`. Cancel still returns the scheduled message when restoring the composer draft fails, with `draft.saved` false so the caller saves the draft again.
+Requires Inbox edit and the `reply` permission. A missing id is `not_found`. A row that is already sending, sent, cancelled, or failed is `invalid_state`. Cancel still returns the scheduled message when restoring the composer draft fails, with `draft.saved` false so the caller saves the draft again.
 
 - API: `POST /v1/scheduled-messages/{scheduledMessageId}/cancel`
 - Generated from the API contract
@@ -24437,7 +24586,7 @@ kenso scheduled-messages cancel --scheduled-message-id <scheduled-message-id>
 
 Start a batch scrape and return a job.
 
-Requires `ReadAccess`. The response is `202` with a `batch_scrape` job. Poll `GET /v1/jobs/{jobId}?type=batch_scrape`. Cancel with `POST /v1/jobs/{jobId}/cancel?type=batch_scrape`.
+Requires Search edit. The response is `202` with a `batch_scrape` job. Poll `GET /v1/jobs/{jobId}?type=batch_scrape`. Cancel with `POST /v1/jobs/{jobId}/cancel?type=batch_scrape`.
 
 - API: `POST /v1/scraping/batch-scrapes`
 - Generated from the API contract
@@ -24458,7 +24607,7 @@ kenso scraping create-batch-scrape --data @body.json
 
 Start a crawl and return a job.
 
-Requires `ReadAccess`. The response is `202` with a `crawl` job. Poll `GET /v1/jobs/{jobId}?type=crawl`. Cancel with `POST /v1/jobs/{jobId}/cancel?type=crawl`. SSRF rejection stays in the Firecrawl service. The body needs a `limit` of 1 to 1,000 pages. When the job cannot be recorded, the started crawl is stopped and the answer is `503 service_unavailable`.
+Requires Search edit. The response is `202` with a `crawl` job. Poll `GET /v1/jobs/{jobId}?type=crawl`. Cancel with `POST /v1/jobs/{jobId}/cancel?type=crawl`. SSRF rejection stays in the Firecrawl service. The body needs a `limit` of 1 to 1,000 pages. When the job cannot be recorded, the started crawl is stopped and the answer is `503 service_unavailable`.
 
 - API: `POST /v1/scraping/crawls`
 - Generated from the API contract
@@ -24479,7 +24628,7 @@ kenso scraping create-crawl --data @body.json
 
 Start an extraction and return a job.
 
-Requires `ReadAccess`. The response is `202` with an `extraction` job. Poll `GET /v1/jobs/{jobId}?type=extraction`. Extraction cannot be canceled.
+Requires Search edit. The response is `202` with an `extraction` job. Poll `GET /v1/jobs/{jobId}?type=extraction`. Extraction cannot be canceled.
 
 - API: `POST /v1/scraping/extractions`
 - Generated from the API contract
@@ -25199,7 +25348,7 @@ kenso segment-email-sequences get-version --segment-id <segment-id> --version-id
 
 List saved versions of a segment email sequence, newest first.
 
-`limit` is 1 to 100 and defaults to 20. Requires `ReadAccess`.
+`limit` is 1 to 100 and defaults to 20. Requires Campaigns view.
 
 - API: `GET /v1/segments/{segmentId}/email-sequence/versions` (a list: `--limit`, `--cursor`, `--all`)
 - Generated from the API contract
@@ -25272,7 +25421,7 @@ kenso segment-email-sequences replace --segment-id <segment-id> --data @body.jso
 
 Restore a segment email sequence to a saved version.
 
-A link the URL reputation check refuses is 400 `validation_failed` with one `link_reputation_blocked` detail per link; its `field` is `steps.subject` or `steps.body` and `stepId` is the live step the restore would overwrite. Requires `SequenceEditAccess`.
+A link the URL reputation check refuses is 400 `validation_failed` with one `link_reputation_blocked` detail per link; its `field` is `steps.subject` or `steps.body` and `stepId` is the live step the restore would overwrite. Requires Campaigns edit.
 
 - API: `POST /v1/segments/{segmentId}/email-sequence/versions/{versionId}/restore`
 - Generated from the API contract
@@ -25292,7 +25441,7 @@ kenso segment-email-sequences restore-version --segment-id <segment-id> --versio
 
 Save a new segment email sequence version.
 
-Omit `steps` to snapshot the live sequence. With `sourceVersionId`, omitted or empty `steps` keep that version's steps, and a non-empty list overlays them. A link the URL reputation check refuses is 400 `validation_failed` with one `link_reputation_blocked` detail per link (`field`, `stepId`, `stepOrder`, `rule`, `url`), as on the sequence replace. Requires `SequenceEditAccess`.
+Omit `steps` to snapshot the live sequence. With `sourceVersionId`, omitted or empty `steps` keep that version's steps, and a non-empty list overlays them. A link the URL reputation check refuses is 400 `validation_failed` with one `link_reputation_blocked` detail per link (`field`, `stepId`, `stepOrder`, `rule`, `url`), as on the sequence replace. Requires Campaigns edit.
 
 - API: `POST /v1/segments/{segmentId}/email-sequence/versions`
 - Generated from the API contract
@@ -25467,7 +25616,7 @@ kenso segment-linkedin-sequences save-version --segment-id <segment-id> --data @
 
 Activate a segment.
 
-Idempotent when the segment is already active. Requires `WriteAccess`.
+Idempotent when the segment is already active. Requires Campaigns edit.
 
 - API: `POST /v1/segments/{segmentId}/activate`
 - Generated from the API contract
@@ -25486,7 +25635,7 @@ kenso segments activate --segment-id <segment-id>
 
 Create a segment on a campaign in the current workspace.
 
-Returns `201` and `Location`. Requires `WriteAccess`.
+Returns `201` and `Location`. Requires Campaigns edit.
 
 - API: `POST /v1/campaigns/{campaignId}/segments`
 - Generated from the API contract
@@ -25513,7 +25662,7 @@ kenso segments create --campaign-id <campaign-id> --data @body.json
 
 Deactivate a segment.
 
-Idempotent when the segment is already inactive. Requires `WriteAccess`.
+Idempotent when the segment is already inactive. Requires Campaigns edit.
 
 - API: `POST /v1/segments/{segmentId}/deactivate`
 - Generated from the API contract
@@ -25551,7 +25700,7 @@ kenso segments delete --segment-id <segment-id>
 
 Return one segment in the current workspace.
 
-A missing or cross-workspace id is `not_found`. Requires `ReadAccess`.
+A missing or cross-workspace id is `not_found`. Requires Campaigns view.
 
 - API: `GET /v1/segments/{segmentId}`
 - Generated from the API contract
@@ -25570,7 +25719,7 @@ kenso segments get --segment-id <segment-id>
 
 Return the segment filter catalog.
 
-The values a segment filter accepts: seniority levels, functions, industries, company types, employment types, funding rounds, technologies, email validity, email providers and languages, each as `value`, `label` and an optional `category`. The catalog is the same for every workspace and is the `filterOptions` object `POST /v1/campaigns/{campaignId}/segments/preview` returns; this read needs no campaign. It replaces `GET /v1/campaigns/segments/filter-metadata`. Read-only. Requires `ReadAccess`.
+The values a segment filter accepts: seniority levels, functions, industries, company types, employment types, funding rounds, technologies, email validity, email providers and languages, each as `value`, `label` and an optional `category`. The catalog is the same for every workspace and is the `filterOptions` object `POST /v1/campaigns/{campaignId}/segments/preview` returns; this read needs no campaign. It replaces `GET /v1/campaigns/segments/filter-metadata`. Read-only. Requires Campaigns view.
 
