@intutic/clawde / ControlPlaneClient

Class: ControlPlaneClient

Control-plane management client — org/team/gateway/credentials administration, as distinct from ClawdeClient's data-plane chat calls.

Deliberately a separate class, not new methods on ClawdeClient: ClawdeClient.baseUrl targets the proxy (default http://localhost:4000); the control plane is a different origin entirely (default Intutic's hosted control plane, or a self-hosted CONTROL_PLANE_URL). Bolting management calls onto ClawdeClient would silently need a second base URL on a class whose whole contract today is "one client, one proxy."

Every endpoint here comes from the control-plane calls in tools/cli/src/commands/* — the CLI's own already-tested contracts, not re-derived — and the Python SDK's control_plane.py has the same methods in snake_case. packages/shared-types/fixtures/control-plane-operations.json lists every method with the request it makes and the answer it returns, and both SDKs' tests run against it, so neither can grow a method the other lacks. Method names follow one pattern for whatever is added next: a verb (list, get, create, update, delete, rotate…Secret, download, or the CLI subcommand's own verb, such as approve or promote), then the resource.

Not included: session establishment (login/logout; an SDK caller supplies apiKey directly, and ClawdeClient registers its own session), the CLI's workspace budget (ClawdeClient.checkBudget()), and commands that act on the machine they run on: init, setup, doctor, install-daemon, connect, disconnect, exec, start, syncContext, rollback, enforce, rules, judge, skill (its loop commands are here), sops status, guardrails pull, and policy compile|install|snapshot|list-local.

Works unmodified against a self-hosted control plane — there is no SaaS-vs-self-hosted branch anywhere in this file. An open-core user who runs the proxy standalone with no control plane configured simply never constructs this class (or does, points it at nothing, and gets a ClawdeConnectionError on the first call) — the same framing whoami.ts already uses: "This command needs an Intutic control plane, which open core does not include."

Auth: the same apiKey type ClawdeClient accepts — a vk_ token or a JWT both satisfy services/control-plane/src/middleware/auth.ts, which resolves either to an AuthContext with a role. A call the role may not make throws ClawdeConnectionError with the control plane's answer; for a 403 that names the roles allowed (detail), the message is that sentence, as the CLI prints it.

Constructors

Constructor

new ControlPlaneClient(options): ControlPlaneClient;

Parameters

Parameter	Type
`options`	`ControlPlaneClientOptions`

Returns

ControlPlaneClient

Methods

addPolicySource()

addPolicySource(source): Promise<PolicySource>;

POST /api/v1/connectors

Parameters

Parameter	Type
`source`	`PolicySourceInput`

Returns

Promise<PolicySource>

adjudicateFinding()

adjudicateFinding(
   findingId, 
   outcome, 
   options?
): Promise<FindingAdjudication>;

POST /api/v1/findings/:findingId/adjudicate — the ruling is recorded under the key's member.

Parameters

Parameter	Type
`findingId`	`string`
`outcome`	`FindingOutcome`
`options`	`AdjudicateOptions`

Returns

Promise<FindingAdjudication>

approveDecision()

approveDecision(holdId, options?): Promise<DecisionReviewResult>;

POST /api/v1/decisions/:holdId/review (OWNER, ADMIN, EM) — approve a held call.

Parameters

Parameter	Type
`holdId`	`string`
`options`	`ReviewOptions`

Returns

Promise<DecisionReviewResult>

approveGuardrailShadow()

approveGuardrailShadow(guardrailId): Promise<GuardrailTransitionResult>;

POST …/guardrails/:guardrailId/approve-shadow — into SHADOW: distributed as warn, measuring, enforcing nothing.

Parameters

Parameter	Type
`guardrailId`	`string`

Returns

Promise<GuardrailTransitionResult>

approveLoopRun()

approveLoopRun(loopRunId, options?): Promise<LoopRunActionResult>;

POST /api/v1/loops/:loopRunId/review (OWNER, ADMIN, EM) — approve a run held for review; it is ACTIVE again.

Parameters

Parameter	Type
`loopRunId`	`string`
`options`	`LoopRunReviewOptions`

Returns

Promise<LoopRunActionResult>

approveMcpServer()

approveMcpServer(serverId): Promise<McpServerDecision>;

POST /api/v1/mcp/servers/:serverId/status — approve a server (OWNER, ADMIN).

Parameters

Parameter	Type
`serverId`	`string`

Returns

Promise<McpServerDecision>

assignOrgGateway()

assignOrgGateway(orgId, gatewayId): Promise<{
  gatewayId: string | null;
}>;

PATCH /api/v1/orgs/:orgId/gateway — pass null to clear the org default.

Parameters

Parameter	Type
`orgId`	`string`
`gatewayId`	`string` \| `null`

Returns

Promise<{ gatewayId: string | null; }>

assignWorkspaceGateway()

assignWorkspaceGateway(gatewayId): Promise<{
  gatewayId: string | null;
}>;

PATCH /api/v1/workspace/gateway — pass null to clear the override.

Parameters

Parameter	Type
`gatewayId`	`string` \| `null`

Returns

Promise<{ gatewayId: string | null; }>

attenuateKey()

attenuateKey(
   parentKeyId, 
   requestedCaps, 
   options?
): Promise<AttenuationResult>;

POST /api/v1/attenuate — a child of one of your keys with narrower scopes: each of requestedCaps is an API key scope (gateway:use, traces:read, …) the parent grants. The child key is in the response once and never stored.

