Create Tool

POST /tools

422 on a builtin slug collision, and on a code_exec config carrying code/script/source.

Role floor

Requires member or above. The floor is a minimum, not a grant: scope filtering still applies on top of it, and a resource in another tenant answers 404 rather than 403.

Request body — ToolCreate

Field	Type		Notes
slug	string	required	—
kind	http | remote_protocol | builtin | code_exec | web_search | web_fetch | delegate | schedule	required	—
description	string	required	—
scope	workspace | organization | platform | null	optional	—
display_name	string | null	optional	max length 200
input_schema	object	optional	—
config	object	optional	—
secrets_required	string[]	optional	—
concurrency	read | write | exclusive	optional	Default "read".
effect	read | write	optional	Default "write".
critical	boolean	optional	Default false.
client_owned	boolean	optional	Default false.
response_max_chars	integer	optional	Default 100000. min 1
timeout_s	integer	optional	Default 120. min 1 max 3600
is_active	boolean	optional	Default true.

Responses

Status	Description	Body
201	Successful Response	ToolView
422	Validation Error	HTTPValidationError

Only the success paths are declared

Any operation may also answer any status in the error catalogue, and every failure body is the platform envelope — including the 422 this document types as HTTPValidationError.

Example

The body shows the fields the schema always carries. Which combination is legal is a service rule the schema cannot express, so read the description above before copying this.

curl -X POST https://your-deployment.example.com/tools \
  -H "Authorization: Bearer $COBRE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
       "slug": "string",
       "kind": "http",
       "description": "string"
     }'

Response — ToolView

Field	Type		Notes
id	string (uuid)	required	—
scope	workspace | organization | platform	required	—
organization_id	string (uuid) | null	required, nullable	—
workspace_id	string (uuid) | null	required, nullable	—
slug	string	required	—
kind	http | remote_protocol | builtin | code_exec | web_search | web_fetch | delegate | schedule	required	—
display_name	string | null	required, nullable	—
description	string	required	—
input_schema	object	required	—
config	object	required	—
secrets_required	string[]	required	—
concurrency	read | write | exclusive	required	—
effect	read | write	required	—
critical	boolean	required	—
client_owned	boolean	required	—
response_max_chars	integer	required	—
timeout_s	integer	required	—
is_active	boolean	required	—
created_at	string (date-time)	required	—
updated_at	string (date-time)	required	—