 - API: `GET /v1/segments/filter-options`
 - Generated from the API contract
@@ -25588,7 +25737,7 @@ kenso segments get-filter-options
 
 Return one segment version and its snapshot.
 
-`segmentationType` and `status` on the snapshot are lowercase snake_case. Requires `ReadAccess`.
+`segmentationType` and `status` on the snapshot are lowercase snake_case. Requires Campaigns view.
 
 - API: `GET /v1/segments/{segmentId}/versions/{versionId}`
 - Generated from the API contract
@@ -25608,7 +25757,7 @@ kenso segments get-version --segment-id <segment-id> --version-id <version-id>
 
 List segments of a campaign in the current workspace.
 
-Ordered by id. `q` matches the name. `isActive` filters that flag. `includeMetrics=false` skips the contact counts and omits `contactCount`, `rawContactCount` and `readyContactCount`: use it when only ids and names are needed. Read-only. Requires `ReadAccess`.
+Ordered by id. `q` matches the name. `isActive` filters that flag. `includeMetrics=false` skips the contact counts and omits `contactCount`, `rawContactCount` and `readyContactCount`: use it when only ids and names are needed. Read-only. Requires Campaigns view.
 
 - API: `GET /v1/campaigns/{campaignId}/segments` (a list: `--limit`, `--cursor`, `--all`)
 - Generated from the API contract
@@ -25636,7 +25785,7 @@ kenso segments list --campaign-id <campaign-id> --all
 
 List saved versions of a segment, newest first.
 
-`limit` is 1 to 100 and defaults to 20. `cursor` is the opaque cursor from the previous page. Requires `ReadAccess`.
+`limit` is 1 to 100 and defaults to 20. `cursor` is the opaque cursor from the previous page. Requires Campaigns view.
 
 - API: `GET /v1/segments/{segmentId}/versions` (a list: `--limit`, `--cursor`, `--all`)
 - Generated from the API contract
@@ -25659,7 +25808,7 @@ kenso segments list-versions --segment-id <segment-id> --all
 
 Preview a segment filter against the campaign.
 
-Returns the match count, a contact sample, and the filter catalog (`filterOptions`). Omit the body to read the catalog only, or read it without a campaign at `GET /v1/segments/filter-options`. A body, including an empty object, runs the match preview. `segmentId` scopes a match preview to an existing segment. Read-only. Requires `ReadAccess`.
+Returns the match count, a contact sample, and the filter catalog (`filterOptions`). Omit the body to read the catalog only, or read it without a campaign at `GET /v1/segments/filter-options`. A body, including an empty object, runs the match preview. A body whose keys name no filter field is `400 validation_failed` naming those keys, as on create and update. `segmentId` scopes a match preview to an existing segment. Read-only. Requires Campaigns view.
 
 - API: `POST /v1/campaigns/{campaignId}/segments/preview`
 - Generated from the API contract
@@ -25706,7 +25855,7 @@ kenso segments preview --campaign-id <campaign-id> --data @body.json
 
 Restore a segment to a saved version.
 
-`dryRun` returns the cascade preview and does not write. Each child includes the resolved `snapshot` the revert dialog renders. An applying restore that would clear campaign AI output returns `409 conflict` with `error.impact` until `confirm` is true. Cascade `kind` and `status` are lowercase snake_case. Requires `WriteAccess`.
+`dryRun` returns the cascade preview and does not write. Each child includes the resolved `snapshot` the revert dialog renders. An applying restore that would clear campaign AI output returns `409 conflict` with `error.impact` until `confirm` is true. Cascade `kind` and `status` are lowercase snake_case. Requires Campaigns edit.
 
 - API: `POST /v1/segments/{segmentId}/versions/{versionId}/restore`
 - Generated from the API contract
@@ -25733,7 +25882,7 @@ kenso segments restore-version --segment-id <segment-id> --version-id <version-i
 
 Save a segment as a new version.
 
-Applies the body to the segment and writes one version row. The body takes the `PATCH /v1/segments/{segmentId}` fields plus `sourceVersionId`. Absent fields keep the live segment's value, or the `sourceVersionId` version's value when one is given, so a save with no body saves the current state. JSON null clears `description` and `abTestPercentage`. A `sourceVersionId` of another segment is `not_found`, and another save in progress for the segment is `409 conflict`. When the save lands but version history is not captured, `version` is null and `versionWarning` says so. Requires `WriteAccess`.
+Applies the body to the segment and writes one version row. The body takes the `PATCH /v1/segments/{segmentId}` fields plus `sourceVersionId`. Absent fields keep the live segment's value, or the `sourceVersionId` version's value when one is given, so a save with no body saves the current state. JSON null clears `description` and `abTestPercentage`. A `sourceVersionId` of another segment is `not_found`, and another save in progress for the segment is `409 conflict`. When the save lands but version history is not captured, `version` is null and `versionWarning` says so. Requires Campaigns edit.
 
 - API: `POST /v1/segments/{segmentId}/versions`
 - Generated from the API contract
@@ -25761,7 +25910,7 @@ kenso segments save-version --segment-id <segment-id> --data @body.json
 
 Update a segment.
 
-Absent fields stay unchanged. JSON null clears `description` and `abTestPercentage`. `filterCriteria` field names are camelCase (matched case-insensitively); an object that names no filter field is `400 validation_failed` and nothing is saved. Requires `WriteAccess`.
+Absent fields stay unchanged. JSON null clears `description` and `abTestPercentage`. `filterCriteria` field names are camelCase (matched case-insensitively); an object that names no filter field is `400 validation_failed` and nothing is saved. Requires Campaigns edit.
 
 - API: `PATCH /v1/segments/{segmentId}`
 - Generated from the API contract
@@ -25828,7 +25977,7 @@ kenso sending-capacity get
 
 ### kenso sending-capacity get-forecast
 
-Forecast the current workspace's email sends for UTC today and the next two days: what its healthy inboxes can send per day (capacity), what is already queued or planned (planned), and what is left (remaining). Public, read only, Delivery view. Takes no what-if inputs; the staff forecast keeps those.
+Forecast the current workspace's email sends for UTC today and the next two days: what its healthy inboxes can send per day (capacity), what is already queued or planned (planned), and what is left (remaining). Read-only. Requires Delivery view. Takes no what-if inputs.
 
 - API: `GET /v1/sending-capacity/forecast`
 - Generated from the API contract
@@ -26037,7 +26186,7 @@ kenso sending-providers list
 
 Return the sequence variable catalog.
 
-Pass `campaignId` to include that campaign's custom variables. Requires `ReadAccess`.
+Pass `campaignId` to include that campaign's custom variables. Requires Campaigns view.
 
 - API: `GET /v1/sequence-variables`
 - Generated from the API contract
@@ -26058,7 +26207,7 @@ kenso sequence-variables get
 
 Read the meeting notes shared with you.
 