Parameters

Parameter	Type
`parentKeyId`	`string`
`requestedCaps`	`string`[]
`options`	`AttenuateOptions`

Returns

Promise<AttenuationResult>

blockMcpServer()

blockMcpServer(serverId): Promise<McpServerDecision>;

POST /api/v1/mcp/servers/:serverId/status — block a server (OWNER, ADMIN).

Parameters

Parameter	Type
`serverId`	`string`

Returns

Promise<McpServerDecision>

checkDomainVerification()

checkDomainVerification(verificationId): Promise<CheckDomainVerificationResult>;

GET /api/v1/domain-verification/:id — re-checks DNS for the TXT record. Safe to call repeatedly; performs a fresh lookup every call.

Parameters

Parameter	Type
`verificationId`	`string`

Returns

Promise<CheckDomainVerificationResult>

collectEvidence()

collectEvidence(options?): Promise<EvidenceCollectResult>;

POST /api/v1/compliance/soc2-collect (OWNER, ADMIN) — run a fresh evidence collection and seal it.

Parameters

Parameter	Type
`options`	`EvidenceCollectOptions`

Returns

Promise<EvidenceCollectResult>

completeLoopRun()

completeLoopRun(loopRunId, options?): Promise<LoopRunActionResult>;

POST /api/v1/loops/:loopRunId/complete — outcome records how the run ended.

Parameters

Parameter	Type
`loopRunId`	`string`
`options`	`CompleteLoopRunOptions`

Returns

Promise<LoopRunActionResult>

createGuardrail()

createGuardrail(guardrail): Promise<AuthoredGuardrailWriteResult>;

POST /api/v1/policy-guardrails/guardrails (OWNER, ADMIN) — an authored guardrail, created PROPOSED. An IR a check refuses is a 400 naming the check.

Parameters

Parameter	Type
`guardrail`	`AuthoredGuardrailInput`

Returns

Promise<AuthoredGuardrailWriteResult>

createNotificationRule()

createNotificationRule(rule): Promise<NotificationRule>;

POST /api/v1/notifications/rules. A webhook rule comes back with its signingSecret, which is not shown again.

Parameters

Parameter	Type
`rule`	`NotificationRuleInput`

Returns

Promise<NotificationRule>

createOrg()

createOrg(params): Promise<CreateOrgResult>;

POST /api/v1/orgs — creates a real org from an already-authenticated caller. Requires a verified, unconsumed domain verification (see startDomainVerification); the verification is consumed atomically inside the org-insert transaction, so it backs exactly this one org.

Parameters

Parameter	Type
`params`	`CreateOrgParams`

Returns

Promise<CreateOrgResult>

createOrgSop()

createOrgSop(sop): Promise<OrgSop>;

POST /api/v1/workspace/org-sops — a mandatory org-wide floor (OWNER, ADMIN of a workspace in the org).

Parameters

Parameter	Type
`sop`	`OrgSopInput`

Returns

Promise<OrgSop>

createSiemDestination()

createSiemDestination(destination): Promise<SiemDestination>;

POST /api/v1/siem/destinations (OWNER, ADMIN). The control plane refuses a destination that points at an internal address. A webhook destination comes back with its signingSecret, which is not shown again.

Parameters

Parameter	Type
`destination`	`SiemDestinationInput`

Returns

Promise<SiemDestination>

createSop()

createSop(sop): Promise<SopCreateResult>;

POST /api/v1/sops — one workspace SOP; markdown_content without front matter.

Parameters

Parameter	Type
`sop`	`SopInput`

Returns

Promise<SopCreateResult>

createTeam()

createTeam(orgId, name): Promise<Pick<Team, "name" | "orgId" | "teamId">>;

POST /api/v1/orgs/:orgId/teams

Parameters

Parameter	Type
`orgId`	`string`
`name`	`string`

Returns

Promise<Pick<Team, "name" | "orgId" | "teamId">>

createWorkspace()

createWorkspace(teamId, name): Promise<Pick<Workspace, "name" | "workspaceId"> & object>;

POST /api/v1/teams/:teamId/workspaces

Parameters

Parameter	Type
`teamId`	`string`
`name`	`string`

Returns

Promise<Pick<Workspace, "name" | "workspaceId"> & object>

deleteGuardrail()

deleteGuardrail(guardrailId): Promise<GuardrailDeleteResult>;

DELETE /api/v1/policy-guardrails/guardrails/:guardrailId (OWNER, ADMIN) — retires it; its history is kept.

Parameters

Parameter	Type
`guardrailId`	`string`

Returns

Promise<GuardrailDeleteResult>

deleteNotificationRule()

deleteNotificationRule(ruleId): Promise<void>;

DELETE /api/v1/notifications/rules/:ruleId

Parameters

Parameter	Type
`ruleId`	`string`

Returns

Promise<void>

deleteOrgSop()

deleteOrgSop(orgSopId): Promise<void>;

DELETE /api/v1/workspace/org-sops/:orgSopId — answers 404 both for no such SOP and for a member without admin access.

Parameters

Parameter	Type
`orgSopId`	`string`

Returns

Promise<void>

deleteSiemDestination()

deleteSiemDestination(destinationId): Promise<void>;

DELETE /api/v1/siem/destinations/:destinationId (OWNER, ADMIN) — deactivates it; updateSiemDestination(id, { isActive: true }) turns it back on.

