getstackrun

Record an operator decision on a flagged Passport checkout. approved clears the flag; blocked stops future Passport issuance to the agent. A block applies immediately. An approval from an MCP or API-key session requires human approval. Returns GOVERNANCE_APPROVAL_REQUIRED with approval_id and approval_url when human approval is required. The same payload sent with governance_approval_id after approval applies the change. An approval is single-use, bound to the exact payload, and expires after 15 minutes.

stack_decide_review

Delete a notification delivery method and remove it from the notification rules that reference it. Calls from MCP and API-key sessions require human approval. Returns GOVERNANCE_APPROVAL_REQUIRED with approval_id and approval_url when human approval is required. The same payload sent with governance_approval_id after approval applies the change. An approval is single-use, bound to the exact payload, and expires after 15 minutes.

stack_delete_delivery_method

Delete a notification rule. Calls from MCP and API-key sessions require human approval. Returns GOVERNANCE_APPROVAL_REQUIRED with approval_id and approval_url when human approval is required. The same payload sent with governance_approval_id after approval applies the change. An approval is single-use, bound to the exact payload, and expires after 15 minutes.

stack_delete_notification_rule

Deposit a package into a drop-off. The payload is validated against the drop-off's schema and encrypted at rest.

stack_deposit

Remove a skill from an agent's allowed_skills list. Removing a skill that is not on the list succeeds without change.

stack_disallow_skill

Disconnect a service connection by its id (scon_*). Deletes the stored credential and revokes the active Passports of agents that had grants to this connection. Connection ids come from stack_list_connected_services.

stack_disconnect_service

Expire a drop-off now and delete its package.

stack_expire_dropoff

Create one portable Signed record for a Mission, session or period and return it. The immutable JSON snapshot contains the signed claims and verification material that exist at export time. Creating records requires the Enterprise plan.

stack_export_signed_record

List marketplace skills that match a skill request.

stack_find_matching_skills

Get one Connect-with-STACK grant by grant_id (pgr_*): status, scopes, allowed_providers and timestamps. The grant token is never returned.

stack_partner_get_connection

Get one Mission by id: lifecycle state (started_at, expires_at, completed_at, revoked_at, terminal_state), caps, cap_behavior overrides, intent_services, expected_counterparties and the latest claim_id. Missions belonging to another account return 404.

stack_get_mission

Get the account's PII redaction settings for the LLM gateway: confidence threshold and country scope. An account with no settings gets the built-in defaults with configured=false. Available on every plan.

stack_get_pii_config

Get the accountability report for a Passport: intent, checkpoints, checkout and review decision.

stack_get_passport_report

Get one Signed record receipt by id. The response includes the signed envelope bytes and parsed record claim.

stack_get_signed_record

Get the account usage, spend and earnings for a period. consumption.activity is every audit event in the window. consumption.actions is the metered subset against the monthly allowance. allowance_coverage says whether limit and allowance_tier are known for that exact UTC month. An old unknown month never borrows the current tier. detail_coverage says whether by_kind is complete, partial, or unavailable. Overage bills the wallet at $0.0001 per metered action. Reads, revocation, audit export, checkpoints, intent simulation, detector config, governance decisions, and configuration are not metered. For a white-label pool (a partner or one of its tenants) consumption.actions also carries pooled: true, and used is the whole pool the allowance applies to, own_used is the share of this account, and tenants is how many tenant accounts share it. Also returns seats, current-month pass-through allowances, account_since, unlimited inventory counts, retention, fair-use ceilings, actual STACK wallet spend, wallet balance, and publisher earnings. Provider cost estimates are not STACK spend. All money is in cents. The period defaults to the current billing period; since and until (ISO-8601 or unix-ms) set another window.

stack_usage

Read the fleet policy an agent belongs to.

stack_get_fleet_membership

Get the service grants and scopes held by an agent.

stack_get_agent_permissions

Get the account's audit chain head: latest entry hash, total count and latest timestamp. A recorded head lets a third party later confirm, from an export, that no earlier entry was altered.

stack_audit_chain_head

Get the status of an Authority request. After approval the result includes the opaque binding reference. Identity-provider tokens and evidence are never returned.

stack_get_authority_request

Get the account's customization for one detector. Returns 404 when none exists, which means the detector runs on built-in defaults. Available on every plan.

stack_get_detector_config

Get the status, parties and expiry of a drop-off.

stack_get_dropoff_status

Read one fleet policy and its shared usage.

stack_get_fleet

Get the operator's identity security settings: claim TTL, claim inheritance mode (auto vs opt-in), and auto-revoke on expiry.

stack_get_identity_settings

Get one inbound webhook with its counters and signing_configured status. Signing is configured by an owner or admin through the REST API or SDK (https://getstack.run/docs/api/inbound-webhooks). Signing secrets are never returned.

stack_get_inbound_webhook

Get one intent approval by id. Returns the approval with its status: pending, approved, rejected, expired or consumed. Approvals belonging to another account return 404.

stack_get_intent_approval

Get one white-label tenant by operator_id. Returns its metadata, status, billing: 'partner', and month-to-date usage (its share of your pooled action allowance). Never returns tenant audit content or API keys.

stack_partner_get_tenant

Get the account's proxy usage and remaining quota for the current month.

stack_proxy_usage

Get the account's content-scan usage and remaining quota for the current month.

stack_scan_usage

Get one security event by id with its full metadata: signal type, severity, the agent and Passport it fired on, and detector context.

stack_get_security_event

Get one marketplace skill, including its input and output schemas, trust requirement and execution mode.

stack_get_skill

Create or replace an agent's grant on a service connection. A new grant, or any expansion of scopes, constraints or data-flow authority, requires human approval. Returns GOVERNANCE_APPROVAL_REQUIRED with approval_id and approval_url when human approval is required. The same payload sent with governance_approval_id after approval applies the change. An approval is single-use, bound to the exact payload, and expires after 15 minutes. Pure narrowing applies immediately. Active Passports are checked against the current grant on their next STACK verification. The named-intent catalog is returned by stack_list_intents.

stack_grant_agent_access

List every Connect-with-STACK grant the partner account holds, in all statuses. Grant tokens are never returned.

stack_partner_list_connections

List per-call LLM usage records for the customer-key gateway and STACK-key product calls. Each row names the product surface, provider payer, STACK-fee payer, model, tokens, provider cost, STACK fee, total cost, wallet hold, streaming flag, and mission binding. Cursor-paginated, newest first. Returns only the calling account's records.

stack_llm_usage_list

List the signed Operator review revisions of a Mission, including older dossier claims. Returns an empty array when no review exists.

stack_list_mission_operator_reviews

List the account's Missions, newest first by started_at, optionally filtered by status (active, completed, revoked) and paginated with page and limit.

stack_list_missions

List the account's Signed records, newest first, optionally filtered by scope as <kind>:<ref>.

stack_list_signed_records

List active (unexpired, unrevoked) Passports, optionally filtered by agent or session.

stack_list_active_passports

List the registered agents of the account.

stack_list_agents

List the account's recent audit log entries, newest first. agent_id and passport_jti narrow the list to one agent or Passport; since (epoch ms) returns only newer entries. Each entry has layer, action, outcome, duration_ms, error_code, error_message and the hash-chain fields entry_hash and prev_entry_hash. A cascade revoke appears as one passport.revoke entry plus one passport.revoke_cascade entry per child.

stack_audit_list

List the account's service connections with each connection's id, provider, status and stored scopes. An agent grant's scopes must be a subset of the connection's stored scopes; a connection with scopes ['*'] permits any child scope.

stack_list_connected_services