-The token is the last path segment of the emailed link `/meeting-share/{token}`. No `X-Ken-Workspace-Id` needed. Returns the meeting's title and times, who shared it, when the link expires and Ken's notes (`notes` is null until there are notes to read); never a rep's typed lines or the transcript. The signed-in email must be the shared address (`403 email_mismatch`) and verified, by the session's `email_verified` claim or the user's stored verified email (`403 email_unverified`). An unknown or altered token, or a deleted meeting, is `404`. A revoked share is `410 share_revoked`, an expired one `410 share_expired`, and Kenso Notetaker off for the sharer in that workspace `410 share_inactive`. An agent or an API key gets `403`: only a person signed in with the address opens it. Each open is audited.
+The token is the last path segment of the emailed link `/meeting-share/{token}`. No `X-Ken-Workspace-Id` needed. Returns the meeting's title and times, who shared it, when the link expires and Ken's notes (`notes` is null until there are notes to read); never a rep's typed lines or the transcript. An unknown or altered token is `404`. Then the address is checked before anything else about the share: the signed-in email must be the shared address (`403 email_mismatch`, whatever state the share is in) and verified, by the session's `email_verified` claim or the user's stored verified email (`403 email_unverified`). Only then the share's state: a deleted meeting is `404`, a revoked share is `410 share_revoked`, an expired one `410 share_expired`, and Kenso Notetaker off for the sharer in that workspace `410 share_inactive`. So a `410` or `200` means the caller holds the shared address. An agent or an API key gets `403`: only a person signed in with the address opens it. Each open is audited, once per person and share per 2 minutes.
 
 - API: `GET /v1/shared-meetings/{token}`
 - Generated from the API contract
@@ -26341,7 +26490,7 @@ kenso signal-vendor-connections get --integration-key <integration-key>
 
 Queue signals for the current workspace.
 
-Requires Search edit access (owners, admins and editors by default). `type` and `source` are lowercase snake_case. Non-super-admins are forced to synthetic signals and send at most 100 signals a call, each counted against the workspace's signal quota. A contact, campaign, or segment outside the workspace is rejected before publish. `duplicateCount` counts signals skipped because their `dedupKey` was queued in the last 24 hours.
+Requires Search edit access (owners, admins and editors by default). `type` and `source` are lowercase snake_case. Every signal is stored as synthetic. A call sends at most 100 signals, each counted against the workspace's signal quota. A contact, campaign, or segment outside the workspace is rejected before publish. `duplicateCount` counts signals skipped because their `dedupKey` was queued in the last 24 hours.
 
 - API: `POST /v1/signals`
 - Generated from the API contract
@@ -26566,7 +26715,7 @@ kenso spend-limits update --data @body.json
 
 Add a person to an account as a stakeholder.
 
-Send `personId` (an existing person) or `person` (found by email, then LinkedIn URL, then kenPersonId, else created; a match only fills its blank fields), plus `role` (champion, economic_buyer, approver, evaluator, user, executive_sponsor, blocker, unknown), `priority` (1-3), `coverage` (engaged, planned, gap, not_targeted), `note`, `kenNote` (up to 1,000 characters), `reportsToStakeholderId` (a stakeholder on the same account, no cycles) and `fillsSeatId` (an open seat on this account, closed in the same write). Conflicts: `already_stakeholder`; `previously_removed` when a person removed them and the caller is not a person (resend with `force: true` only when the user asked). Requires `WriteAccess`.
+Send `personId` (an existing person) or `person` (found by email, then LinkedIn URL, then kenPersonId, else created; a match only fills its blank fields), plus `role` (champion, economic_buyer, approver, evaluator, user, executive_sponsor, blocker, unknown), `priority` (1-3), `coverage` (engaged, planned, gap, not_targeted), `note`, `kenNote` (up to 1,000 characters), `reportsToStakeholderId` (a stakeholder on the same account, no cycles) and `fillsSeatId` (an open seat on this account, closed in the same write). Conflicts: `already_stakeholder`; `previously_removed` when a person removed them and the caller is not a person (resend with `force: true` only when the user asked). Requires Accounts edit.
 
 - Beta: needs the `accounts` feature flag on the workspace.
 - API: `POST /v1/accounts/{accountId}/stakeholders`
@@ -26600,7 +26749,7 @@ kenso stakeholders create --account-id <account-id> --data @body.json
 
 Remove a stakeholder from its account.
 
-Skips their open touches; the person stays. Returns `204`. Requires `WriteAccess`.
+Skips their open touches; the person stays. Returns `204`. Requires Accounts edit.
 
 - Beta: needs the `accounts` feature flag on the workspace.
 - API: `DELETE /v1/stakeholders/{stakeholderId}`
@@ -26620,7 +26769,7 @@ kenso stakeholders delete --stakeholder-id <stakeholder-id>
 
 List an account's stakeholders, each with its person.
 
-Oldest first. Requires `ReadAccess`.
+Oldest first. Requires Accounts view.
 
 - Beta: needs the `accounts` feature flag on the workspace.
 - API: `GET /v1/accounts/{accountId}/stakeholders` (a list: `--limit`, `--cursor`, `--all`)
@@ -26644,7 +26793,7 @@ kenso stakeholders list --account-id <account-id> --all
 
 Update a stakeholder. Absent fields stay unchanged; null clears.
 
-Fields: role, priority, coverage, note, kenNote, reportsToStakeholderId. Pinned fields need `overwritePinned: true`. Requires `WriteAccess`.
+Fields: role, priority, coverage, note, kenNote, reportsToStakeholderId. Pinned fields need `overwritePinned: true`. Requires Accounts edit.
 
 - Beta: needs the `accounts` feature flag on the workspace.
 - API: `PATCH /v1/stakeholders/{stakeholderId}`
@@ -26967,7 +27116,7 @@ kenso subscription update --data @body.json
 
 Stream the stored attachment bytes for the calling user.
 
-Replaces `GET /v1/support-chat/attachments/{id}/content`. Requires `ReadAccess`.
+Replaces `GET /v1/support-chat/attachments/{id}/content`. Requires the `ask` permission.
 
 - API: `GET /v1/support/attachments/{attachmentId}/content`
 - Generated from the API contract
@@ -26986,7 +27135,7 @@ kenso support-attachments content --attachment-id <attachment-id>
 
 Upload a file for the support agent to read: PDF, Word, Markdown, text, CSV or image.
 
-Replaces `POST /v1/support-chat/attachments`. Multipart field `file`, at most 20 MB. Takes .pdf, .docx, .md, .markdown, .txt, .csv, .png, .jpg, .jpeg, .webp and .gif, checked against the file's bytes; `kind` is `pdf`, `docx`, `text` or `image`. Each upload draws on per-user and per-workspace daily quotas; a refusal is `429`. A PDF without a text layer comes back with `textStatus``pending` while OCR reads it in the background, under the workspace's OCR page budget. Requires `ReadAccess`.
+Replaces `POST /v1/support-chat/attachments`. Multipart field `file`, at most 20 MB. Takes .pdf, .docx, .md, .markdown, .txt, .csv, .png, .jpg, .jpeg, .webp and .gif, checked against the file's bytes; `kind` is `pdf`, `docx`, `text` or `image`. Each upload draws on per-user and per-workspace daily quotas; a refusal is `429`. A PDF without a text layer comes back with `textStatus``pending` while OCR reads it in the background, under the workspace's OCR page budget. Requires the `ask` permission.
 
 - API: `POST /v1/support/attachments`
 - Generated from the API contract
@@ -27007,7 +27156,7 @@ kenso support-attachments create --file ./file.csv
 
 Read attachment metadata and extracted text for the calling user.
 
