auto-runtime.schema.json

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "title": "Auto Runtime configuration file",
  "description": "The settings of Auto Runtime that are lists or maps, where Studio comes from, a declared local mode, the usage ping, payload offloading and the license, read from the file that CONFIG_FILE names. Each key stands for the environment variable of the same name in upper case, which wins over it, and license for AUTO_RUNTIME_LICENSE, whose key and allocation AUTO_RUNTIME_LICENSE_KEY and AUTO_RUNTIME_ALLOCATION win over. Secrets are written as references such as ${GATEWAY_API_KEY}.",
  "type": "object",
  "properties": {
    "allowed_origins": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "The origins a page in a browser may call the API from, such as https://app.example.com. ALLOWED_ORIGINS wins over it"
    },
    "studio_origin": {
      "type": "string",
      "description": "The origin Studio is served from, an https URL, or an http URL on localhost, 127.0.0.1 or [::1], with no path; a page there may call the API, and the runtime fetches Studio from it when it serves Studio. https://studio.on.auto when left out. STUDIO_ORIGIN wins over it"
    },
    "serve_studio": {
      "type": "boolean",
      "description": "Whether the runtime serves Studio itself at /studio/ on its own address, fetched from the Studio host and kept, since a page on a public address may not reach an address on the machine. On in local mode and off otherwise when left out. SERVE_STUDIO wins over it"
    },
    "api_keys": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "id": {
            "type": "string",
            "pattern": "^[a-z0-9-]{1,32}$"
          },
          "org": {
            "type": "string",
            "pattern": "^[A-Za-z0-9_-]{1,64}$"
          },
          "permissions": {
            "type": "array",
            "items": {
              "type": "string",
              "enum": ["org:read", "org:write", "playbook:read", "playbook:write"]
            }
          },
          "playbooks": {
            "anyOf": [
              {
                "type": "string",
                "enum": ["*"]
              },
              {
                "type": "array",
                "items": {
                  "type": "string",
                  "pattern": "^[a-z][a-z0-9-]{2,47}$"
                }
              }
            ]
          },
          "sha256": {
            "type": "string",
            "pattern": "^[0-9a-f]{64}$"
          }
        },
        "required": ["id", "org", "permissions", "playbooks", "sha256"],
        "additionalProperties": false
      }
    },
    "access_mode": {
      "type": "string",
      "enum": ["local"],
      "description": "local declares local mode, where every request acts as the local developer with no credential, for a runtime whose port only this computer reaches, such as a container whose port is published on 127.0.0.1 alone. It takes no API_KEYS, and a PUBLIC_URL only on localhost, 127.0.0.1 or [::1], which names the address of the runtime and signs no one in; a runtime that listens beyond the loopback needs that PUBLIC_URL. ACCESS_MODE wins over it"
    },
    "model_gateways": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "name": {
            "type": "string",
            "description": "The provider prefix, such as gateway in gateway/llama-3.3-70b: 1 to 32 lowercase letters, digits and hyphens, starting with a letter, unique, and not a built-in prefix"
          },
          "base_url": {
            "type": "string",
            "description": "The http or https URL that /chat/completions is appended to, such as https://gateway.example.com/v1"
          },
          "api_key": {
            "type": "string",
            "description": "The key, sent as Authorization: Bearer <key>; in the configuration file a reference such as ${GATEWAY_API_KEY}"
          },
          "headers": {
            "type": "object",
            "additionalProperties": {
              "type": "string"
            },
            "description": "Headers sent with every request, their values treated as secrets; in the configuration file a credential is a reference"
          },
          "query_params": {
            "type": "object",
            "additionalProperties": {
              "type": "string"
            },
            "description": "Query parameters added to every request, their values treated as secrets"
          },
          "structured_outputs": {
            "type": "boolean",
            "description": "true when the endpoint accepts response_format json_schema; otherwise no response_format is sent, the schema of a JSON answer is written into the instructions, and the answer is checked here. Default false"
          },
          "include_usage": {
            "type": "boolean",
            "description": "Asks for usage in streamed responses. Default false"
          },
          "expose_provider_messages": {
            "type": "boolean",
            "description": "true when the gateway's error messages are safe to show to callers of a reasoning function. Default false"
          },
          "allowed_provider_options": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "description": "The top-level request body fields a reasoning function may set for this gateway through provider_options, such as user and metadata. Default none"
          },
          "cost_header": {
            "type": "string",
            "description": "A gateway entry names the header its gateway answers the call's cost in, in US dollars, or names none and no cost is kept. A run keeps the cost as cost_usd"
          }
        },
        "required": ["name", "base_url"],
        "additionalProperties": false
      },
      "description": "OpenAI-compatible gateways, each a provider prefix of its own. MODEL_GATEWAYS wins over it"
    },
    "model_aliases": {
      "type": "object",
      "additionalProperties": {
        "type": "string"
      },
      "description": "Model references a reasoning function may give, each sent on as another reference; a trailing * on both sides covers every model of a provider. MODEL_ALIASES wins over it"
    },
    "declared_models": {
      "type": "object",
      "additionalProperties": {
        "type": "array",
        "items": {
          "type": "string",
          "description": "A model id as the provider receives it, such as eu.anthropic.claude-sonnet-4-5-20250929-v1:0"
        }
      },
      "description": "The models list_models shows for bedrock, bedrock-anthropic, azure, vertex and vertex-anthropic, which do not list their own, and for a gateway whose list cannot be read, keyed by the provider prefix. DECLARED_MODELS wins over it"
    },
    "allowed_models": {
      "type": "array",
      "items": {
        "type": "string",
        "description": "A model reference a reasoning function may give, written provider/model, or provider/* for every model of a provider"
      },
      "description": "The only model references a reasoning function may give, by name or through an alias, and list_models shows, each provider/model or provider/* for every model of a provider; every model when left out. ALLOWED_MODELS wins over it"
    },
    "voice_model": {
      "type": "string",
      "description": "The model that writes out what a person says, which Studio offers beside each comment field, as provider/model, its provider openai or the name of an entry of model_gateways, such as openai/whisper-1; none when left out. VOICE_MODEL wins over it"
    },
    "tool_servers": {
      "type": "object",
      "additionalProperties": {
        "type": "object",
        "properties": {
          "type": {
            "type": "string",
            "enum": ["mcp", "stdio", "openapi"],
            "description": "mcp for a remote MCP server, given url; stdio for an MCP server this server starts as a process, given command; openapi for an HTTP API, given document. Taken from url, command or document when left out"
          },
          "url": {
            "type": "string",
            "description": "The http or https URL of a remote MCP server, spoken to over Streamable HTTP"
          },
          "headers": {
            "type": "object",
            "additionalProperties": {
              "type": "string"
            },
            "description": "Headers sent to a remote MCP server, or to an HTTP API outside its document's security schemes, with every request; the value of a reference such as ${GRAPH_API_KEY} is a secret, scrubbed from everything a call records, and a value written out is not"
          },
          "auth": {
            "type": "object",
            "properties": {
              "issuer": {
                "type": "string",
                "description": "The issuer of the authorization server the credential was registered with, pinned: it is sent to no other. An https URL, or an http URL on a loopback address"