Parameters

Parameter	Type
`destinationId`	`string`

Returns

Promise<void>

disableMcpTool()

disableMcpTool(serverId, tool): Promise<McpServerDecision>;

POST /api/v1/mcp/servers/:serverId/tools — switch one tool off (OWNER, ADMIN).

Parameters

Parameter	Type
`serverId`	`string`
`tool`	`string`

Returns

Promise<McpServerDecision>

downloadEvidence()

downloadEvidence(runId): Promise<Uint8Array<ArrayBufferLike>>;

GET /api/v1/compliance/soc2-export/:runId (OWNER, ADMIN) — a stored archive, as the file. Check it with verifyEvidenceArchive.

Parameters

Parameter	Type
`runId`	`string`

Returns

Promise<Uint8Array<ArrayBufferLike>>

downloadFrameworkCoverage()

downloadFrameworkCoverage(frameworkId, format): Promise<Uint8Array<ArrayBufferLike>>;

GET /api/v1/compliance/frameworks/:frameworkId/coverage?format= — the report as a file. Unsigned: the signed copies are the ones sealed in the evidence archive.

Parameters

Parameter	Type
`frameworkId`	`string`
`format`	`CoverageFormat`

Returns

Promise<Uint8Array<ArrayBufferLike>>

downloadInventoryHarnessesCsv()

downloadInventoryHarnessesCsv(filters?): Promise<Uint8Array<ArrayBufferLike>>;

GET /api/v1/inventory/harnesses?format=csv — the CSV the dashboard downloads.

Parameters

Parameter	Type
`filters`	`InventoryFilters`

Returns

Promise<Uint8Array<ArrayBufferLike>>

downloadInventoryMcpServersCsv()

downloadInventoryMcpServersCsv(filters?): Promise<Uint8Array<ArrayBufferLike>>;

GET /api/v1/inventory/mcp-servers?format=csv

Parameters

Parameter	Type
`filters`	`InventoryFilters`

Returns

Promise<Uint8Array<ArrayBufferLike>>

enableMcpTool()

enableMcpTool(serverId, tool): Promise<McpServerDecision>;

POST /api/v1/mcp/servers/:serverId/tools — switch one tool on (OWNER, ADMIN).

Parameters

Parameter	Type
`serverId`	`string`
`tool`	`string`

Returns

Promise<McpServerDecision>

extractPolicyDocument()

extractPolicyDocument(docId, options?): Promise<ExtractDocumentResult>;

POST /api/v1/policy-guardrails/documents/:docId/extract — propose guardrails from the document's clauses.

Parameters

Parameter	Type
`docId`	`string`
`options`	`ExtractOptions`

Returns

Promise<ExtractDocumentResult>

getAttenuationChain()

getAttenuationChain(chainId): Promise<AttenuationChainLink[]>;

GET /api/v1/attenuate/chain/:chainId (OWNER, ADMIN) — the delegation lineage.

Parameters

Parameter	Type
`chainId`	`string`

Returns

Promise<AttenuationChainLink[]>

getBranchUsage()

getBranchUsage(options?): Promise<BranchUsageResponse>;

GET /api/v1/usage/branches

Parameters

Parameter	Type
`options`	`UsageOptions`

Returns

Promise<BranchUsageResponse>

getCommitUsage()

getCommitUsage(options?): Promise<CommitUsageResponse>;

GET /api/v1/usage/commits

Parameters

Parameter	Type
`options`	`UsageOptions`

Returns

Promise<CommitUsageResponse>

getFindingStats()

getFindingStats(): Promise<FindingStats>;

GET /api/v1/findings/stats — false-positive rate per detector, over adjudicated findings.

Returns

Promise<FindingStats>

getFrameworkCoverage()

getFrameworkCoverage(frameworkId): Promise<FrameworkCoverage>;

GET /api/v1/compliance/frameworks/:frameworkId/coverage — eu_ai_act, iso_42001, nist_ai_rmf or mitre_atlas.

Parameters

Parameter	Type
`frameworkId`	`string`

Returns

Promise<FrameworkCoverage>

getGateLiveness()

getGateLiveness(): Promise<GateLiveness>;

GET /api/v1/governance/gate-liveness (OWNER, ADMIN, EM) — whether each installed harness's gate is reporting.

Returns

Promise<GateLiveness>

getGatewayConfig()

getGatewayConfig(gatewayId): Promise<GatewayConfigResult>;

GET /api/v1/gateways/:id/config — the flags set on the gateway and their version, as the gateway pulls them.

Parameters

Parameter	Type
`gatewayId`	`string`

Returns

Promise<GatewayConfigResult>

getGatewayStatus()

getGatewayStatus(gatewayId): Promise<GatewayStatus>;

GET /api/v1/gateways/:id/status

Parameters

Parameter	Type
`gatewayId`	`string`

Returns

Promise<GatewayStatus>

getGithubWebhook()

getGithubWebhook(): Promise<GitHubWebhookInfo>;

GET /api/v1/integrations/github/webhook (OWNER, ADMIN) — the payload URL; never the secret.