-Replaces `GET /v1/support-chat/attachments/{id}`. Requires `ReadAccess`.
+Replaces `GET /v1/support-chat/attachments/{id}`. Requires the `ask` permission.
 
 - API: `GET /v1/support/attachments/{attachmentId}`
 - Generated from the API contract
@@ -27076,7 +27225,7 @@ kenso tags bulk-assign --tag-id <tag-id> --data @body.json
 
 Remove a tag from up to 1,000 entities in one call.
 
-Same body, validation, and per-item behavior as `bulk-create`, through the same path as `DELETE /v1/tags/{tagId}/assignments`. A successful item is `removed`. The route needs workspace membership; each item's entity type adds its page edit access, as on assign.
+Same body, validation, and per-item behavior as `bulk-create`, through the same path as `DELETE /v1/tags/{tagId}/assignments`. A successful item is `removed`. A deleted tag of the workspace can still be removed from `reply` and `linkedin_conversation` items; every other item is then `not_found`. The route needs workspace membership; each item's entity type adds its page edit access, as on assign.
 
 - API: `POST /v1/tags/{tagId}/assignments/bulk-delete`
 - Generated from the API contract
@@ -27187,7 +27336,7 @@ kenso tags list --all
 
 Remove a tag assignment.
 
-Query parameters, not a body: `entityType` plus `entityId`, `messageId`, or `conversationId` (the same ids as on assign). A missing `entityType` is `validation_failed`, and a tag outside the workspace is `404 not_found`. The route needs workspace membership; the entity type adds its page edit access, as on assign.
+Query parameters, not a body: `entityType` plus `entityId`, `messageId`, or `conversationId` (the same ids as on assign). A missing `entityType` is `validation_failed`, and a tag outside the workspace is `404 not_found`. A deleted tag of the workspace can still be removed from a `reply` or a `linkedin_conversation`. The route needs workspace membership; the entity type adds its page edit access, as on assign.
 
 - API: `DELETE /v1/tags/{tagId}/assignments`
 - Generated from the API contract
@@ -27343,7 +27492,7 @@ kenso teams-connection update --data @body.json
 
 Apply the same field update to up to 1,000 threads.
 
-Returns per-id outcomes. Requires `InboxReplyAccess`.
+Returns per-id outcomes. Requires Inbox edit.
 
 - API: `POST /v1/threads/bulk-update`
 - Generated from the API contract
@@ -27364,7 +27513,7 @@ kenso threads bulk-update --data @body.json
 
 Count inbox threads by tab and source.
 
-Requires Inbox view. Email and LinkedIn together. `status`, `folder`, `isArchived` and `isSaved` name the tab the way `GET /v1/threads` takes them, and `allCount` is the number of distinct threads that list returns for the tab. The list's `pagination.total` counts email messages, so it is higher when a thread has several messages in the tab. `accountsCount` and `campaignsCount` split the tab by account-linked and campaign threads, and `campaigns` lists every campaign with a thread in the inbox. `toReplyCount`, `unreadCount`, `latestMessageAt` and `inboxChangedAt` ignore the tab filters. `inboxChangedAt` moves when a reply arrives (a late-synced one included) or changes tab, for example when the classifier files it; poll it and refetch the list when it changes. An email thread is counted once however many messages it has; a LinkedIn conversation is one thread.
+Requires Inbox view. Email and LinkedIn together. `status`, `folder`, `isArchived` and `isSaved` name the tab the way `GET /v1/threads` takes them, and `allCount` is the number of distinct threads that list returns for the tab. The list's `pagination.total` counts email messages, so it is higher when a thread has several messages in the tab. `accountsCount` and `campaignsCount` split the tab by account-linked and campaign threads, and `campaigns` lists every campaign with a thread in the inbox. `toReplyCount`, `unreadCount`, `latestMessageAt` and `inboxChangedAt` ignore the tab filters. `inboxChangedAt` moves when a reply arrives (a late-synced one included) or changes tab, for example when the classifier files it; poll it and refetch the list when it changes. An email thread is counted once however many messages it has; a LinkedIn conversation is one thread. With `groupBy=person` the counts count distinct people instead (`allCount`, `accountsCount`, `campaignsCount`, `toReplyCount`, `unreadCount`, `campaigns[].threadCount`), each the number of rows `GET /v1/threads?groupBy=person` lists for that tab. A person counts under a campaign or an account by the campaign or account of their thread in the tab. A tab that lists our own sends (`folder=sent` or `folder=all`) keeps its thread counts in `allCount`, `accountsCount`, `campaignsCount` and `campaigns[].threadCount` under `groupBy=person`, since its grouped list's total may be capped; when `pagination.isTotalCapped` is true, show that total as N+. `toReplyCount` and `unreadCount` still count people (DEV-7255).
 
 - API: `GET /v1/threads/counts`
 - Generated from the API contract
@@ -27372,6 +27521,7 @@ Requires Inbox view. Email and LinkedIn together. `status`, `folder`, `isArchive
 | Flag | Type | Required | Description |
 | --- | --- | --- | --- |
 | `--folder` | string | no | Inbox folder: inbox, sent, or all. Omitted means inbound. |
+| `--group-by` | string | no | `person`: every count counts distinct people (a row of `GET /v1/threads?groupBy=person`) instead of threads (DEV-7255). Omitted counts threads. Any other value is 400. |
 | `--is-archived` | boolean | no | isArchived (query, boolean) |
 | `--is-saved` | boolean | no | isSaved (query, boolean) |
 | `--status` | string | no | Inbox tab token: to_reply, other, automated_reply, not_interested, human_reply. |
@@ -27413,7 +27563,7 @@ kenso threads create --data @body.json
 
 Send a message on a thread.
 