              },
              "client_id": {
                "type": "string",
                "description": "The client id registered with that authorization server"
              },
              "client_secret": {
                "type": "string",
                "description": "The client secret, as a reference such as ${GRAPH_CLIENT_SECRET}"
              },
              "private_key": {
                "type": "string",
                "description": "A private key in PEM that signs the client assertion, as a reference such as ${GRAPH_PRIVATE_KEY}"
              },
              "algorithm": {
                "type": "string",
                "description": "The signing algorithm of private_key, such as RS256 or ES256"
              },
              "scope": {
                "type": "string",
                "description": "The scopes to ask for, separated by spaces"
              }
            },
            "required": ["issuer", "client_id"],
            "additionalProperties": false,
            "description": "OAuth client credentials, for a server whose authorization server issues tokens to clients: client_secret, or private_key with its algorithm. An mcp server's authorization server is found from the server's own metadata, an openapi server's from the issuer's"
          },
          "command": {
            "type": "string",
            "description": "The command of a stdio server: an installed, pinned program, never a package downloaded at start such as npx -y"
          },
          "args": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "description": "The arguments of the command of a stdio server"
          },
          "env": {
            "type": "object",
            "additionalProperties": {
              "type": "string"
            },
            "description": "The whole environment of the process of a stdio server, which inherits nothing else; the value of a reference such as ${GRAPH_API_KEY} is a secret, scrubbed from everything a call records, and a value written out is not"
          },
          "document": {
            "type": "string",
            "description": "The OpenAPI document of an HTTP API, version 3.0 or 3.1, read once at start: an https URL, an http URL on a loopback address, or a path relative to the directory of the configuration file"
          },
          "base_url": {
            "type": "string",
            "description": "The URL the calls of an HTTP API go to, in place of the first server its document names; required when it names none. An https URL, or an http URL on a loopback address"
          },
          "query_params": {
            "type": "object",
            "additionalProperties": {
              "type": "string"
            },
            "description": "Query parameters sent to an HTTP API with every call, outside its document's security schemes, such as a tenant; the value of a reference such as ${GRAPH_API_KEY} is a secret, scrubbed from everything a call records, and a value written out is not"
          },
          "security": {
            "type": "object",
            "additionalProperties": {
              "type": "string"
            },
            "description": "The credential of each security scheme of an HTTP API's document the entry gives, by the scheme's name, placed as the scheme says: an apiKey in its header or query parameter, a bearer as Authorization: Bearer, a basic as user:password; an oauth2 or openIdConnect scheme takes the auth block instead; each value is a reference such as ${BILLING_API_KEY} or ada:${BILLING_PASSWORD}, a secret, and one written out is refused"
          },
          "failure_codes": {
            "type": "object",
            "properties": {
              "succeeded": {
                "type": "string",
                "description": "A JSON pointer to the boolean of a JSON answer that says whether the call succeeded, false for a failure, such as /ok"
              },
              "code": {
                "type": "string",
                "description": "A JSON pointer to the string of a failed answer that names its failure, such as /error"
              },
              "key_refused": {
                "type": "array",
                "items": {
                  "type": "string"
                },
                "description": "The codes that say the API refused the credential, as a 401 says elsewhere"
              },
              "scope_lacking": {
                "type": "array",
                "items": {
                  "type": "string"
                },
                "description": "The codes that say the credential lacks a scope the call needs"
              },
              "rate_limited": {
                "type": "array",
                "items": {
                  "type": "string"
                },
                "description": "The codes that say the API limits the rate of its calls, as a 429 says elsewhere"
              }
            },
            "required": ["succeeded", "code"],
            "additionalProperties": false,
            "description": "For an HTTP API that answers a failure in a JSON answer of a successful status: where the answer says whether the call succeeded and the code that names its failure, and the codes that mean a refused credential, a lacking scope or a limited rate; any other failed answer is an error result carrying the answer"
          },
          "org": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "array",
                "items": {
                  "type": "string"
                }
              }
            ],
            "description": "The org this server serves, a list of orgs, or * for every org of this server, required; one entry serves each org it names under one name, with one credential and one connection"
          },
          "playbooks": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "description": "The playbooks this server serves within each org it names, by id; every playbook of each org when left out, and refused beside * for every org"
          },
          "allowed": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "description": "The tools of this server a function may name, each named as the server lists it; every tool of the server when left out"
          },
          "marks": {
            "type": "object",
            "properties": {
              "reads": {
                "type": "array",
                "items": {
                  "type": "string"
                },
                "description": "The tools that only read, each named as the server lists it"
              },
              "acts": {
                "type": "array",
                "items": {
                  "type": "string"
                },
                "description": "The tools that may change something, each named as the server lists it"
              }
            },
            "additionalProperties": false,
            "description": "The mark of each tool named, which wins over the one the server's hints or the HTTP method of an operation give: reads for a tool that only reads, acts for one that may change something; a tool named in neither keeps the mark it is listed with, and one nothing marks is unmarked, which counts as one that may change something. A name the server does not list is ignored"
          },
          "record_content": {
            "type": "boolean",
            "description": "Whether the arguments and the answers of this server's calls are kept whole, scrubbed of secrets, in the playbook's ledger, where anyone who may read the playbook reads them; false keeps their sizes alone. Default true"
          },
          "handles_money": {
            "type": "boolean",
            "description": "Whether the tools of this server pay, refund, transfer or pay out money; the directory listing does not offer such a server. Default false"
          },
          "request_id": {
            "type": "string",
            "description": "The response header, or for an MCP server the key of the metadata of a result, in which the server carries its own id of a request, recorded with each call"
          },
          "provider": {
            "type": "string",
            "description": "A provider the runtime knows, by its name, which gives the server and where its credential goes: the entry then gives placeholders, credential, org, playbooks, allowed and record_content, and no field of the server"
          },
          "placeholders": {
            "type": "object",
            "additionalProperties": {
              "type": "string"
            },
            "description": "With provider, the value of each of the provider's placeholders, by name, never a reference"
          },
          "credential": {
            "anyOf": [
              {
                "type": "string",
                "description": "For a secret, a reference such as ${TRACKER_TOKEN}"
