Skip to main content
POST
Assign agent tool

Authorizations

Authorization
string
header
required

Clerk session JWT (deployments with Clerk auth) — validated per request (issuer + signature + lifetime + authorized-party). The internal Boardy tenant/member are resolved from the token's ACTIVE Clerk organization (org_id) → the Boardy tenant it maps to → this user's member in that tenant (#356). A token with no active organization is rejected; production never trusts spoofable X-Tenant-Id/X-Member-Id headers. The same normalized context backs the SPA, this OpenAPI surface, and MCP.

Headers

Idempotency-Key
string

AD-5 idempotency: a repeated mutation with the same key replays the prior result (no double-apply).

Path Parameters

agentId
string<uuid>
required

Body

application/json
toolId
null | string
required
allowedActions
null | string[]
required
scope
null | string
required
scopeId
null | string<uuid>
required
approvalRequired
null | boolean
required

Response

Created

id
string<uuid>
required
tenantId
string<uuid>
required
agentMemberId
string<uuid>
required
toolId
string
required
allowedActions
string[]
required
scope
enum<string>
required
Available options:
Workspace,
Board,
Resource
scopeId
null | string<uuid>
required
approvalRequired
boolean
required
enabled
boolean
required
dangerous
boolean