Grant a workspace capacity for more hosted gateways (fleet operator)
The fleet operator, with their own Microsoft Entra token (GatewayOperations.py limit), sets how many hosted gateways the workspace may hold, from 1 to 10. Core locks the workspace, refuses a limit below the gateways it already holds, and records the verified operator and the reason in hosted_gateway.limit.changed. It changes neither billing nor any customer consent, and accepts no operator identity, plan or workspace key from the body. Twenty calls per hour per operator.
Authorization
OperatorEntraAuth A fleet operator's Microsoft Entra v2 access token for the
"Decionis Operator API" app registration (Application ID URI
api://decionis-operator), as az account get-access-token --scope api://decionis-operator/Operator.Act returns it: issuer
https://login.microsoftonline.com//v2.0, audience the app's
client id, scp holding Operator.Act, roles holding
HostedGateway.Operator (or DECIONIS_OPERATOR_ENTRA_ROLE), and azp
Azure CLI (04b07795-8ddb-461a-bbee-02f9e1bf7b46) or a client
DECIONIS_OPERATOR_ENTRA_CLIENT_APPS names (403
OPERATOR_CLIENT_NOT_ALLOWED otherwise), verified against the tenant's
JWKS. The app registration should make Operator.Act admin-consent
only and require assignment on its enterprise application.
In: header
Path Parameters
The workspace (organization) id.
uuidRequest Body
application/json
1 <= value <= 10Why the capacity is granted; recorded with the operator's verified identity.
10 <= length <= 500Response Body
application/json
curl -X POST "https://example.com/v1/hosted-gateway/workspaces/497f6eca-6276-4993-bfeb-53cbbbba6f08/deployment-limit" \ -H "Content-Type: application/json" \ -d '{ "limit": 1, "reason": "stringstri" }'{ "org_id": "a40f5d1f-d889-42e9-94ea-b9b33585fc6b", "deployment_limit": 1}Revoke a workspace's contracted hosted-enforcement permission POST
Withdraws the exact grant and retires only its provenance-bound keys, including delivered predecessors. In one audited transaction it invalidates dependent provisioning generations and leases and marks readiness blocked. It preserves requested/fleet modes, custody and history; it does not switch to SHADOW, remove a hostname, call the fleet or cancel in-flight actions. Withdrawal remains available with inactive billing. A later regrant needs new customer approval and a new key. An old revoke never withdraws a newer grant. JSON only, bounded to 4096 bytes, ten requests per minute per address and twenty per hour per verified operator through the existing shared start limit. Every response is no-store. The request UUID binds action, org, grant where applicable, verified operator oid/tenant and normalized body. Exact retries return the original identity and audit references; rebinding returns 409. Operator identity, capability, credentials, consent, beta, billing changes and other extra fields are refused. Reasons and agreement references appear only in the transactional operator audit.
Start a hosted gateway sign-on for a paying tenant (fleet operator) POST
Device-authorization grant (RFC 8628 shaped) by which a paying tenant of the AgentSafe hosted gateway fleet receives its workspace key without anyone copying one. The fleet operator (Tenant.py) starts it with a Microsoft Entra access token for `api://decionis-operator/Operator.Act` whose `roles` holds the operator role; who asked (`oid`, sign-in name) is recorded from the verified token, never from the body, and a body naming a requester is refused. The customer then approves at `verification_uri_complete` while signed in to Decionis as `owner_email` by a sign-in that proved that address, ADMIN or above in a workspace on a paid plan with an active entitlement, and the operator polls the token endpoint. Codes live 30 minutes; poll every `interval` seconds. Twenty starts per hour per operator. Without Entra configuration (DECIONIS_OPERATOR_ENTRA_TENANT_ID, DECIONIS_OPERATOR_ENTRA_CLIENT_ID, and a well-formed DECIONIS_OPERATOR_ENTRA_CLIENT_APPS when set) every call answers 503 OPERATOR_AUTH_NOT_CONFIGURED.