Returns

Promise<GitHubWebhookInfo>

getGuardrail()

getGuardrail(guardrailId): Promise<GuardrailDetail>;

GET /api/v1/policy-guardrails/guardrails/:guardrailId

Parameters

Parameter	Type
`guardrailId`	`string`

Returns

Promise<GuardrailDetail>

getGuardrailCoverage()

getGuardrailCoverage(token): Promise<TokenCoverage>;

GET /api/v1/policy-guardrails/coverage?token= — the passages that mention a tool or action, and the guardrails on them.

Parameters

Parameter	Type
`token`	`string`

Returns

Promise<TokenCoverage>

getGuardrailImpact()

getGuardrailImpact(seed): Promise<LedgerImpact>;

GET /api/v1/policy-guardrails/impact — what a change to a document or a passage reaches. Name one of them.

Parameters

Parameter	Type
`seed`	`GuardrailImpactSeed`

Returns

Promise<LedgerImpact>

getGuardrailReadiness()

getGuardrailReadiness(guardrailId): Promise<GuardrailReadiness>;

GET /api/v1/policy-guardrails/guardrails/:guardrailId/readiness — whether a SHADOW guardrail's evidence clears promotion.

Parameters

Parameter	Type
`guardrailId`	`string`

Returns

Promise<GuardrailReadiness>

getIncident()

getIncident(incidentId): Promise<Incident>;

GET /api/v1/incidents/:incidentId

Parameters

Parameter	Type
`incidentId`	`string`

Returns

Promise<Incident>

getIntegrityChain()

getIntegrityChain(): Promise<IntegrityChain>;

GET /api/v1/integrity/chain — the root chain walk; intact: false lists the breaks.

Returns

Promise<IntegrityChain>

getIntegrityConfigChain()

getIntegrityConfigChain(): Promise<ConfigChain>;

GET /api/v1/integrity/config-chain — the harness config snapshot chain walk.

Returns

Promise<ConfigChain>

getIntegrityRoot()

getIntegrityRoot(rootId): Promise<IntegrityRootDetail>;

GET /api/v1/integrity/roots/:rootId — the root, its signature and its leaves.

Parameters

Parameter	Type
`rootId`	`string`

Returns

Promise<IntegrityRootDetail>

getInventorySummary()

getInventorySummary(): Promise<InventorySummary>;

GET /api/v1/inventory/summary

Returns

Promise<InventorySummary>

getLoopRun()

getLoopRun(loopRunId): Promise<LoopRun>;

GET /api/v1/loops/:loopRunId

Parameters

Parameter	Type
`loopRunId`	`string`

Returns

Promise<LoopRun>

getMemberUsage()

getMemberUsage(options?): Promise<MemberUsageResponse>;

GET /api/v1/usage/members

Parameters

Parameter	Type
`options`	`UsageOptions`

Returns

Promise<MemberUsageResponse>

getMirrorAdoptionReport()

getMirrorAdoptionReport(candidateModel): Promise<MirrorAdoptionReport>;

GET /api/v1/routing/mirror-adoption-report — how a mirror-tested candidate model compared. Reported only; changes nothing.

Parameters

Parameter	Type
`candidateModel`	`string`

Returns

Promise<MirrorAdoptionReport>

getPolicyDocument()

getPolicyDocument(docId): Promise<PolicyDocumentDetail>;

GET /api/v1/policy-guardrails/documents/:docId — passages, clauses and extraction runs.

Parameters

Parameter	Type
`docId`	`string`

Returns

Promise<PolicyDocumentDetail>

getPullRequestUsage()

getPullRequestUsage(options?): Promise<PullRequestUsageResponse>;

GET /api/v1/usage/pull-requests

Parameters

Parameter	Type
`options`	`UsageOptions`

Returns

Promise<PullRequestUsageResponse>

getResponseEchoReport()

getResponseEchoReport(options?): Promise<ResponseEchoReport>;

GET /api/v1/findings/response-echo/report

Parameters

Parameter	Type
`options`	`ResponseEchoReportOptions`

Returns

Promise<ResponseEchoReport>

getRuleCandidateSource()

getRuleCandidateSource(candidateId): Promise<RuleCandidateSource>;

GET /api/v1/rule-candidates/:candidateId/source — the source of record a candidate's bundle must be compiled from. A source that does not hash to the sourceSha256 served with it is refused (ClawdeConnectionError): something between the control plane and this process changed it.

Parameters

Parameter	Type
`candidateId`	`string`

Returns

Promise<RuleCandidateSource>

getSiemDestination()

getSiemDestination(destinationId): Promise<SiemDestination>;

GET /api/v1/siem/destinations/:destinationId

Parameters

Parameter	Type
`destinationId`	`string`

Returns

Promise<SiemDestination>

getSigningKeys()

getSigningKeys(): Promise<SigningJwks>;

GET /.well-known/intutic-trace-signing.json — the published signing keys, fetched without credentials. verifyEvidenceArchive takes them.

Returns

Promise<SigningJwks>

getSop()

getSop(sopId): Promise<SopDetail>;

GET /api/v1/sops/:sopId

Parameters

Parameter	Type
`sopId`	`string`

Returns

Promise<SopDetail>

getTeamUsage()

getTeamUsage(options?): Promise<TeamUsageResponse>;

GET /api/v1/usage/teams — per SCIM group.

