Allow actions in this session without asking

curl --request POST \
  --url https://api.example.com/v1/sessions/{sessionId}/rules \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "rules": [
    {
      "action": "shell",
      "resource": "make deploy"
    },
    {
      "action": "network",
      "resource": "docs.rs"
    }
  ]
}
'

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/v1/sessions/{sessionId}/rules"

	payload := strings.NewReader("{\n  \"rules\": [\n    {\n      \"action\": \"shell\",\n      \"resource\": \"make deploy\"\n    },\n    {\n      \"action\": \"network\",\n      \"resource\": \"docs.rs\"\n    }\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    rules: [
      {action: 'shell', resource: 'make deploy'},
      {action: 'network', resource: 'docs.rs'}
    ]
  })
};

fetch('https://api.example.com/v1/sessions/{sessionId}/rules', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.example.com/v1/sessions/{sessionId}/rules"

payload = { "rules": [
        {
            "action": "shell",
            "resource": "make deploy"
        },
        {
            "action": "network",
            "resource": "docs.rs"
        }
    ] }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

{
  "code": "NRY-0002",
  "title": "Session not found",
  "message": "No session with id 6b9f6d2e-1c3a-4f5b-9d7e-2a8c4e6f0b1d exists on this host."
}

{
  "code": "NRY-0002",
  "title": "Session not found",
  "message": "No session with id 6b9f6d2e-1c3a-4f5b-9d7e-2a8c4e6f0b1d exists on this host."
}

{
  "code": "NRY-0002",
  "title": "Session not found",
  "message": "No session with id 6b9f6d2e-1c3a-4f5b-9d7e-2a8c4e6f0b1d exists on this host."
}

{
  "code": "NRY-0002",
  "title": "Session not found",
  "message": "No session with id 6b9f6d2e-1c3a-4f5b-9d7e-2a8c4e6f0b1d exists on this host."
}

{
  "code": "NRY-0002",
  "title": "Session not found",
  "message": "No session with id 6b9f6d2e-1c3a-4f5b-9d7e-2a8c4e6f0b1d exists on this host."
}

{
  "code": "NRY-0002",
  "title": "Session not found",
  "message": "No session with id 6b9f6d2e-1c3a-4f5b-9d7e-2a8c4e6f0b1d exists on this host."
}

Allow actions in this session without asking

Holds one allow rule per entry for the rest of this session’s life on this host, as answering a prompt “allow for this session” holds one: a rule in the grammar of a permissions.toml line whose effect is always allow, at the session scope: above the other scopes, under narya’s floor on writes to its own files. Nothing is stored; they go when the host stops. narya -p --allow sends them before its prompt, which is how an unattended run does the one thing it would otherwise refuse. The session’s owner alone may call it: a colleague’s answer releases one call. A rule permissions.toml would refuse, or one granting what a deny in the operator’s own permissions.toml refuses, is refused with 422 naming it, and nothing in the list is held.

POST

sessions

{sessionId}

rules

Allow actions in this session without asking

curl --request POST \
  --url https://api.example.com/v1/sessions/{sessionId}/rules \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "rules": [
    {
      "action": "shell",
      "resource": "make deploy"
    },
    {
      "action": "network",
      "resource": "docs.rs"
    }
  ]
}
'

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/v1/sessions/{sessionId}/rules"

	payload := strings.NewReader("{\n  \"rules\": [\n    {\n      \"action\": \"shell\",\n      \"resource\": \"make deploy\"\n    },\n    {\n      \"action\": \"network\",\n      \"resource\": \"docs.rs\"\n    }\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    rules: [
      {action: 'shell', resource: 'make deploy'},
      {action: 'network', resource: 'docs.rs'}
    ]
  })
};

fetch('https://api.example.com/v1/sessions/{sessionId}/rules', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.example.com/v1/sessions/{sessionId}/rules"

payload = { "rules": [
        {
            "action": "shell",
            "resource": "make deploy"
        },
        {
            "action": "network",
            "resource": "docs.rs"
        }
    ] }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

{
  "code": "NRY-0002",
  "title": "Session not found",
  "message": "No session with id 6b9f6d2e-1c3a-4f5b-9d7e-2a8c4e6f0b1d exists on this host."
}

{
  "code": "NRY-0002",
  "title": "Session not found",
  "message": "No session with id 6b9f6d2e-1c3a-4f5b-9d7e-2a8c4e6f0b1d exists on this host."
}

{
  "code": "NRY-0002",
  "title": "Session not found",
  "message": "No session with id 6b9f6d2e-1c3a-4f5b-9d7e-2a8c4e6f0b1d exists on this host."
}

{
  "code": "NRY-0002",
  "title": "Session not found",
  "message": "No session with id 6b9f6d2e-1c3a-4f5b-9d7e-2a8c4e6f0b1d exists on this host."
}

{
  "code": "NRY-0002",
  "title": "Session not found",
  "message": "No session with id 6b9f6d2e-1c3a-4f5b-9d7e-2a8c4e6f0b1d exists on this host."
}

{
  "code": "NRY-0002",
  "title": "Session not found",
  "message": "No session with id 6b9f6d2e-1c3a-4f5b-9d7e-2a8c4e6f0b1d exists on this host."
}

Authorizations

Authorization

string

header

required

Enforced on every transport, with no exempt operation. A person's request must carry a JWT issued by the configured identity provider, which the host verifies itself against that issuer's key set: signature, issuer, expiry, and the person and organisation it names. Requests without a valid one receive 401 NRY-0011 — except a request with no token on a laptop's socket from the OS user the kernel names as the host's own, which is that machine's user.

Path Parameters

sessionId

string<uuid>

required

The session's id.

Body

application/json

The allow rules to hold for one session, in the order they apply.

rules

object[]

required

Show child attributes

Response

Held. The next permission check in this session reads them.

Overview

Host

Sessions

Messages

Events

Lanes

Monitors

Agents

Skills and commands

Permissions

Peers

Packages

Extensions

Workflows

Schedules

Providers

Records

Environments

Sharing

Refinements

Platform

Error handling

Allow actions in this session without asking

Authorizations

Path Parameters

Body

Response