What publishing this session would send, and what it would hold back

curl --request GET \
  --url https://api.example.com/v1/sessions/{sessionId}/share/preview \
  --header 'Authorization: Bearer <token>'

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/v1/sessions/{sessionId}/share/preview"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.example.com/v1/sessions/{sessionId}/share/preview', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.example.com/v1/sessions/{sessionId}/share/preview"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

{
  "entries": [
    {
      "id": "3f1c9a52-8d4e-4b21-9c07-5e2a1d8b6f40",
      "kind": "user-message",
      "sequence": 1,
      "text": "deploy with ANTHROPIC_API_KEY=[redacted: masked-environment]"
    },
    {
      "id": "7a2d4e61-9b3c-4f18-8e05-1c6b3a9d2f57",
      "kind": "tool-result",
      "sequence": 2,
      "text": "ok  github.com/example/pkg  0.4s"
    }
  ],
  "withheld": [
    {
      "entryId": "3f1c9a52-8d4e-4b21-9c07-5e2a1d8b6f40",
      "rule": "masked-environment",
      "count": 1
    }
  ],
  "ruleCounts": {
    "masked-environment": 1
  }
}

{
  "code": "NRY-0002",
  "title": "Session not found",
  "message": "No session with id 6b9f6d2e-1c3a-4f5b-9d7e-2a8c4e6f0b1d exists on this host."
}

{
  "code": "NRY-0002",
  "title": "Session not found",
  "message": "No session with id 6b9f6d2e-1c3a-4f5b-9d7e-2a8c4e6f0b1d exists on this host."
}

{
  "code": "NRY-0002",
  "title": "Session not found",
  "message": "No session with id 6b9f6d2e-1c3a-4f5b-9d7e-2a8c4e6f0b1d exists on this host."
}

What publishing this session would send, and what it would hold back

Exactly what would leave this machine if the session were published to the organisation’s home, computed before anything leaves it. The entries carry the text as it would be sent — already redacted — and withheld names every place a rule held something back, so a person decides against the document rather than against a promise. A MATCHED RULE REDACTS IN PLACE AND NEVER DROPS. A withheld span is replaced by a marker naming the rule that took it, and the entry keeps its id, its kind and its place in the transcript — a reader can tell a withheld line from a line nobody wrote, which a gap in the sequence cannot say. The rules are the host’s, configured under [sharing.redaction], and every one of them is on unless somebody turned it off. A client computes none of it and holds no rule of its own.

GET

sessions

{sessionId}

preview

What publishing this session would send, and what it would hold back

curl --request GET \
  --url https://api.example.com/v1/sessions/{sessionId}/share/preview \
  --header 'Authorization: Bearer <token>'

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/v1/sessions/{sessionId}/share/preview"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.example.com/v1/sessions/{sessionId}/share/preview', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.example.com/v1/sessions/{sessionId}/share/preview"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

{
  "entries": [
    {
      "id": "3f1c9a52-8d4e-4b21-9c07-5e2a1d8b6f40",
      "kind": "user-message",
      "sequence": 1,
      "text": "deploy with ANTHROPIC_API_KEY=[redacted: masked-environment]"
    },
    {
      "id": "7a2d4e61-9b3c-4f18-8e05-1c6b3a9d2f57",
      "kind": "tool-result",
      "sequence": 2,
      "text": "ok  github.com/example/pkg  0.4s"
    }
  ],
  "withheld": [
    {
      "entryId": "3f1c9a52-8d4e-4b21-9c07-5e2a1d8b6f40",
      "rule": "masked-environment",
      "count": 1
    }
  ],
  "ruleCounts": {
    "masked-environment": 1
  }
}

{
  "code": "NRY-0002",
  "title": "Session not found",
  "message": "No session with id 6b9f6d2e-1c3a-4f5b-9d7e-2a8c4e6f0b1d exists on this host."
}

{
  "code": "NRY-0002",
  "title": "Session not found",
  "message": "No session with id 6b9f6d2e-1c3a-4f5b-9d7e-2a8c4e6f0b1d exists on this host."
}

{
  "code": "NRY-0002",
  "title": "Session not found",
  "message": "No session with id 6b9f6d2e-1c3a-4f5b-9d7e-2a8c4e6f0b1d exists on this host."
}

Autorizações

Authorization

string

header

obrigatório

Enforced on every transport, with no exempt operation. A person's request — over the default local unix socket exactly as over a TCP listener — must carry a JWT issued by the configured identity provider, which the host verifies itself against that issuer's key set: signature, issuer, expiry, and the person and organisation it names. Requests without a valid one receive 401 NRY-0011. The socket's file permissions are transport and are not an authorisation.

Parâmetros de caminho

sessionId

string<uuid>

obrigatório

The session's id.

Resposta

What a publish of this session would send, and what it withheld.

What publishing one session would send, and what it would hold back. The same object the publish then sends, computed by the same function in the host.

entries

object[]

obrigatório

The session as it would leave this machine, oldest first. Every entry of the transcript is here, redacted where a rule matched: the list is the document, not a selection from it.

Show child attributes

withheld

object[]

obrigatório

Every place a rule held something back, in transcript order — one item per entry per rule. This is what a client draws beside the conversation so a reader can see WHERE something was withheld; ruleCounts answers how much in total.

Show child attributes

ruleCounts

object

obrigatório

How many spans each rule withheld across the whole session, keyed by the rule's name. Empty when nothing was withheld.

Show child attributes

Visão geral

Host

Sessões

Mensagens

Eventos

Lanes

Monitores

Agentes

Skills e comandos

Permissões

Peers

Pacotes

Extensões

Workflows

Agendamentos

Provedores

Registros

Ambientes

Compartilhamento

Refinamentos

Plataforma

Tratamento de erros

What publishing this session would send, and what it would hold back

Autorizações

Parâmetros de caminho

Resposta