Parameters

Parameter	Type
`options`	`UsageOptions`

Returns

Promise<TeamUsageResponse>

getTrace()

getTrace(traceId): Promise<TraceDetail>;

GET /api/v1/traces/:traceId

Parameters

Parameter	Type
`traceId`	`string`

Returns

Promise<TraceDetail>

getWorkspaceSettings()

getWorkspaceSettings(): Promise<WorkspaceSettings>;

GET /api/v1/workspace/settings — every setting, resolved with its default.

Returns

Promise<WorkspaceSettings>

killLoopRun()

killLoopRun(loopRunId): Promise<LoopRunActionResult>;

POST /api/v1/loops/:loopRunId/kill

Parameters

Parameter	Type
`loopRunId`	`string`

Returns

Promise<LoopRunActionResult>

listFindings()

listFindings(filters?): Promise<Finding[]>;

GET /api/v1/findings — detector findings, newest first.

Parameters

Parameter	Type
`filters`	`FindingFilters`

Returns

Promise<Finding[]>

listGateways()

listGateways(): Promise<Gateway[]>;

GET /api/v1/gateways

Returns

Promise<Gateway[]>

listGuardrailConflicts()

listGuardrailConflicts(): Promise<GuardrailConflict[]>;

GET /api/v1/policy-guardrails/conflicts — live guardrails and front-matter rules that contradict each other.

Returns

Promise<GuardrailConflict[]>

listGuardrailDuplicates()

listGuardrailDuplicates(options?): Promise<LedgerDuplicates>;

GET /api/v1/policy-guardrails/duplicates — overlapping passages and rules cited more than once.

Parameters

Parameter	Type
`options`	`DuplicatesOptions`

Returns

Promise<LedgerDuplicates>

listGuardrails()

listGuardrails(filters?): Promise<GuardrailSummary[]>;

GET /api/v1/policy-guardrails/guardrails

Parameters

Parameter	Type
`filters`	`GuardrailFilters`

Returns

Promise<GuardrailSummary[]>

listIncidents()

listIncidents(filters?): Promise<IncidentList>;

GET /api/v1/incidents — ranked by review priority; filter by status, severity and type.

Parameters

Parameter	Type
`filters`	`IncidentFilters`

Returns

Promise<IncidentList>

listIntegrityRoots()

listIntegrityRoots(options?): Promise<IntegrityRootList>;

GET /api/v1/integrity/roots — the sealed trace roots.

Parameters

Parameter	Type
`options`	{ `loopRunId?`: `string`; }
`options.loopRunId?`	`string`

Returns

Promise<IntegrityRootList>

listInventoryDevices()

listInventoryDevices(): Promise<InventoryDevice[]>;

GET /api/v1/inventory/devices — one row per machine.

Returns

Promise<InventoryDevice[]>

listInventoryDisconnects()

listInventoryDisconnects(options?): Promise<DeviceDisconnect[]>;

GET /api/v1/inventory/disconnects — machines that ran intutic disconnect, newest first (default 100, at most 500).

Parameters

Parameter	Type
`options`	{ `limit?`: `number`; }
`options.limit?`	`number`

Returns

Promise<DeviceDisconnect[]>

listInventoryHarnesses()

listInventoryHarnesses(filters?): Promise<InventoryHarness[]>;

GET /api/v1/inventory/harnesses

Parameters

Parameter	Type
`filters`	`InventoryFilters`

Returns

Promise<InventoryHarness[]>

listInventoryMcpServers()

listInventoryMcpServers(filters?): Promise<InventoryMcpServer[]>;

GET /api/v1/inventory/mcp-servers

Parameters

Parameter	Type
`filters`	`InventoryFilters`

Returns

Promise<InventoryMcpServer[]>

listInventorySkills()

listInventorySkills(filters?): Promise<InventorySkill[]>;

GET /api/v1/inventory/skills

Parameters

Parameter	Type
`filters`	`InventorySkillFilters`

Returns

Promise<InventorySkill[]>

listLoopRuns()

listLoopRuns(): Promise<LoopRun[]>;

GET /api/v1/loops

Returns

Promise<LoopRun[]>

listMcpServers()

listMcpServers(): Promise<McpServerList>;

GET /api/v1/mcp/servers — every server the workspace's MCP proxies have reported, and the registry-wide policy.

Returns

Promise<McpServerList>

listNotificationRules()

listNotificationRules(): Promise<NotificationRule[]>;

GET /api/v1/notifications/rules

Returns

Promise<NotificationRule[]>

listOrgSops()

listOrgSops(): Promise<OrgSop[]>;

GET /api/v1/workspace/org-sops — the org-wide SOP floors of the key's org.

Returns

Promise<OrgSop[]>

listPolicyDocuments()

listPolicyDocuments(): Promise<PolicyDocumentSummary[]>;

GET /api/v1/policy-guardrails/documents

Returns

Promise<PolicyDocumentSummary[]>

listPolicySources()

listPolicySources(): Promise<PolicySource[]>;

GET /api/v1/connectors — the workspace's policy sources (Notion, Confluence, GitHub, Google Drive).

Returns

Promise<PolicySource[]>

listProviderCredentials()

listProviderCredentials(): Promise<ProviderCredentialStatus[]>;

GET /api/v1/workspace/provider-credentials

Returns

Promise<ProviderCredentialStatus[]>

listProviderModels()

listProviderModels(provider): Promise<ProviderModelList>;

GET /api/v1/workspace/provider-credentials/:provider/models

Parameters

Parameter	Type
`provider`	`string`

Returns

Promise<ProviderModelList>

listSiemDestinations()

listSiemDestinations(): Promise<SiemDestinationList>;

GET /api/v1/siem/destinations — the destinations and the event sources they can receive.