              },
              {
                "type": "object",
                "properties": {
                  "kind": {
                    "type": "string",
                    "description": "The way of the provider the credential takes, when not its first"
                  },
                  "value": {
                    "type": "string",
                    "description": "For a secret, a reference such as ${TRACKER_TOKEN}"
                  },
                  "client_id": {
                    "type": "string",
                    "description": "For client credentials, the client id, written out"
                  },
                  "client_secret": {
                    "type": "string",
                    "description": "For client credentials, a reference such as ${LEDGERS_CLIENT_SECRET}"
                  },
                  "private_key": {
                    "type": "string",
                    "description": "For client credentials, a private key in PEM as a reference such as ${LEDGERS_PRIVATE_KEY}"
                  },
                  "algorithm": {
                    "type": "string",
                    "description": "The signing algorithm of private_key, such as RS256 or ES256"
                  }
                },
                "additionalProperties": false
              }
            ],
            "description": "With provider, the credential of the way kind names, or else of its first way but authorization, a consent a person gives on Studio's page alone: a secret as a reference such as ${TRACKER_TOKEN}, or client credentials as the client id written out with client_secret, or with private_key and its algorithm, each key a reference; nothing for a way that takes none"
          }
        },
        "additionalProperties": false
      },
      "description": "The tool servers whose tools a function may name, each bound to an org and optionally its playbooks: url for a remote MCP server, command for an MCP server run as a process, document for an HTTP API described by an OpenAPI document. Secrets are references such as ${GRAPH_API_KEY}. TOOL_SERVERS wins over it"
    },
    "connections": {
      "type": "object",
      "properties": {
        "people_may_add": {
          "type": "boolean",
          "description": "Whether people may add connections through their agents; true when left out"
        },
        "allowed_hosts": {
          "type": "array",
          "items": {
            "type": "string",
            "pattern": "^(?:\\*\\.)?[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?(?:\\.[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?)*$"
          },
          "description": "The hosts a connection may reach, each a host or *. and a host for every host under it; a loopback, private or link-local address is reached only where it is named here by itself, and a name that resolves to one never is; every host that is none of those addresses when left out"
        },
        "credential_kinds": {
          "type": "array",
          "items": {
            "type": "string",
            "enum": ["none", "reference", "secret", "client_credentials", "authorization"]
          },
          "description": "The kinds of credential a connection may take, of none, reference, secret, client_credentials and authorization; every kind when left out"
        },
        "variables": {
          "type": "array",
          "items": {
            "type": "string",
            "pattern": "^[A-Za-z_][A-Za-z0-9_]*$"
          },
          "description": "The variables of the runtime a reference credential may name, never one the runtime reads for itself; none when left out, so no connection takes a reference"
        },
        "registered_clients": {
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "issuers": {
                "type": "array",
                "items": {
                  "type": "string"
                },
                "minItems": 1,
                "description": "The issuers of the authorization servers the client is registered at, each an https URL, or an http URL on a loopback address; one written with a placeholder, such as https://login.example.com/{tenant}, is kept as it is written"
              },
              "client_id": {
                "type": "string",
                "minLength": 1,
                "description": "The client id the authorization servers issued"
              },
              "client_secret": {
                "type": "string",
                "description": "The client secret, as a reference such as ${EXAMPLE_CLIENT_SECRET}"
              },
              "private_key": {
                "type": "string",
                "description": "A private key in PEM that signs the client assertion, as a reference such as ${EXAMPLE_PRIVATE_KEY}"
              },
              "algorithm": {
                "type": "string",
                "minLength": 1,
                "description": "The signing algorithm of private_key, such as RS256 or ES256"
              },
              "token_endpoint_auth_method": {
                "type": "string",
                "enum": ["client_secret_basic", "client_secret_post", "private_key_jwt", "none"],
                "description": "How the client authenticates at the token endpoint where the metadata of the authorization server leaves the choice; chosen from the client and the metadata when left out"
              },
              "scopes": {
                "type": "array",
                "items": {
                  "type": "string",
                  "minLength": 1
                },
                "minItems": 1,
                "description": "The scopes the client may ask at its issuers, each as a provider's way writes it: a consent takes the first client at its issuer that names every scope it asks, the scope of the way at a first consent, and with a group of the way's more the scopes the connection holds and the group's. Named for each client where several clients serve one issuer, and left out for a client that may ask any"
              }
            },
            "required": ["issuers", "client_id"],
            "additionalProperties": false
          },
          "description": "The clients whoever runs the runtime registered at authorization servers, each with the issuers it is registered at, its client_id, and its client_secret, or its private_key with its algorithm, as a reference, or neither for a public client, and the scopes it may ask, which each client names where several serve one issuer"
        },
        "auto_clients": {
          "type": "boolean",
          "description": "Whether a provider whose way takes a registered client takes Auto's client too, through Auto's consent service, where no client registered at its issuer covers the scope the way asks; true in local mode and false otherwise when left out. AUTO_CLIENTS wins over it"
        },
        "providers": {
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "name": {
                "type": "string",
                "description": "The name of the provider and of a connection to it by default: 1 to 32 lowercase letters, digits and hyphens, starting with a letter"
              },
              "title": {
                "type": "string",
                "minLength": 1,
                "description": "What a person reads as its name"
              },
              "description": {
                "type": "string",
                "minLength": 1,
                "maxLength": 300,
                "description": "What a function may do through it, in one or two sentences of at most 300 characters"
              },
              "website": {
                "type": "string",
                "description": "The https page where a person reads about the server and makes a credential"
              },
              "type": {
                "type": "string",
                "enum": ["mcp", "openapi"],
                "description": "mcp for an MCP server, given url; openapi for an HTTP API"
              },
              "url": {
                "type": "string",
                "description": "For mcp, the https URL of the server, {name} standing for the placeholder name"
              },
              "document": {
                "type": "string",
                "description": "For openapi, the https URL of its OpenAPI document, {name} standing for the placeholder name"
              },
              "base_url": {
                "type": "string",
                "description": "For openapi, the https URL its calls go to where the document names no server, {name} standing for the placeholder name"
              },
              "headers": {
                "type": "object",
                "additionalProperties": {
                  "type": "string"
                },
                "description": "Headers sent with every request, never a credential; a reference such as ${ADS_DEVELOPER_TOKEN} stands for a value of whoever runs the runtime"
