What publishing this session would send, and what it would hold back

curl --request GET \
  --url https://api.example.com/v1/sessions/{sessionId}/share/preview \
  --header 'Authorization: Bearer <token>'

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/v1/sessions/{sessionId}/share/preview"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.example.com/v1/sessions/{sessionId}/share/preview', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.example.com/v1/sessions/{sessionId}/share/preview"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

{
  "entries": [
    {
      "id": "3f1c9a52-8d4e-4b21-9c07-5e2a1d8b6f40",
      "kind": "user-message",
      "sequence": 1,
      "text": "deploy with ANTHROPIC_API_KEY=[redacted: masked-environment]"
    },
    {
      "id": "7a2d4e61-9b3c-4f18-8e05-1c6b3a9d2f57",
      "kind": "tool-result",
      "sequence": 2,
      "text": "ok  github.com/example/pkg  0.4s"
    }
  ],
  "withheld": [
    {
      "entryId": "3f1c9a52-8d4e-4b21-9c07-5e2a1d8b6f40",
      "rule": "masked-environment",
      "count": 1
    }
  ],
  "ruleCounts": {
    "masked-environment": 1
  }
}

{
  "code": "NRY-0002",
  "title": "Session not found",
  "message": "No session with id 6b9f6d2e-1c3a-4f5b-9d7e-2a8c4e6f0b1d exists on this host."
}

{
  "code": "NRY-0002",
  "title": "Session not found",
  "message": "No session with id 6b9f6d2e-1c3a-4f5b-9d7e-2a8c4e6f0b1d exists on this host."
}

{
  "code": "NRY-0002",
  "title": "Session not found",
  "message": "No session with id 6b9f6d2e-1c3a-4f5b-9d7e-2a8c4e6f0b1d exists on this host."
}

What publishing this session would send, and what it would hold back

Exactly what would leave this machine if the session were published to the organisation’s home, computed before anything leaves it. The entries carry the text as it would be sent — already redacted — and withheld names every place a rule held something back, so a person decides against the document rather than against a promise. A MATCHED RULE REDACTS IN PLACE AND NEVER DROPS. A withheld span is replaced by a marker naming the rule that took it, and the entry keeps its id, its kind and its place in the transcript — a reader can tell a withheld line from a line nobody wrote, which a gap in the sequence cannot say. The rules are the host’s, configured under [sharing.redaction], and every one of them is on unless somebody turned it off. A client computes none of it and holds no rule of its own.

GET

sessions

{sessionId}

preview

What publishing this session would send, and what it would hold back

curl --request GET \
  --url https://api.example.com/v1/sessions/{sessionId}/share/preview \
  --header 'Authorization: Bearer <token>'

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/v1/sessions/{sessionId}/share/preview"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.example.com/v1/sessions/{sessionId}/share/preview', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.example.com/v1/sessions/{sessionId}/share/preview"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

{
  "entries": [
    {
      "id": "3f1c9a52-8d4e-4b21-9c07-5e2a1d8b6f40",
      "kind": "user-message",
      "sequence": 1,
      "text": "deploy with ANTHROPIC_API_KEY=[redacted: masked-environment]"
    },
    {
      "id": "7a2d4e61-9b3c-4f18-8e05-1c6b3a9d2f57",
      "kind": "tool-result",
      "sequence": 2,
      "text": "ok  github.com/example/pkg  0.4s"
    }
  ],
  "withheld": [
    {
      "entryId": "3f1c9a52-8d4e-4b21-9c07-5e2a1d8b6f40",
      "rule": "masked-environment",
      "count": 1
    }
  ],
  "ruleCounts": {
    "masked-environment": 1
  }
}

{
  "code": "NRY-0002",
  "title": "Session not found",
  "message": "No session with id 6b9f6d2e-1c3a-4f5b-9d7e-2a8c4e6f0b1d exists on this host."
}

{
  "code": "NRY-0002",
  "title": "Session not found",
  "message": "No session with id 6b9f6d2e-1c3a-4f5b-9d7e-2a8c4e6f0b1d exists on this host."
}

{
  "code": "NRY-0002",
  "title": "Session not found",
  "message": "No session with id 6b9f6d2e-1c3a-4f5b-9d7e-2a8c4e6f0b1d exists on this host."
}

Autorizaciones

Authorization

string

header

requerido

Enforced on every transport, with no exempt operation. A person's request — over the default local unix socket exactly as over a TCP listener — must carry a JWT issued by the configured identity provider, which the host verifies itself against that issuer's key set: signature, issuer, expiry, and the person and organisation it names. Requests without a valid one receive 401 NRY-0011. The socket's file permissions are transport and are not an authorisation.

Parámetros de ruta

sessionId

string<uuid>

requerido

The session's id.

Respuesta

What a publish of this session would send, and what it withheld.

What publishing one session would send, and what it would hold back. The same object the publish then sends, computed by the same function in the host.

entries

object[]

requerido

The session as it would leave this machine, oldest first. Every entry of the transcript is here, redacted where a rule matched: the list is the document, not a selection from it.

Show child attributes

withheld

object[]

requerido

Every place a rule held something back, in transcript order — one item per entry per rule. This is what a client draws beside the conversation so a reader can see WHERE something was withheld; ruleCounts answers how much in total.

Show child attributes

ruleCounts

object

requerido

How many spans each rule withheld across the whole session, keyed by the rule's name. Empty when nothing was withheld.

Show child attributes

Resumen

Host

Sesiones

Mensajes

Eventos

Lanes

Monitores

Agentes

Skills y comandos

Permisos

Peers

Paquetes

Extensiones

Workflows

Programaciones

Proveedores

Registros

Entornos

Compartir

Refinamientos

Plataforma

Manejo de errores

What publishing this session would send, and what it would hold back

Autorizaciones

Parámetros de ruta

Respuesta