-Email requires `senderEmailId`. An email reply goes to the thread's sender unless it names `to`, or `replyAll: true` (the sender, To and Cc, less the sending inbox); `cc` and `bcc` add recipients, each one bare email address. `attachmentIds` are `att_` ids uploaded against this thread (its newest message), and `contentType` is `html` (default) or `text`. Those six fields are email only: a LinkedIn reply that names any of them is `400 validation_failed` on that field and sends nothing (DEV-2537). LinkedIn sends plain text through the conversation seat. A LinkedIn `Idempotency-Key` is bound to its thread and message: reusing it on another thread, or with another body once decided, returns `409 idempotency_key_reused` and sends nothing. Without a key, the same text repeated in a thread more than 5 minutes later is sent again. An email `Idempotency-Key` (optional, at most 200 characters, unique in the workspace) is bound to its thread, inbox and body, and to its `to`, `cc`, `bcc`, `replyAll`, `contentType` and `attachmentIds` when it names any: a retry returns the reply it scheduled, or the `202` with the client approval item it was held as, and queues nothing; another request under it is `409 idempotency_key_reused`; one still being queued is `409 in_progress` with `nextAllowedAt` and `Retry-After`; one Kenso cannot tell was queued is `409 outcome_unknown` and never queues again. A refused reply frees its key (DEV-3672). Requires `InboxReplyAccess`. The send is recorded only after the provider accepts it. An email reply to a do-not-contact, blocklisted or unsubscribed contact returns `409 invalid_state` with a `confirmSuppressed` detail whose code is the reason, and is sent only when the request repeats with `confirmSuppressed: true`. LinkedIn replies to a suppressed contact are always refused. An email reply is recorded with its caller: a person, an API key, or an agent (any credential sent with `X-Ken-Actor: agent`). An API key or agent reply from its own member's mailbox is not sent: it returns `202` with the scheduled message in `status: awaiting_approval` and `approverMemberId`, and waits in that member's `GET /v1/approvals` until they approve it in person (DEV-6060); with `accounts` off, or from another member's own mailbox, it is `403 forbidden`. Its reply from an inbox a member paused or Ken blocked from sending is a `409 invalid_state` whose detail code is `inbox_paused` or `inbox_send_blocked`, with a `fix` (DEV-3672). A block carries `nextAllowedAt` (its end) and `Retry-After`; a pause has no known end and carries neither. A pause or block that starts during the undo window refuses the queued reply at send time: the scheduled message ends `failed`. When the workspace requires external approval for replies, an email reply is not sent: the response is `202` with `status``held_for_client_approval` and the `clientApprovalItemId` that holds it (DEV-1526). An email reply a teammate writes in person from a client seat's own inbox, with `accounts_send` on, is not sent either: it returns `202` with the scheduled message (`ScheduledMessageModel`) in `status: awaiting_approval` and `approverMemberId`, and waits in that client's `GET /v1/approvals` (DEV-2043). Email `archiveAfterSend: true` archives the thread once the reply sends; a waiting reply archives only when the approved reply sends, never while it waits. An API key or agent LinkedIn reply through a seat another member connected is not sent (DEV-6464): it returns `202` with `status: awaiting_approval`, `channel: linkedin`, the `approvalId` (type `reply.linkedin`) and `approverMemberId` (the seat owner), and waits in that member's `GET /v1/approvals` until they approve it in person, when it sends once. A retry with the same `Idempotency-Key` (or the same text without one) returns the same waiting reply. With `accounts` off for the owner, or a seat no member connected, it is `403 forbidden`. A person's own reply from the dashboard, and the seat owner's own agent or API key, send as before.
+Email requires `senderEmailId`. An email reply goes to the thread's sender unless it names `to`, or `replyAll: true` (the sender, To and Cc, less the sending inbox); `cc` and `bcc` add recipients, each one bare email address. `attachmentIds` are `att_` ids uploaded against this thread (its newest message), and `contentType` is `html` (default) or `text`. Those six fields are email only: a LinkedIn reply that names any of them is `400 validation_failed` on that field and sends nothing (DEV-2537). An email reply is queued for an undo window: `delaySeconds` is 60 (the default) or 300, as on a forward, and the `201` carries the queued reply's `scheduledMessageId`, which `POST /v1/scheduled-messages/{id}/cancel` takes until the window ends. A retry under the same `Idempotency-Key` returns the first reply whatever its delay (DEV-7673). `subject` is for drafts: a reply goes out on the thread's subject. LinkedIn sends plain text through the conversation seat at once, and ignores `delaySeconds`. A LinkedIn `Idempotency-Key` is bound to its thread and message: reusing it on another thread, or with another body once decided, returns `409 idempotency_key_reused` and sends nothing. Without a key, the same text repeated in a thread more than 5 minutes later is sent again. An email `Idempotency-Key` (optional, at most 200 characters, unique in the workspace) is bound to its thread, inbox and body, and to its `to`, `cc`, `bcc`, `replyAll`, `contentType` and `attachmentIds` when it names any: a retry returns the reply it scheduled, or the `202` with the client approval item it was held as, and queues nothing; another request under it is `409 idempotency_key_reused`; one still being queued is `409 in_progress` with `nextAllowedAt` and `Retry-After`; one Kenso cannot tell was queued is `409 outcome_unknown` and never queues again. A refused reply frees its key (DEV-3672). Requires Inbox edit and the `reply` permission. The send is recorded only after the provider accepts it. An email reply to a do-not-contact, blocklisted or unsubscribed contact returns `409 invalid_state` with a `confirmSuppressed` detail whose code is the reason, and is sent only when the request repeats with `confirmSuppressed: true`. LinkedIn replies to a suppressed contact are always refused. An email reply is recorded with its caller: a person, an API key, or an agent (any credential sent with `X-Ken-Actor: agent`). An API key or agent reply from its own member's mailbox is not sent: it returns `202` with the scheduled message in `status: awaiting_approval` and `approverMemberId`, and waits in that member's `GET /v1/approvals` until they approve it in person (DEV-6060); with `accounts` off, or from another member's own mailbox, it is `403 forbidden`. Its reply from an inbox a member paused or Ken blocked from sending is a `409 invalid_state` whose detail code is `inbox_paused` or `inbox_send_blocked`, with a `fix` (DEV-3672). A block carries `nextAllowedAt` (its end) and `Retry-After`; a pause has no known end and carries neither. A pause or block that starts during the undo window refuses the queued reply at send time: the scheduled message ends `failed`. When the workspace requires external approval for replies, an email reply is not sent: the response is `202` with `status``held_for_client_approval` and the `clientApprovalItemId` that holds it (DEV-1526). An email reply a teammate writes in person from a client seat's own inbox, with `accounts_send` on, is not sent either: it returns `202` with the scheduled message (`ScheduledMessageModel`) in `status: awaiting_approval` and `approverMemberId`, and waits in that client's `GET /v1/approvals` (DEV-2043). Email `archiveAfterSend: true` archives the thread once the reply sends; a waiting reply archives only when the approved reply sends, never while it waits. An API key or agent LinkedIn reply through a seat another member connected is not sent (DEV-6464): it returns `202` with `status: awaiting_approval`, `channel: linkedin`, the `approvalId` (type `reply.linkedin`) and `approverMemberId` (the seat owner), and waits in that member's `GET /v1/approvals` until they approve it in person, when it sends once. A retry with the same `Idempotency-Key` (or the same text without one) returns the same waiting reply. With `accounts` off for the owner, or a seat no member connected, it is `403 forbidden`. A person's own reply from the dashboard, and the seat owner's own agent or API key, send as before.
 
 - API: `POST /v1/threads/{threadId}/messages`
 - Generated from the API contract
@@ -27423,8 +27573,9 @@ Email requires `senderEmailId`. An email reply goes to the thread's sender unles
 | --- | --- | --- | --- |
 | `--thread-id` | string | yes | threadId (path, string) |
 | `--body` | string | no | body (body, string) |
-| `--subject` | string | no | subject (body, string) |
+| `--subject` | string | no | Drafts only: a reply goes out on the thread's own subject, so a send ignores this field. Set a draft's subject with `PUT /v1/threads/{threadId}/draft` (DEV-7673). |
 | `--sender-email-id` | integer | no | senderEmailId (body, integer) |
+| `--delay-seconds` | integer | no | Email only: the undo window in seconds before the reply sends, 60 or 300, as on a forward. Omitted, it is 60. An agent sends 300. Cancel the queued reply with `POST /v1/scheduled-messages/{id}/cancel` and the response's `scheduledMessageId`. A LinkedIn reply sends at once and ignores it (DEV-7673). |
 | `--confirm-suppressed` | boolean | no | Email only: send even though the contact is do-not-contact, blocklisted or unsubscribed. Set only after the user confirmed a `409 invalid_state` for a suppressed contact. |
 | `--archive-after-send` | boolean | no | Email only: archive the thread once the reply sends. A reply waiting on a client seat's approval archives when the approved reply sends, never while it waits, and a skipped one leaves the thread as it was (DEV-2043). |
 | `--reply-all` | boolean | no | Email only: without Ken.Scraper.API.Dtos.CreateThreadMessageRequest.To, reply to the thread's sender, To and Cc, less the sending inbox. A LinkedIn thread refuses it (DEV-2537). |
@@ -27462,7 +27613,7 @@ kenso threads delete-draft --thread-id <thread-id>
 
 Forward an email thread to new recipients.
 