              },
              "query_params": {
                "type": "object",
                "additionalProperties": {
                  "type": "string"
                },
                "description": "For openapi, query parameters sent with every call, never a credential; a reference such as ${ADS_DEVELOPER_TOKEN} stands for a value of whoever runs the runtime"
              },
              "request_id": {
                "type": "string",
                "description": "The response header, or for an MCP server the key of the metadata of a result, in which the server carries its own id of a request, recorded with each call"
              },
              "handles_money": {
                "type": "boolean",
                "description": "true for a provider whose tools pay, refund, transfer or pay out money, which the directory listing does not offer"
              },
              "marks": {
                "type": "object",
                "properties": {
                  "reads": {
                    "type": "array",
                    "items": {
                      "type": "string"
                    },
                    "description": "The tools that only read, each named as the server lists it"
                  },
                  "acts": {
                    "type": "array",
                    "items": {
                      "type": "string"
                    },
                    "description": "The tools that may change something, each named as the server lists it"
                  }
                },
                "additionalProperties": false,
                "description": "The mark of each tool named, for the tools the server marks wrongly or not at all: reads for a tool that only reads, acts for one that may change something, each named as the server lists it; for openapi, a tool of the document beside the entries"
              },
              "failure_codes": {
                "type": "object",
                "properties": {
                  "succeeded": {
                    "type": "string",
                    "description": "A JSON pointer to the boolean of a JSON answer that says whether the call succeeded, false for a failure, such as /ok"
                  },
                  "code": {
                    "type": "string",
                    "description": "A JSON pointer to the string of a failed answer that names its failure, such as /error"
                  },
                  "key_refused": {
                    "type": "array",
                    "items": {
                      "type": "string"
                    },
                    "description": "The codes that say the API refused the credential, as a 401 says elsewhere"
                  },
                  "scope_lacking": {
                    "type": "array",
                    "items": {
                      "type": "string"
                    },
                    "description": "The codes that say the credential lacks a scope the call needs"
                  },
                  "rate_limited": {
                    "type": "array",
                    "items": {
                      "type": "string"
                    },
                    "description": "The codes that say the API limits the rate of its calls, as a 429 says elsewhere"
                  }
                },
                "required": ["succeeded", "code"],
                "additionalProperties": false,
                "description": "For openapi, an API that answers a failure in a JSON answer of a successful status: the pointers to whether the call succeeded and to the code of its failure, and the codes that mean a refused credential, a lacking scope or a limited rate"
              },
              "conversations": {
                "type": "object",
                "properties": {
                  "tell": {
                    "type": "string",
                    "enum": ["all", "refusals"],
                    "description": "The provider's practice, and what a person is told through it by a function that writes no tell: all where one more message is expected, as in a chat, so a reply taken is marked and answered, a reply not taken is answered and a request that ends says so; refusals where each message costs, as in mail or a text message, so only a reply that could not be taken is answered"
                  },
                  "reply": {
                    "type": "object",
                    "properties": {
                      "tool": {
                        "type": "string",
                        "description": "The tool that posts a message in the conversation of a person's reply, named as the server lists it"
                      },
                      "with": {
                        "type": "object",
                        "description": "Its arguments, written as the arguments of a function's deliver are, each a Liquid template over to, sent.conversation, sent.id, message, reply.id and reply.to: message is the line, and reply.to the message the person's reply answers"
                      },
                      "sent": {
                        "type": "string",
                        "description": "A JSON Pointer into what the tool answered, to the id of the message it posted"
                      }
                    },
                    "required": ["tool", "with", "sent"],
                    "additionalProperties": false,
                    "description": "How a line is posted in reply to a person"
                  },
                  "react": {
                    "type": "object",
                    "properties": {
                      "tool": {
                        "type": "string",
                        "description": "The tool that marks a person's message with a reaction, named as the server lists it"
                      },
                      "with": {
                        "type": "object",
                        "description": "Its arguments, written as the arguments of a function's deliver are, each a Liquid template over to, sent.conversation, sent.id, message, reply.id and reply.to"
                      }
                    },
                    "required": ["tool", "with"],
                    "additionalProperties": false,
                    "description": "How a person's message is marked"
                  },
                  "read_limit": {
                    "type": "object",
                    "properties": {
                      "quota": {
                        "type": "integer",
                        "minimum": 1,
                        "description": "The most reads of a conversation the service takes in one window"
                      },
                      "window_seconds": {
                        "type": "integer",
                        "minimum": 1,
                        "maximum": 86400,
                        "description": "The window, in seconds, from 1 to 86400"
                      },
                      "clients": {
                        "type": "array",
                        "items": {
                          "type": "string",
                          "enum": ["registered", "auto", "metadata_document", "dynamic", "own", "gateway"]
                        },
                        "minItems": 1,
                        "description": "The client sources whose connections the service limits so, where it limits some apps and not others; left out, every connection"
                      }
                    },
                    "required": ["quota", "window_seconds"],
                    "additionalProperties": false,
                    "description": "How often the service lets the replies of a conversation be read, as a rate limit's quota and window: at most quota reads in each window. The runtime reads a conversation no sooner than the window divided by the quota after its last read, on its timer and when the service tells it of a message alike"
                  },
                  "automatic": {
                    "type": "string",
                    "description": "A JSON Pointer within a message the reading tool lists, to what it holds only when an app posted it or it was sent automatically; such a message is passed over, never taken, refused or answered"
                  }
                },
                "required": ["tell", "reply"],
                "additionalProperties": false,
                "description": "How the provider's conversations are replied to and marked, for a function that asks a person through it and reads their replies"
              },
              "renders": {
                "type": "string",
                "minLength": 1,
                "description": "The name of the render target a message sent through the provider can be written for, where it can be a card the run turns into the layout the provider shows"
