Applications API

Applications, their environments, allowed websites, and recommendations.

📄️List applications

Returns only applications the caller can access through ownership, direct membership, or team membership. Non-admin callers always get `ACTIVE` applications, admins can request `ARCHIVED` via `status`. All filters combine with AND. Pass `responseShape=summary` for a lean, cursor-paginated envelope (stable identity fields only) instead of the default full array; use `limit` and `cursor` to page through it.

📄️Create application

Creates the application owned by the caller and adds the caller as an active `ADMIN` member. Requires company-level permission to write applications.

📄️Get application

Returns one application in the same item shape as the `GET /api/applications/` list. The persona and tone of voice configuration, when set, is included under `metadata.settings.persona`.

📄️Update application

Updates one or more of the application name, description, group, capability settings (`settings.codeExecutionEnabled`, `settings.codeExecutionOutputRetrievable`, `settings.skillsEnabled`), and the persona and tone of voice (`settings.persona`: a preset, six voice trait levels, and free-text voice notes; `null` or the `neutral` preset clears it). Omitted fields are preserved. Requires write access.

📄️Link collection to application

Grants the application access to the collection, so its agents can search and read the documents inside. The caller needs write access to the application and access to the collection.

📄️Set file sharing for linked collection

Controls whether the application's assistant may send the collection's documents to end users as files. File sharing is off by default and the collection must already be linked to the application. An application's own collection is rejected: its documents are always shareable. The caller needs write access to the application and access to the collection.

📄️Unlink collection from application

Removes the application's access to the collection. The collection and its documents stay untouched. A collection owned by the application itself cannot be unlinked.

📄️List selectable application skills

Lists the skills the company allows, each with its selection state for this application.

📄️Select skill

Makes the skill available to the application's agents.

📄️Deselect skill

Removes the skill from the application's agents.

📄️List MCP servers selectable by application

Lists the MCP server connections in the workspace, each with its selection state for this application.

📄️Enable MCP server

Lets the application's agents call the MCP server's tools.

📄️Disable MCP server

Stops the application's agents from calling the MCP server's tools.

📄️List environments

Environments are named sets of key-value variables that agents resolve through `{{env.*}}` placeholders at run time. Values are stored encrypted. Callers with write access to the application get them decrypted; read-only callers get the variable names with every value replaced by a fixed mask.

📄️Create environment

Environment names are unique per application, compared case-insensitively. Variables are encrypted before storage. Requires write access to the application.

📄️Update application environment (deprecated shape)

Deprecated: use `PUT /api/v1/applications/{id}/environments/{environmentId}/`, which addresses the environment in the path instead of the `environmentId` body field. This variant behaves identically. Provide `name`, `variables`, or both. A provided `variables` map replaces every existing variable.

📄️Delete application environment (deprecated shape)

Deprecated: use `DELETE /api/v1/applications/{id}/environments/{environmentId}/`, which addresses the environment in the path instead of a required request body — a shape several HTTP clients cannot send. This variant behaves identically. Agents that still reference the deleted environment resolve their `{{env.*}}` placeholders to empty values.

📄️Update environment

Provide `name`, `variables`, or both. A provided `variables` map replaces every existing variable. Requires write access to the application.

📄️Delete environment

Agents that still reference the deleted environment resolve their `{{env.*}}` placeholders to empty values. Requires write access to the application.

📄️List application's message templates

Returns every WhatsApp message template registered in the send-side catalog for this application, with placeholders derived from both the definition and the rendered text preview.

📄️Register message template

Validates the pasted `definition` (a WhatsApp send payload or bare template object) and upserts it into the send-side catalog, scoped to `channel: 'whatsapp'`. `name` and `language` are derived from the definition, not accepted separately. Re-registering an existing name replaces its definition and implicitly re-enables it. Requires write access to the application.

📄️Enable or disable message template

Flips whether the template can be used to send messages, without touching its stored definition. Requires write access to the application.

📄️Delete message template

Permanently removes the template definition from the send-side catalog. Requires write access to the application.

📄️List allowed websites

Merges the company-level website records with the per-application link, so each row carries the global configuration plus an `enabledForApplication` toggle. Stored passwords are reported through `hasStoredPassword` and the ciphertext is never returned.

📄️Create allowed website

Creates a company-level allowed website and links it to the application in one call. A plain-text `password` is encrypted before storage. Use `PATCH /api/v1/applications/{id}/allowed-websites/{siteId}/` to toggle the per-application link later.

📄️Get allowed website

The response replaces stored credentials with a `hasStoredPassword` boolean. The password ciphertext is never returned.

📄️Update allowed website

Most fields update the company-level record shared by every application, while `enabledForApplication` toggles only the link to this application. `password: null` clears the stored credentials, omitting the field keeps them.

📄️Delete allowed website

Deletes the company-level record, which removes the website from every application it is linked to, not just the one in the path.

📄️List threads

`limit` is clamped to 100. `threadGroupId` switches to a compact playground-history shape. `format=preview` strips full message content down to a display preview.

📄️Reset browser context

Discards the stored persistent browser context id, the shared browser profile that carries cookies and auth tokens across `ADVANCED` browser runs, so the next run mints a fresh context and logs in from scratch. Use it when cookies persisted by a failed or expired login break subsequent logins. Idempotent, requires write access to the application.

📄️List pending OAuth connections

Checks the OAuth MCP servers enabled on the application and returns the ones that block the assistant for the calling user, that is servers with a `not_connected` or `expired` connection. Each entry carries a `settingsPath` pointing to the page where the connection can be completed. Connected and expiring-soon servers are excluded.

📄️List recommendations

Returns the recommendation configurations of the application plus pagination metadata (`total`, `page`, `limit`, `totalPages`). Defaults to page 1 with 10 items, sorted by `createdAt` descending.

📄️Create recommendation

Registers a recommendation that finds documents similar to the seed `inputs`. A scheduler job recalculates it on `updateFrequencyCron`, hourly by default. Use `POST /api/v1/applications/{id}/recommendations/{recommendationId}/trigger/` to run it immediately.