-Requires `MemberReadAccess` (a white-label Client replies but does not forward). Email only. The forward is queued and the provider confirms delivery later. `to` is required unless `replyAll` is true. `delaySeconds` is 60 or 300. `attachmentIds` are `att_` ids for this thread. Every recipient is one bare email address. A forward that reaches the thread (`replyAll` without `to`, or the contact or another participant as a recipient) returns `409 invalid_state` when the contact is suppressed (detail code is the reason; there is no confirm override, send a reply instead) or when the workspace holds replies for external approval (detail code `client_approval_required`). A queued forward returns `200` with the scheduled message. An API key or agent forward from its own member's mailbox is not sent: it returns `202` with the scheduled message in `status: awaiting_approval` and `approverMemberId`, and waits in that member's `GET /v1/approvals` until they approve it in person (DEV-6060); with `accounts` off, or from another member's own mailbox, it is `403 forbidden`.
+Requires Inbox edit and the `reply` and `export` permissions (the built-in Client template has no `export`, so a Client seat replies but does not forward). Email only. The forward is queued and the provider confirms delivery later. `to` is required unless `replyAll` is true. `delaySeconds` is 60 or 300. `attachmentIds` are `att_` ids for this thread. Every recipient is one bare email address. A forward that reaches the thread (`replyAll` without `to`, or the contact or another participant as a recipient) returns `409 invalid_state` when the contact is suppressed (detail code is the reason; there is no confirm override, send a reply instead) or when the workspace holds replies for external approval (detail code `client_approval_required`). A queued forward returns `200` with the scheduled message. An API key or agent forward from its own member's mailbox is not sent: it returns `202` with the scheduled message in `status: awaiting_approval` and `approverMemberId`, and waits in that member's `GET /v1/approvals` until they approve it in person (DEV-6060); with `accounts` off, or from another member's own mailbox, it is `403 forbidden`.
 
 - API: `POST /v1/threads/{threadId}/forward`
 - Generated from the API contract
@@ -27497,7 +27648,7 @@ kenso threads forward --thread-id <thread-id> --data @body.json
 
 Return one thread.
 
-A malformed id, unknown channel, or cross-workspace thread is `not_found`. `accountId` and `accountName` are the account whose touch the thread is, else the account on which the thread's contact is a stakeholder, when there is one. An email thread that is an account touch's thread also carries `replyTouchId`: that account's open reply touch answering the thread, which sends the reply when approved (DEV-2537). `hasDraft` says a reply draft is saved on the thread and `draftAuthor` who wrote it. Requires `ReadAccess`. An email thread carries `scheduledMessages`: replies and forwards queued on it that have not sent yet, including a teammate's reply waiting on a client seat (`awaiting_approval`, DEV-2043), which the writer can withdraw with `POST /v1/scheduled-messages/{id}/cancel`.
+A malformed id, unknown channel, or cross-workspace thread is `not_found`. `accountId` and `accountName` are the account whose touch the thread is, else the account on which the thread's contact is a stakeholder, when there is one. An email thread that is an account touch's thread also carries `replyTouchId`: that account's open reply touch answering the thread, which sends the reply when approved (DEV-2537). `hasDraft` says a reply draft is saved on the thread and `draftAuthor` who wrote it. Requires Inbox view. An email thread carries `scheduledMessages`: replies and forwards queued on it that have not sent yet, including a teammate's reply waiting on a client seat (`awaiting_approval`, DEV-2043), which the writer can withdraw with `POST /v1/scheduled-messages/{id}/cancel`.
 
 - API: `GET /v1/threads/{threadId}`
 - Generated from the API contract
@@ -27535,7 +27686,7 @@ kenso threads get-draft --thread-id <thread-id>
 
 List threads in the current workspace.
 
-Requires `ReadAccess`. `channel` is `email`, `linkedin`, or `all`. `limit` defaults to 50 and maxes at 100, matching the inbox list. `status` and `folder` are the inbox tab filters (to_reply, other, automated_reply, not_interested, sent) and are applied before paging. Each thread is one row, its newest message in the tab, and `pagination.total` counts threads, as `GET /v1/threads/counts` does (DEV-4083). With `q`, `pagination.total` counts at most 1,000 threads: past 1,000 it is 1,000 and `pagination.isTotalCapped` is true, and paging goes on while `hasMore` is true. Without `q`, or at 1,000 matches or fewer, the total is exact and `isTotalCapped` is omitted (DEV-4517). To Reply is attributed Interested, Objection, and Wrong Contact, plus due reminders. A thread leaves it once our reply is its newest message, as a LinkedIn conversation does, and comes back with the lead's next reply. `source` is the lane on top of the tab: `accounts` (account touch threads) or `campaigns` (campaign threads), with the predicates of `accountsCount` and `campaignsCount` on `GET /v1/threads/counts`. Omitted lists every thread of the tab. A row of an account touch's thread carries `accountId` and `accountName` while the accounts feature is on for the caller, and an email one `replyTouchId`, the account's open reply touch answering the thread, when there is one (DEV-2537). Every row carries `hasDraft`, and `draftAuthor` (`user` or `agent`) when a reply draft is saved on it. `sort=oldest_waiting` lists the thread that has waited longest first, across pages: by `waitingSince`, else by the newest message; omitted keeps the inbox order, newest first. Each row whose newest message is the contact's carries `waitingSince`, when that message arrived, on any tab; it is a wait on a reply only on `to_reply`. A thread we answered whose reminder came due waits since that reminder (DEV-5202).
+Requires Inbox view. `channel` is `email`, `linkedin`, or `all`. `limit` defaults to 50 and maxes at 100, matching the inbox list. `status` and `folder` are the inbox tab filters (to_reply, other, automated_reply, not_interested, sent) and are applied before paging. `contactId`, `inboxId`, `hasReminder` and `interest` are applied before paging too, to each thread's row, so `hasMore` and `pagination.total` count the matching threads (DEV-7640). `inboxId` is the row's `inboxId`: a LinkedIn thread's account, or the workspace inbox an email row's message was sent to (an address in its `to`) or from (DEV-7673). `interest=not_interested` matches both not-interested classifications: the one this API writes, which reads back as `negative`, and the older one, which reads back as `not_interested`. Each thread is one row, its newest message in the tab, and `pagination.total` counts threads, as `GET /v1/threads/counts` does (DEV-4083). Under `folder=all` that is the newest message in either direction, and a message we sent carries no label and no reminder, so filter `interest` and `hasReminder` with `folder=inbox` to match each thread's newest reply. Email inbox ids and LinkedIn account ids are separate id spaces: on `channel=all` an `inboxId` matches either, so pass `channel` with it to stay on one (DEV-7693). With `q`, `pagination.total` counts at most 1,000 threads: past 1,000 it is 1,000 and `pagination.isTotalCapped` is true, and paging goes on while `hasMore` is true. Without `q`, or at 1,000 matches or fewer, the total is exact and `isTotalCapped` is omitted (DEV-4517). To Reply is attributed Interested, Objection, and Wrong Contact, plus due reminders. A thread leaves it once our reply is its newest message, as a LinkedIn conversation does, and comes back with the lead's next reply. `source` is the lane on top of the tab: `accounts` (account touch threads) or `campaigns` (campaign threads), with the predicates of `accountsCount` and `campaignsCount` on `GET /v1/threads/counts`. Omitted lists every thread of the tab. A row of an account touch's thread carries `accountId` and `accountName` while the accounts feature is on for the caller, and an email one `replyTouchId`, the account's open reply touch answering the thread, when there is one (DEV-2537). Every row carries `hasDraft`, and `draftAuthor` (`user` or `agent`) when a reply draft is saved on it. `sort=oldest_waiting` lists the thread that has waited longest first, across pages: by `waitingSince`, else by the newest message; omitted keeps the inbox order, newest first. Each row whose newest message is the contact's carries `waitingSince`, when that message arrived, on any tab; it is a wait on a reply only on `to_reply`. A thread we answered whose reminder came due waits since that reminder (DEV-5202).
 