Returns

Promise<SiemDestinationList>

listSiemSources()

listSiemSources(): Promise<SiemSources>;

The event sources a destination can receive; defaults are the ones an empty sourceTables means.

Returns

Promise<SiemSources>

listSops()

listSops(options?): Promise<SopSummary[]>;

GET /api/v1/sops

Parameters

Parameter	Type
`options`	{ `limit?`: `number`; }
`options.limit?`	`number`

Returns

Promise<SopSummary[]>

listTeams()

listTeams(orgId): Promise<Team[]>;

GET /api/v1/orgs/:orgId/teams

Parameters

Parameter	Type
`orgId`	`string`

Returns

Promise<Team[]>

listTeamWorkspaces()

listTeamWorkspaces(teamId): Promise<Workspace[]>;

GET /api/v1/teams/:teamId/workspaces

Parameters

Parameter	Type
`teamId`	`string`

Returns

Promise<Workspace[]>

listTraces()

listTraces(filters?): Promise<TraceList>;

GET /api/v1/traces — newest first.

Parameters

Parameter	Type
`filters`	`TraceFilters`

Returns

Promise<TraceList>

predictCost()

predictCost(params): Promise<CostPrediction>;

POST /api/v1/predict-cost — estimate a call's cost before it runs. Size the input with a token count or the text.

Parameters

Parameter	Type
`params`	`PredictCostParams`

Returns

Promise<CostPrediction>

promoteGuardrail()

promoteGuardrail(guardrailId, options?): Promise<GuardrailTransitionResult>;

POST …/guardrails/:guardrailId/promote — into ENFORCING. Refused with a 409 until the shadow evidence clears the thresholds; a guardrail that never fired needs acknowledgeNoTraffic.

Parameters

Parameter	Type
`guardrailId`	`string`
`options`	`PromoteOptions`

Returns

Promise<GuardrailTransitionResult>

recomputeIntegrityRoot()

recomputeIntegrityRoot(rootId): Promise<IntegrityRecompute>;

POST /api/v1/integrity/roots/:rootId/recompute — re-derive the root from the stored traces.

Parameters

Parameter	Type
`rootId`	`string`

Returns

Promise<IntegrityRecompute>

reconfirmGuardrail()

reconfirmGuardrail(guardrailId): Promise<GuardrailTransitionResult>;

POST …/guardrails/:guardrailId/reconfirm — re-confirm a stale citation against a live passage.

Parameters

Parameter	Type
`guardrailId`	`string`

Returns

Promise<GuardrailTransitionResult>

refreshPullRequestUsage()

refreshPullRequestUsage(): Promise<PullRequestRefreshResult>;

POST /api/v1/usage/pull-requests/refresh — look the branches up on GitHub now (OWNER, ADMIN, EM).

Returns

Promise<PullRequestRefreshResult>

registerGateway()

registerGateway(params): Promise<GatewayRegisterResult>;

POST /api/v1/gateways

Parameters

Parameter	Type
`params`	`GatewayRegisterParams`

Returns

Promise<GatewayRegisterResult>

rejectDecision()

rejectDecision(holdId, options?): Promise<DecisionReviewResult>;

POST /api/v1/decisions/:holdId/review (OWNER, ADMIN, EM) — reject a held call.

Parameters

Parameter	Type
`holdId`	`string`
`options`	`ReviewOptions`

Returns

Promise<DecisionReviewResult>

rejectGuardrail()

rejectGuardrail(guardrailId, reason): Promise<GuardrailTransitionResult>;

POST …/guardrails/:guardrailId/reject — recorded with the reason.

Parameters

Parameter	Type
`guardrailId`	`string`
`reason`	`string`

Returns

Promise<GuardrailTransitionResult>

rejectLoopRun()

rejectLoopRun(loopRunId, options?): Promise<LoopRunActionResult>;

POST /api/v1/loops/:loopRunId/review (OWNER, ADMIN, EM) — reject a run held for review; it is KILLED.

Parameters

Parameter	Type
`loopRunId`	`string`
`options`	`LoopRunReviewOptions`

Returns

Promise<LoopRunActionResult>

replayGuardrail()

replayGuardrail(guardrailId): Promise<GuardrailReplay>;

POST …/guardrails/:guardrailId/replay — what the guardrail would have done on captured traffic.

Parameters

Parameter	Type
`guardrailId`	`string`

Returns

Promise<GuardrailReplay>

replayWasmRule()

replayWasmRule(ruleId, options?): Promise<WasmReplayResult>;

POST /api/v1/wasm-rules/:ruleId/replay — what a rule would have done on sampled traffic, without enforcing.

Parameters

Parameter	Type
`ruleId`	`string`
`options`	`WasmReplayOptions`

Returns

Promise<WasmReplayResult>

resetMcpServer()

resetMcpServer(serverId): Promise<McpServerDecision>;

POST /api/v1/mcp/servers/:serverId/status — return a server to the approval queue (OWNER, ADMIN).