              },
              "events": {
                "type": "object",
                "properties": {
                  "destinations": {
                    "type": "array",
                    "items": {
                      "type": "object",
                      "properties": {
                        "type": {
                          "type": "string",
                          "enum": ["webhook", "websocket", "queue"],
                          "description": "How the service sends: webhook, an HTTP request to the runtime's address; websocket, down a socket the runtime opens to the service; queue, into a queue the runtime reads"
                        },
                        "per": {
                          "type": "string",
                          "enum": ["subscription", "app"],
                          "description": "For webhook and queue, how sending is arranged: subscription, by a call Auto makes for each place requests wait in; app, once on the app at the vendor, for everyone who connects through it"
                        },
                        "topic": {
                          "type": "string",
                          "description": "Per subscription, the topic, as WebSub names the unit one subscribes to: a Liquid template over with, the arguments of the call that delivered a request, and sent.conversation and sent.id, rendering the place one subscription serves, such as a repository or a chat"
                        },
                        "subscribe": {
                          "type": "object",
                          "properties": {
                            "tool": {
                              "type": "string",
                              "description": "A tool of the connection that makes the call, named as the server lists it"
                            },
                            "with": {
                              "type": "object",
                              "description": "Beside tool, its arguments, written as the arguments of a function's deliver are"
                            },
                            "method": {
                              "type": "string",
                              "enum": ["GET", "POST", "PUT", "PATCH", "DELETE"],
                              "description": "Beside url, the method of an HTTP request sent with the connection's own credential"
                            },
                            "url": {
                              "type": "string",
                              "description": "Beside method, the https URL of the request, written out up to its host, a Liquid template"
                            },
                            "body": {
                              "type": "object",
                              "description": "Beside method and url, the JSON body of the request, written as with is"
                            },
                            "subscribed": {
                              "type": "object",
                              "properties": {
                                "id": {
                                  "type": "string",
                                  "description": "A JSON Pointer into what the call answered, to the id of the subscription it made"
                                },
                                "expires_at": {
                                  "type": "string",
                                  "description": "A JSON Pointer to when the subscription lapses, where the answer says"
                                },
                                "secret": {
                                  "type": "string",
                                  "description": "A JSON Pointer to the secret the service made for the subscription, where it makes one"
                                }
                              },
                              "required": ["id"],
                              "additionalProperties": false,
                              "description": "Where what the call answered names the subscription it made"
                            }
                          },
                          "required": ["subscribed"],
                          "additionalProperties": false,
                          "description": "The call that subscribes, a tool of the connection or an HTTP request"
                        },
                        "renew": {
                          "type": "object",
                          "properties": {
                            "tool": {
                              "type": "string",
                              "description": "A tool of the connection that makes the call, named as the server lists it"
                            },
                            "with": {
                              "type": "object",
                              "description": "Beside tool, its arguments, written as the arguments of a function's deliver are"
                            },
                            "method": {
                              "type": "string",
                              "enum": ["GET", "POST", "PUT", "PATCH", "DELETE"],
                              "description": "Beside url, the method of an HTTP request sent with the connection's own credential"
                            },
                            "url": {
                              "type": "string",
                              "description": "Beside method, the https URL of the request, written out up to its host, a Liquid template"
                            },
                            "body": {
                              "type": "object",
                              "description": "Beside method and url, the JSON body of the request, written as with is"
                            },
                            "renewed": {
                              "type": "object",
                              "properties": {
                                "expires_at": {
                                  "type": "string",
                                  "description": "A JSON Pointer into what the call answered, to when the subscription lapses now"
                                }
                              },
                              "required": ["expires_at"],
                              "additionalProperties": false
                            }
                          },
                          "additionalProperties": false,
                          "description": "The call that renews a subscription before it lapses"
                        },
                        "unsubscribe": {
                          "type": "object",
                          "properties": {
                            "tool": {
                              "type": "string",
                              "description": "A tool of the connection that makes the call, named as the server lists it"
                            },
                            "with": {
                              "type": "object",
                              "description": "Beside tool, its arguments, written as the arguments of a function's deliver are"
                            },
                            "method": {
                              "type": "string",
                              "enum": ["GET", "POST", "PUT", "PATCH", "DELETE"],
                              "description": "Beside url, the method of an HTTP request sent with the connection's own credential"
                            },
                            "url": {
                              "type": "string",
                              "description": "Beside method, the https URL of the request, written out up to its host, a Liquid template"
                            },
                            "body": {
                              "type": "object",
                              "description": "Beside method and url, the JSON body of the request, written as with is"
                            }
                          },
                          "additionalProperties": false,
                          "description": "The call that removes a subscription, without which none is made"
                        },
                        "lease_seconds": {
                          "type": "integer",
                          "minimum": 1,
                          "description": "Per subscription, the most seconds a subscription lasts before it lapses, as WebSub's lease"
                        },
                        "needs": {
                          "type": "string",
                          "description": "Per subscription, the group of more of the entry's authorization way whose scopes subscribing takes, where the way's own scope does not cover it"
                        },
                        "verify": {