 - API: `GET /v1/threads` (a list: `--limit`, `--cursor`, `--all`)
 - Generated from the API contract
@@ -27544,16 +27695,18 @@ Requires `ReadAccess`. `channel` is `email`, `linkedin`, or `all`. `limit` defau
 | --- | --- | --- | --- |
 | `--campaign-id` | integer | no | campaignId (query, integer) |
 | `--channel` | string | no | channel (query, string) |
-| `--contact-id` | integer | no | contactId (query, integer) |
+| `--contact-id` | integer | no | Threads with this `contactId`, as each row carries it: the stored contact, or for a LinkedIn conversation stored with none, the contact its attendee is matched to (DEV-7673). |
 | `--cursor` | string | no | Start at this cursor (the next: hint of a previous page). |
 | `--folder` | string | no | Inbox folder: inbox, sent, or all. Omitted means inbound, matching the legacy list. |
-| `--has-reminder` | boolean | no | hasReminder (query, boolean) |
-| `--inbox-id` | integer | no | inboxId (query, integer) |
-| `--interest` | string | no | interest (query, string) |
+| `--group-by` | string | no | `person`: one row per person, the person's newest thread in the tab (DEV-7255). Each row adds `personKey` (`per_`, else `con_`, else the row's `thr_` id), `personId` and `personName` (null unless `per_`), and over the person's threads on any tab `channels` (`{ email, linkedin }`), `waitingCount` (threads To Reply lists) and `threadIds` (newest first, at most 200). `pagination.total` then counts people. On a tab that lists our own sends (`folder=sent` or `folder=all`) in the default order and without `q`, the total may be capped, counting only the people among the newest messages read for the page; when `pagination.isTotalCapped` is true, show the total as N+ and page while `hasMore` is true. With `q` the total is capped at 1000 people as a plain search's is at 1000 threads. With `sort=oldest_waiting` a person sorts by their longest wait in the tab, and the row stays their newest thread. Omitted lists one row per thread. Any other value is 400. |
+| `--has-reminder` | boolean | no | true lists threads whose row carries a reminder, false those whose row carries none. Under `folder=all` a thread's row is its newest message in either direction, and a message we sent carries no reminder, so a thread we answered after setting a reminder on the reply does not match true. To filter threads by their newest reply, list with `folder=inbox` (DEV-7693). |
+| `--inbox-id` | integer | no | Threads whose `inboxId` is this inbox: a LinkedIn thread's account, or the workspace inbox an email row's message was sent to or from (DEV-7673). Email inbox ids and LinkedIn account ids are separate id spaces, so on `channel=all` (the default) the id matches an email inbox or a LinkedIn account with that id; pass `channel` to stay on one (DEV-7693). |
+| `--interest` | string | no | Threads whose row carries this label: interested, not_interested, negative, automated, unclassified, unsubscribe, objection, wrong_contact, out_of_office or referral; not_interested also matches negative. Under `folder=all` a thread's row is its newest message in either direction, and a message we sent carries no label (it reads as unclassified), so a thread we already answered matches only unclassified. To filter threads by their newest reply, list with `folder=inbox` (DEV-7693). |
 | `--is-archived` | boolean | no | isArchived (query, boolean) |
 | `--is-read` | boolean | no | isRead (query, boolean) |
 | `--is-saved` | boolean | no | isSaved (query, boolean) |
 | `--limit` | integer | no | Page size. |
+| `--person-key` | string | no | A row's `personKey` (`per_`, `con_` or `thr_`): every thread of that person, archived or not, newest first, each with the `groupBy=person` fields (DEV-7255). Every folder unless a `folder` or `status` is given; other filters still narrow it. Malformed is 400. |
 | `--q` | string | no | q (query, string) |
 | `--sort` | string | no | `oldest_waiting`: the thread that has waited longest first, across pages, by each row's `waitingSince`, else its newest message (DEV-5202). Omitted keeps the inbox order, newest first. Any other value is 400. |
 | `--source` | string | no | The inbox lane on top of the tab: accounts or campaigns, matching accountsCount and campaignsCount of GET /v1/threads/counts. Omitted means every thread of the tab. Any other value is 400. |
@@ -27576,12 +27729,16 @@ kenso threads list --all
 
 List messages in a thread, oldest first.
 
+Every item carries `kind`: `message` for a chat or email message. `includeEvents=true` on a LinkedIn thread also lists the connection note Ken sent with the invitation (`connection_note`, outbound) and the moment the person accepted (`connection_accepted`, inbound, empty body) in time order, an event before a message sent at the same instant. An email thread ignores it, and a failed read of the events returns the messages alone.
+
 - API: `GET /v1/threads/{threadId}/messages`
 - Generated from the API contract
 
 | Flag | Type | Required | Description |
 | --- | --- | --- | --- |
 | `--thread-id` | string | yes | threadId (path, string) |
+| `--include-events` | boolean | no | includeEvents (query, boolean) |
+| `--no-include-events` | boolean | no | Send includeEvents as false. |
 | `--each` | string | no | Run once per row of a JSONL or CSV file (- for stdin); row keys fill params and body by name. |
 | `--concurrency` | integer | no | With --each: requests in flight at once (1-16, default 4). |
 
@@ -27686,7 +27843,7 @@ kenso threads suggest --thread-id <thread-id> --data @body.json
 
 Update thread fields. Absent fields stay unchanged. Null `reminderAt` clears a reminder.
 
-Requires `InboxReplyAccess`, matching inbox triage. The thread comes back with `hasDraft` and `draftAuthor`, as threads.get serves them; `accountId`, `replyTouchId` and `scheduledMessages` are left out (DEV-2537).
+Requires Inbox edit. The thread comes back with `hasDraft` and `draftAuthor`, as threads.get serves them; `accountId`, `replyTouchId` and `scheduledMessages` are left out (DEV-2537). `personId` (a positive integer) links the thread's contact to that person, replacing any link; a merged person links as its survivor. It needs the `unified_inbox` feature for the workspace (off is `404 not_found`) and Accounts edit (without it, `403 permission_denied`). No contact is `422 unprocessable` and a person not in the workspace (or deleted) is `404 not_found`. Each of these answers before any field is written; the link is written after the other fields, so a refused field leaves no link (DEV-7255). Bulk update refuses `personId`.
 
 - API: `PATCH /v1/threads/{threadId}`
 - Generated from the API contract
@@ -28137,7 +28294,7 @@ kenso touches update --touch-id <touch-id> --data @body.json
 
 Create a tracking link on a campaign in the current workspace.
 