Parameters

Parameter	Type
`serverId`	`string`

Returns

Promise<McpServerDecision>

resolveGateway()

resolveGateway(): Promise<GatewayResolution>;

GET /api/v1/workspace/gateway-resolution

Returns

Promise<GatewayResolution>

retireGuardrail()

retireGuardrail(guardrailId): Promise<GuardrailTransitionResult>;

POST …/guardrails/:guardrailId/retire — gone from every rule endpoint on the next poll.

Parameters

Parameter	Type
`guardrailId`	`string`

Returns

Promise<GuardrailTransitionResult>

revokeGateway()

revokeGateway(gatewayId, reason?): Promise<void>;

DELETE /api/v1/gateways/:id

Parameters

Parameter	Type
`gatewayId`	`string`
`reason?`	`string`

Returns

Promise<void>

rotateGatewayToken()

rotateGatewayToken(gatewayId): Promise<GatewayRotateResult>;

POST /api/v1/gateways/:id/rotate

Parameters

Parameter	Type
`gatewayId`	`string`

Returns

Promise<GatewayRotateResult>

rotateGithubWebhookSecret()

rotateGithubWebhookSecret(): Promise<GitHubWebhookSecret>;

POST /api/v1/integrations/github/webhook/secret (OWNER, ADMIN) — make the webhook, or replace its secret. Deliveries signed with an earlier secret are refused from then on.

Returns

Promise<GitHubWebhookSecret>

rotateNotificationRuleSecret()

rotateNotificationRuleSecret(ruleId): Promise<NotificationSecretRotation>;

POST /api/v1/notifications/rules/:ruleId/signing-secret — deliveries are signed with the new secret from now on.

Parameters

Parameter	Type
`ruleId`	`string`

Returns

Promise<NotificationSecretRotation>

rotateSiemDestinationSecret()

rotateSiemDestinationSecret(destinationId): Promise<SiemSecretRotation>;

POST /api/v1/siem/destinations/:destinationId/signing-secret (OWNER, ADMIN)

Parameters

Parameter	Type
`destinationId`	`string`

Returns

Promise<SiemSecretRotation>

searchPolicyPassages()

searchPolicyPassages(text): Promise<PassageSearchResult>;

GET /api/v1/policy-guardrails/search?q= — full-text search over live passages, best match first.

Parameters

Parameter	Type
`text`	`string`

Returns

Promise<PassageSearchResult>

setGatewayConfig()

setGatewayConfig(gatewayId, config): Promise<GatewayConfigResult>;

PATCH /api/v1/gateways/:id/config

Parameters

Parameter	Type
`gatewayId`	`string`
`config`	`GatewayConfigUpdate`

Returns

Promise<GatewayConfigResult>

setProviderCredential()

setProviderCredential(provider, fields): Promise<ProviderCredentialStatus>;

PUT /api/v1/workspace/provider-credentials/:provider

Parameters

Parameter	Type
`provider`	`string`
`fields`	`Record`<`string`, `string`>

Returns

Promise<ProviderCredentialStatus>

signupOrg()

signupOrg(params): Promise<OrgSignupResult>;

POST /api/v1/auth/signup/org — unauthenticated, creates the calling user. acceptTerms: true is required: the caller is 18 or older and agrees to the Terms and the Privacy Policy; without it the call fails with 400 TERMS_NOT_ACCEPTED.

Closed by default in production (INTUTIC_PUBLIC_ORG_SIGNUP, off unless a deployment has built its own anonymous domain-verification story): creating a real org auto-provisions a real managed gateway cell (LLD #71), so org creation now requires DNS domain-ownership proof, and an anonymous caller has no session to own a verification attempt against. Prefer startDomainVerification + checkDomainVerification + createOrg with an already-authenticated apiKey — the same flow the CLI's intutic org create and the dashboard's "Create Organization" modal use.

Parameters

Parameter	Type
`params`	`OrgSignupParams`

Returns

Promise<OrgSignupResult>

startDomainVerification()

startDomainVerification(domain): Promise<StartDomainVerificationResult>;

POST /api/v1/domain-verification/start — mints a DNS TXT-record verification token for domain. Publish a TXT record at txtRecordName with value txtRecordValue, then poll checkDomainVerification until status is 'verified'.

Parameters

Parameter	Type
`domain`	`string`

Returns

Promise<StartDomainVerificationResult>

startLoopRun()

startLoopRun(name, options?): Promise<LoopRun>;

POST /api/v1/loops/start — register a loop run. Send its id with the run's requests (INTUTIC_LOOP_RUN_ID, as intutic loop exec sets it) so the proxy files them under it.

Parameters

Parameter	Type
`name`	`string`
`options`	`StartLoopRunOptions`

Returns

Promise<LoopRun>

syncPolicySource()

syncPolicySource(connectorId): Promise<PolicySourceSyncResult>;

POST /api/v1/connectors/:connectorId/sync

Parameters

Parameter	Type
`connectorId`	`string`

Returns

Promise<PolicySourceSyncResult>

unsetProviderCredential()

unsetProviderCredential(provider): Promise<void>;

DELETE /api/v1/workspace/provider-credentials/:provider

Parameters

Parameter	Type
`provider`	`string`

Returns

Promise<void>

updateGuardrail()

updateGuardrail(guardrailId, changes): Promise<AuthoredGuardrailWriteResult>;

PUT /api/v1/policy-guardrails/guardrails/:guardrailId (OWNER, ADMIN). A changed IR creates the next version (forked), PROPOSED with no evidence; a name or description edit keeps the evidence.