                          "type": "object",
                          "properties": {
                            "scheme": {
                              "type": "string",
                              "enum": ["hmac", "standard-webhooks", "bearer", "jwt"],
                              "description": "How a delivery proves it is the service's: hmac, a keyed hash of what it sends, in a header; standard-webhooks, signed as the Standard Webhooks specification signs a webhook; bearer, the secret itself, in a header; jwt, a JSON Web Token in a header, signed with the secret"
                            },
                            "secret": {
                              "type": "string",
                              "enum": ["subscription", "app"],
                              "description": "Which secret proves it: subscription, the subscription's own, which Auto makes or the service answers when Auto subscribes; app, the app's own, set once on the app at the vendor"
                            },
                            "hash": {
                              "type": "string",
                              "enum": ["sha256", "sha384", "sha512"],
                              "description": "For hmac, the hash function it keys"
                            },
                            "signed_payload": {
                              "type": "string",
                              "description": "For hmac, what is signed: {payload}, the body as sent, joined to {timestamp} and {id} where the service signs them, as in v0:{timestamp}:{payload}"
                            },
                            "signature": {
                              "type": "string",
                              "description": "For hmac, the header that carries the signature, as $request.header.<name>"
                            },
                            "prefix": {
                              "type": "string",
                              "minLength": 1,
                              "description": "What the signature or the token starts with before its value, such as sha256= or Bearer and a space"
                            },
                            "encoding": {
                              "type": "string",
                              "enum": ["hex", "base64"],
                              "description": "For hmac, how the signature is written"
                            },
                            "timestamp": {
                              "type": "string",
                              "description": "For hmac, the header or the field of the body that holds when the service sent the delivery"
                            },
                            "id": {
                              "type": "string",
                              "description": "For hmac, the header or the field of the body that holds the id of the delivery, the same on a retry"
                            },
                            "token": {
                              "type": "string",
                              "description": "For bearer and jwt, the header that carries it, as $request.header.<name>"
                            },
                            "alg": {
                              "type": "string",
                              "enum": ["HS256", "HS384", "HS512"],
                              "description": "For jwt, the algorithm the token is signed with, as JSON Web Algorithms names it"
                            }
                          },
                          "required": ["scheme", "secret"],
                          "additionalProperties": false
                        },
                        "handshake": {
                          "type": "object",
                          "properties": {
                            "when": {
                              "type": "object",
                              "additionalProperties": {
                                "type": "array",
                                "items": {
                                  "type": "string"
                                },
                                "minItems": 1
                              },
                              "description": "The arrival with which the service checks the address, as wake.when names an arrival"
                            },
                            "challenge": {
                              "type": "string",
                              "description": "Where the challenge the runtime answers is"
                            },
                            "response": {
                              "type": "object",
                              "additionalProperties": {
                                "type": "string",
                                "enum": ["challenge", "hmac"]
                              },
                              "description": "The fields of a JSON answer, each the challenge as it came or its hmac under the destination's secret, by the hash and encoding of its proof; left out, the challenge alone is answered as text"
                            },
                            "signed": {
                              "type": "boolean",
                              "description": "Whether the service proves the handshake as it proves a delivery, so that it is answered once proven; false where it comes before any secret exists, as WebSub's verification of intent does"
                            }
                          },
                          "required": ["when", "challenge", "signed"],
                          "additionalProperties": false,
                          "description": "How the service checks the address before it sends, as WebSub verifies intent"
                        },
                        "wake": {
                          "type": "object",
                          "properties": {
                            "when": {
                              "type": "object",
                              "additionalProperties": {
                                "type": "array",
                                "items": {
                                  "type": "string"
                                },
                                "minItems": 1
                              },
                              "description": "The arrivals that make Auto read now: each a runtime expression, a header or a field, with the values it may equal, every one of which holds"
                            },
                            "subscription": {
                              "type": "string",
                              "description": "Per subscription, where an arrival names the subscription it is for, so that only the conversations waiting through that subscription are read"
                            },
                            "conversation": {
                              "type": "string",
                              "description": "Where an arrival names the conversation it is about, as the answer of a request's delivery names it in sent.conversation, so that only the conversations waiting there are read"
                            },
                            "automatic": {
                              "type": "string",
                              "description": "Where an arrival holds something only when an app posted the message it is about, which then makes Auto read nothing, as the automatic of conversations passes such a message over"
                            }
                          },
                          "required": ["when"],
                          "additionalProperties": false,
                          "description": "Which arrivals make Auto read the conversations that wait, through the reading it does"
                        },
                        "connection": {
                          "type": "object",
                          "properties": {
                            "account": {
                              "type": "string",
                              "description": "Where an arrival names the vendor's account it happened in, such as a workspace, so that Auto finds the connections made in it"
                            },
                            "user": {
                              "type": "string",
                              "description": "Where an arrival names the vendor's user it is for, where the service sends for each person"
                            }
                          },
                          "required": ["account"],
                          "additionalProperties": false,
                          "description": "For a destination of the app, where an arrival names whose connection it is for"
                        },
                        "kind": {
                          "type": "string",
                          "enum": ["azure-event-hubs", "google-cloud-pubsub", "amazon-eventbridge"],