-Returns `201` and `Location`. Requires `WriteAccess`.
+Returns `201` and `Location`. Requires Delivery edit.
 
 - API: `POST /v1/campaigns/{campaignId}/tracking-links`
 - Generated from the API contract
@@ -28181,7 +28338,7 @@ kenso tracking-links delete --tracking-link-id <tracking-link-id>
 
 Return one tracking link in the current workspace.
 
-A missing or cross-workspace id is `not_found`. Requires `ReadAccess`.
+A missing or cross-workspace id is `not_found`. Requires Delivery view.
 
 - API: `GET /v1/tracking-links/{trackingLinkId}`
 - Generated from the API contract
@@ -28200,7 +28357,7 @@ kenso tracking-links get --tracking-link-id <tracking-link-id>
 
 List a campaign's tracking links in the current workspace.
 
-Ordered by id. Read-only. Requires `ReadAccess`.
+Ordered by id. Read-only. Requires Delivery view.
 
 - API: `GET /v1/campaigns/{campaignId}/tracking-links` (a list: `--limit`, `--cursor`, `--all`)
 - Generated from the API contract
@@ -28223,7 +28380,7 @@ kenso tracking-links list --campaign-id <campaign-id> --all
 
 Update a tracking link.
 
-Absent fields stay unchanged. JSON null clears `textValue`. Requires `WriteAccess`. A new `domainName` goes through the URL reputation check, and changing it after mail with the link went out counts against a daily cap (`429 rate_limited` with `Retry-After` once `UrlReputation:Mode` is `Enforce`). A new `domainName` on a link served from a Kenso shared tracking host is `409 shared_host_link_frozen`, and off a paid plan `402 plan_limit_reached` (`refusal.code``link_edit_requires_paid_plan`), when `Redirects:LinkEdits:Mode` is Enforce (DEV-3690).
+Absent fields stay unchanged. JSON null clears `textValue`. Requires Delivery edit. A new `domainName` goes through the URL reputation check, and changing it after mail with the link went out counts against a daily cap (`429 rate_limited` with `Retry-After` while Kenso enforces the URL reputation check). A new `domainName` on a link served from a Kenso shared tracking host is `409 shared_host_link_frozen`, and off a paid plan `402 plan_limit_reached` (`refusal.code``link_edit_requires_paid_plan`), while Kenso enforces its link edit rules (DEV-3690).
 
 - API: `PATCH /v1/tracking-links/{trackingLinkId}`
 - Generated from the API contract
@@ -28564,7 +28721,7 @@ kenso triggers update --trigger-id <trigger-id> --data @body.json
 
 Reserve one support-agent turn against the per-user and per-workspace monthly quotas.
 
-Replaces `POST /v1/support-chat/turns`. A quota refusal is `429` and includes the legacy `quotaResetAt`. Requires `ReadAccess`.
+Replaces `POST /v1/support-chat/turns`. A quota refusal is `429` and includes the legacy `quotaResetAt`. Requires the `ask` permission.
 
 - API: `POST /v1/support/turns`
 - Generated from the API contract
@@ -28883,7 +29040,7 @@ kenso video-provider-connections verify --connection-id <connection-id>
 
 Upgrade to a WebSocket and relay PCM16 audio to Deepgram Nova 3.
 
-Replaces `GET /v1/support-chat/voice`. Browser sockets cannot set headers, so they pass a `ticket` from `POST /v1/support/voice/tickets`. Until the browser moves to tickets, `access_token`, `ken_version=1.1`, and `workspace_id` still work. Requires `ReadAccess`.
+Replaces `GET /v1/support-chat/voice`. Browser sockets cannot set headers, so they pass a `ticket` from `POST /v1/support/voice/tickets`. Until the browser moves to tickets, `access_token`, `ken_version=1.1`, and `workspace_id` still work. Requires the `ask` permission.
 
 - API: `GET /v1/support/voice`
 - Generated from the API contract
@@ -28951,7 +29108,7 @@ kenso voice-notes audio --voice-note-id <voice-note-id>
 
 Mint a single-use ticket that opens the voice WebSocket.
 
-A browser socket cannot send headers, so it opens `GET /v1/support/voice?ticket=` instead of putting the dashboard token in the URL. The ticket carries this request's `Authorization`, workspace and version, opens one socket and expires after 60 seconds. No MCP tool: only a browser socket uses it. Requires `ReadAccess`.
+A browser socket cannot send headers, so it opens `GET /v1/support/voice?ticket=` instead of putting the dashboard token in the URL. The ticket carries this request's `Authorization`, workspace and version, opens one socket and expires after 60 seconds. No MCP tool: only a browser socket uses it. Requires the `ask` permission.
 
 - API: `POST /v1/support/voice/tickets`
 - Generated from the API contract
@@ -31380,7 +31537,7 @@ kenso workspaces clear-reply-to --workspace-id <workspace-id>
 
 Create a workspace for the caller.
 
-Replaces `POST /v1/workspaces/setup`. Idempotent: an existing workspace is returned with 200. A new workspace is 201. Requires `ReadAccess` because first-workspace setup is not limited to existing admins. An API key with the staff-issued scope `workspaces:provision` (a service key, DEV-1555) gets a new workspace on every call instead, with Free billing and the Kenso team as admins, and the key's owner becomes its admin. Not idempotent for such a key. The key reaches only the workspaces it is a member of.
+Replaces `POST /v1/workspaces/setup`. Idempotent: an existing workspace is returned with 200. A new workspace is 201. Open to any signed-in caller because first-workspace setup is not limited to existing admins. An API key with the staff-issued scope `workspaces:provision` (a service key, DEV-1555) gets a new workspace on every call instead, with Free billing and the Kenso team as admins, and the key's owner becomes its admin. Not idempotent for such a key. The key reaches only the workspaces it is a member of. A caller who holds no workspace and signed in with a personal, relay, agent or disposable address gets 403 `work_email_required` (DEV-7602), unless the caller is staff, signed in with LinkedIn or AgentID, or through an Auth0 organization (an accepted invitation). The rule does not apply to an API key.
 
 - API: `POST /v1/workspaces`
 - Generated from the API contract
@@ -31480,7 +31637,7 @@ kenso workspaces delete-wordmark --workspace-id <workspace-id>
 
 Return one workspace.
 
-Replaces `GET /v1/clients/{id}` and `GET /v1/workspaces/{id}/company`. Non-members receive 403. Requires `ReadAccess`.
+Replaces `GET /v1/clients/{id}` and `GET /v1/workspaces/{id}/company`. Non-members receive 403. Open to any workspace member.
 
 - API: `GET /v1/workspaces/{workspaceId}`
 - Generated from the API contract
@@ -31516,7 +31673,7 @@ kenso workspaces get-tracking --workspace-id <workspace-id>
 
 List the caller's workspaces.
 
-Replaces `GET /v1/workspaces/me`, `GET /v1/workspaces/search`, and `GET /v1/clients` for the caller's own memberships. Ordered by id. `q` matches the workspace name. Requires `ReadAccess`.
+Replaces `GET /v1/workspaces/me`, `GET /v1/workspaces/search`, and `GET /v1/clients` for the caller's own memberships. Ordered by id. `q` matches the workspace name. Open to any signed-in caller.
 
 - API: `GET /v1/workspaces` (a list: `--limit`, `--cursor`, `--all`)
 - Generated from the API contract