Parameters

Parameter	Type
`guardrailId`	`string`
`changes`	`AuthoredGuardrailUpdate`

Returns

Promise<AuthoredGuardrailWriteResult>

updateNotificationRule()

updateNotificationRule(ruleId, changes): Promise<NotificationRule>;

PUT /api/v1/notifications/rules/:ruleId — only the fields given change. A switch to the webhook channel comes back with the new signingSecret.

Parameters

Parameter	Type
`ruleId`	`string`
`changes`	`NotificationRuleUpdate`

Returns

Promise<NotificationRule>

updateSiemDestination()

updateSiemDestination(destinationId, changes): Promise<SiemDestination>;

PUT /api/v1/siem/destinations/:destinationId (OWNER, ADMIN) — only the fields given change.

Parameters

Parameter	Type
`destinationId`	`string`
`changes`	`SiemDestinationUpdate`

Returns

Promise<SiemDestination>

updateWorkspaceSettings()

updateWorkspaceSettings(settings): Promise<WorkspaceSettingsUpdateResult>;

PUT /api/v1/workspace/settings — the route intutic settings set calls.

Only the keys given change; the rest are kept (featureFlags merges one level deeper, so one flag does not switch the others off). The control plane is the authority on which keys exist and what each accepts: an unknown key or a bad value is refused with a 400 naming it, a setting the workspace's plan does not include (the group policy below Biz Org) with a 403 "Upgrade required", and a member below OWNER or ADMIN with a 403. Each refusal throws ClawdeConnectionError carrying the server's answer.

Parameters

Parameter	Type
`settings`	`Record`<`string`, `unknown`>

Returns

Promise<WorkspaceSettingsUpdateResult>

uploadRuleCandidateBundle()

uploadRuleCandidateBundle(
   candidateId, 
   wasm, 
   sourceSha256, 
   options?
): Promise<BundleUploadResult>;

POST /api/v1/rule-candidates/:candidateId/bundle (OWNER, ADMIN) — upload a compiled rule with the hash of the source it was compiled from. The control plane runs its gates; accepted says whether the rule went into shadow, and gates why.

Parameters

Parameter	Type
`candidateId`	`string`
`wasm`	`Uint8Array`
`sourceSha256`	`string`
`options`	`BundleUploadOptions`

Returns

Promise<BundleUploadResult>

whoami()

whoami(): Promise<WhoamiResult>;

GET /api/v1/auth/me

Returns

Promise<WhoamiResult>

@intutic/gate

Classes

@intutic/gate/workflow

Classes

@intutic/gate/managed-agents

Classes

Class: ControlPlaneClient ​

Constructors ​

Constructor ​

Parameters ​

Returns ​

Methods ​

addPolicySource() ​

Parameters ​

Returns ​

adjudicateFinding() ​

Parameters ​

Returns ​

approveDecision() ​

Parameters ​

Returns ​

approveGuardrailShadow() ​

Parameters ​

Returns ​

approveLoopRun() ​

Parameters ​

Returns ​

approveMcpServer() ​

Parameters ​

Returns ​

assignOrgGateway() ​

Parameters ​

Returns ​

assignWorkspaceGateway() ​

Parameters ​

Returns ​

attenuateKey() ​

Parameters ​

Returns ​

blockMcpServer() ​

Parameters ​

Returns ​

checkDomainVerification() ​

Parameters ​

Returns ​

collectEvidence() ​

Parameters ​

Returns ​

completeLoopRun() ​

Parameters ​

Returns ​

createGuardrail() ​

Parameters ​

Returns ​

createNotificationRule() ​

Parameters ​

Returns ​

createOrg() ​

Parameters ​

Returns ​

createOrgSop() ​

Parameters ​

Returns ​

createSiemDestination() ​

Parameters ​

Returns ​

createSop() ​

Parameters ​

Returns ​

createTeam() ​

Parameters ​

Returns ​

createWorkspace() ​

Parameters ​

Returns ​

deleteGuardrail() ​

Parameters ​

Returns ​

deleteNotificationRule() ​

Parameters ​

Class: ControlPlaneClient

Constructors

Constructor

Parameters

Returns

Methods

addPolicySource()

Parameters

Returns

adjudicateFinding()

Parameters

Returns

approveDecision()

Parameters

Returns

approveGuardrailShadow()

Parameters

Returns

approveLoopRun()

Parameters

Returns

approveMcpServer()

Parameters

Returns

assignOrgGateway()

Parameters

Returns

assignWorkspaceGateway()

Parameters

Returns

attenuateKey()

Parameters

Returns

blockMcpServer()

Parameters

Returns

checkDomainVerification()

Parameters

Returns

collectEvidence()

Parameters

Returns

completeLoopRun()

Parameters

Returns

createGuardrail()

Parameters

Returns

createNotificationRule()

Parameters

Returns

createOrg()

Parameters

Returns

createOrgSop()

Parameters

Returns

createSiemDestination()

Parameters

Returns

createSop()

Parameters

Returns

createTeam()

Parameters

Returns

createWorkspace()

Parameters

Returns

deleteGuardrail()

Parameters

Returns

deleteNotificationRule()

Parameters

Returns

deleteOrgSop()

Parameters

Returns

deleteSiemDestination()

Parameters