                          "description": "For queue, the queue the service delivers into, by its vendor's name for it"
                        },
                        "open": {
                          "type": "object",
                          "properties": {
                            "tool": {
                              "type": "string",
                              "description": "A tool of the connection that answers the socket's address, named as the server lists it"
                            },
                            "address": {
                              "type": "string",
                              "description": "Beside tool, a JSON Pointer into its answer, to the socket's address"
                            },
                            "url": {
                              "type": "string",
                              "description": "The socket's wss address, written out whole"
                            }
                          },
                          "additionalProperties": false,
                          "description": "How the runtime finds the address of the socket it opens"
                        },
                        "credential": {
                          "type": "string",
                          "pattern": "^[a-z][a-z0-9_]{0,63}$",
                          "description": "For websocket, the value of the app that opens the socket, named as the vendor names it, such as app_level_token"
                        },
                        "acknowledge": {
                          "type": "string",
                          "description": "For websocket, where a message names the id the runtime acknowledges it by"
                        },
                        "heartbeat_seconds": {
                          "type": "integer",
                          "minimum": 1,
                          "description": "For websocket, how often the service asks the runtime to send it a heartbeat, in seconds"
                        }
                      },
                      "required": ["type", "wake"],
                      "additionalProperties": false
                    },
                    "minItems": 1,
                    "description": "The ways the service sends what happens where a request waits, one of each type, in the order the runtime tries them, the first it can take serving"
                  }
                },
                "required": ["destinations"],
                "additionalProperties": false
              },
              "placeholders": {
                "type": "object",
                "additionalProperties": {
                  "type": "object",
                  "properties": {
                    "description": {
                      "type": "string",
                      "minLength": 1
                    },
                    "pattern": {
                      "type": "string"
                    },
                    "example": {
                      "type": "string"
                    },
                    "required": {
                      "type": "boolean"
                    },
                    "choices": {
                      "type": "array",
                      "items": {
                        "type": "object",
                        "properties": {
                          "value": {
                            "type": "string",
                            "minLength": 1
                          },
                          "title": {
                            "type": "string",
                            "minLength": 1
                          },
                          "sets": {
                            "type": "object",
                            "additionalProperties": {
                              "type": "string",
                              "minLength": 1
                            }
                          }
                        },
                        "required": ["value", "title"],
                        "additionalProperties": false
                      },
                      "minItems": 1
                    }
                  },
                  "required": ["description"],
                  "additionalProperties": false
                },
                "description": "The values that differ from one connection to the next, by name: each a description with a pattern and an example, or with choices"
              },
              "credentials": {
                "type": "array",
                "items": {
                  "type": "object",
                  "properties": {
                    "kind": {
                      "type": "string",
                      "enum": ["secret", "client_credentials", "none", "authorization"]
                    },
                    "in": {
                      "type": "string",
                      "enum": ["header", "query", "security"]
                    },
                    "name": {
                      "type": "string",
                      "minLength": 1
                    },
                    "scheme": {
                      "type": "string",
                      "minLength": 1
                    },
                    "issuer": {
                      "type": "string"
                    },
                    "scope": {
                      "type": "string"
                    },
                    "parameters": {
                      "type": "object",
                      "additionalProperties": {
                        "type": "string"
                      }
                    },
                    "authorization_endpoint": {
                      "type": "string"
                    },
                    "token_endpoint": {
                      "type": "string"
                    },
                    "revocation_endpoint": {
                      "type": "string"
                    },
                    "pkce": {
                      "type": "string",
                      "enum": ["none"]
                    },
                    "clients": {
                      "type": "array",
                      "items": {
                        "type": "string",
                        "enum": ["registered", "metadata_document", "dynamic"]
                      }
                    },
                    "oauth_client": {
                      "type": "string",
                      "enum": ["required"]
                    },
                    "says": {
                      "type": "object",
                      "additionalProperties": {
                        "type": "string",
                        "maxLength": 120,
                        "pattern": "^[A-Z][^.]*(?:\\.[^.\\s][^.]*)*\\.$"
                      }
                    },
                    "more": {
                      "type": "array",
                      "items": {
                        "type": "object",
                        "properties": {
                          "name": {
                            "type": "string",
                            "pattern": "^[a-z][a-z0-9_]{0,31}$",
                            "description": "The name a tool and a consent that asks more name the group by"
                          },
                          "for": {
                            "type": "string",
                            "maxLength": 120,
                            "pattern": "^[A-Z][^.]*(?:\\.[^.\\s][^.]*)*\\.$",
                            "description": "What the group is for, in one sentence of the person's words"
                          },
                          "scope": {
                            "type": "string",
                            "description": "The scopes it adds to those the way asks, separated by single spaces"
                          },
                          "says": {
                            "type": "object",
                            "additionalProperties": {
                              "type": "string",
                              "maxLength": 120,
                              "pattern": "^[A-Z][^.]*(?:\\.[^.\\s][^.]*)*\\.$"
                            },
                            "description": "What a connection can do through each scope it adds, by the scope"
                          }
                        },
                        "required": ["name", "for", "scope", "says"],
                        "additionalProperties": false
                      },
                      "minItems": 1
                    },
                    "ending_codes": {
                      "type": "array",
                      "items": {
                        "type": "string",
                        "minLength": 1
                      },
                      "minItems": 1,
                      "maxItems": 16,
                      "description": "For authorization, the error codes beside invalid_grant with which the token endpoint refuses a refresh because the consent has ended, so that the connection is broken rather than failing"
                    },
                    "gateway": {
                      "type": "object",
                      "properties": {
                        "url": {
                          "type": "string",
                          "description": "The https URL where the start, the hand-off and the end of a connection made through it are asked"
                        },
                        "audiences": {
                          "type": "object",
                          "properties": {
                            "connections": {
                              "type": "string",
                              "minLength": 1,
                              "description": "The aud of the note the gateway takes with the start, the hand-off and the end of a connection"
                            },
                            "calls": {
                              "type": "string",
                              "minLength": 1,
                              "description": "The aud of the note the gateway takes with a call"
                            }
                          },
                          "required": ["connections", "calls"],
                          "additionalProperties": false
                        },
                        "claims": {
                          "type": "array",
                          "items": {
                            "type": "string",
                            "enum": ["name", "playbook_name", "takes_answer"]
                          },
                          "description": "What the note may carry beside the ids: name and playbook_name, the person's and the playbook's display names, and takes_answer, true on the note of a call that delivers a request, which takes an answer; ids alone where it is left out"
                        }
                      },
                      "required": ["url", "audiences"],
                      "additionalProperties": false,
                      "description": "For authorization, the gateway a connection is made through: it makes the consent with its own client, keeps the vendor's tokens, and hands the runtime a key of the connection's own, sent under the security scheme name names"
                    },
                    "permissions": {
                      "type": "string",
                      "enum": ["application", "delegated"],
                      "description": "For authorization, whether a connection made this way acts as the app, application, or as the person who connects, delegated; delegated where it is left out"
                    },
                    "instructions": {
                      "type": "string",
                      "description": "For secret, how a person makes the key, in Markdown without HTML of at most 1,000 characters: where it is made, the plan or role it needs, the permissions it needs and its format",
                      "minLength": 1,
                      "maxLength": 1000
                    },
                    "key_page": {
                      "type": "string",
                      "description": "For secret, the https address of the page where a person makes the key"
                    },
                    "example": {
                      "type": "string",
                      "description": "For secret, what a key looks like, with an ellipsis in place of its characters, such as ghp_…, which the field of the key shows",
                      "maxLength": 100
                    },
                    "pattern": {
                      "type": "string",
                      "description": "For secret, beside example, the regular expression from ^ to $ every key matches, of at most 200 characters, by which the runtime refuses a value of another format"
                    },
                    "description": {
                      "type": "string",
                      "minLength": 1
                    }
                  },
                  "required": ["kind"],
                  "additionalProperties": false
                },
                "minItems": 1,
                "description": "The ways a credential reaches the server, in the order a person is offered them, the first the default, each of its own kind: secret, client_credentials, none or authorization; a way that asks a scope says, beside it, what a connection can do through each scope, and an authorization way that asks a scope may name in more the groups of scopes a later consent may add to it"
              }
            },
            "required": ["name", "title", "description", "website", "type", "credentials"],
            "additionalProperties": false
          }
        },
        "receive_events": {
          "type": "array",
          "items": {
            "type": "string",
            "enum": ["http"],
            "description": "A way the runtime receives what a connection's service sends: http, a delivery signed as the Standard Webhooks specification signs a webhook, at the connection's answer addresses"
          },
          "description": "The ways the runtime receives what a connection's service sends, of http; every way when left out, and none for an empty list, so a request is answered only through Auto or by reading its replies. CONNECTIONS_RECEIVE_EVENTS wins over it"
        }
      },
      "additionalProperties": false,
      "description": "What people may add as connections through their agents, tool servers of an org which every playbook of the org may use; the clients whoever runs the runtime registered at authorization servers, and whether Auto's clients serve as well; and the providers it adds beside those the runtime ships. CONNECTIONS wins over it"
    },
    "usage_ping": {
      "type": "boolean",
      "description": "Whether the runtime sends its anonymous usage ping when it starts: its release, the operating system, the processor, the version of Node.js, how it was installed and a random install id, and nothing of its work. On when left out; DO_NOT_TRACK or SCARF_NO_ANALYTICS in the environment turns it off too. USAGE_PING wins over it"
    },
    "payload_offloading": {
      "type": "boolean",
      "description": "Whether a payload larger than payload_size_threshold_bytes, the input, output or answer of a run, the prompt its record holds, a definition's document or a value a workflow holds, is offloaded: kept once in the content store, the ledger's database or the bucket of CONTENT_STORE_URL, and named in its record by its SHA-256 and its size, as the claim check pattern does. On when left out. Turning it off keeps new payloads in their records and still reads those offloaded before. PAYLOAD_OFFLOADING wins over it"
    },
    "payload_size_threshold_bytes": {
      "type": "integer",
      "minimum": 2048,
      "maximum": 65536,
      "description": "The size in bytes of UTF-8 past which a payload is offloaded, from 2048 to 65536; 16384 when left out. A change applies to new payloads alone. PAYLOAD_SIZE_THRESHOLD_BYTES wins over it"
    },
    "license": {
      "type": "object",
      "properties": {
        "key": {
          "type": "string",
          "description": "The key Studio gave as the account holder or an organization admin registered this runtime, written as a reference to the variable that holds it, such as ${LICENSE_KEY}. AUTO_RUNTIME_LICENSE_KEY wins over it"
        },
        "allocation": {
          "type": "string",
          "description": "The offline credits an operator of Auto signed for a runtime that does not reach Auto, the JSON of their payload, signature and kid, written as a reference to the variable that holds it, such as ${ALLOCATION}. AUTO_RUNTIME_ALLOCATION wins over it"
        }
      },
      "additionalProperties": false,
      "description": "The license of this runtime, which runs it on its org's credits past the 100 free runs and the free rate of 15 runs a UTC day and 75 a UTC month it runs without one: its key, and the offline credits of a runtime that does not reach Auto. AUTO_RUNTIME_LICENSE wins over it"
    },
    "extensions": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "package": {
            "type": "string",
            "maxLength": 214,
            "pattern": "^(?:@[a-z0-9][a-z0-9._~-]*\\/)?[a-z0-9][a-z0-9._~-]*$",
            "description": "The package of the extension, which the server imports by its name"
          },
          "integrity": {
            "type": "string",
            "pattern": "^sha512-[A-Za-z0-9+/]{86}==$",
            "description": "The integrity of the installed package, sha512- and the base64 of the SHA-512 of its files; a package whose files differ stops the start"
          }
        },
        "required": ["package"],
        "additionalProperties": false
      }
    }
  },
  "additionalProperties": false,
  "$defs": {}
}