# Tool Calls

## List objective tool calls

`$ cadenya objectives:tool-calls list`

**get** `/v1/objectives/{objectiveId}/tool_calls`

Lists all tool calls for an objective

### Parameters

- `--objective-id: string`

  The objective ID to return tool calls for

- `--cursor: optional string`

  Pagination cursor from previous response

- `--include-info: optional boolean`

  When set to true you may use more of your alloted API rate-limit

- `--limit: optional number`

  Maximum number of results to return

- `--status: optional "TOOL_CALL_STATUS_UNSPECIFIED" or "TOOL_CALL_STATUS_AUTO_APPROVED" or "TOOL_CALL_STATUS_WAITING_FOR_APPROVAL" or 2 more`

  Filter by tool call status

### Returns

- `ListObjectiveToolCallsResponse: object { items, pagination }`

  - `items: optional array of ObjectiveToolCall`

    - `data: object { callable, arguments, memo, 2 more }`

      - `callable: object { agent, cadenyaProvidedTool, tool }`

        CallableTool is a union that represents a tool that can be called by an agent. In Cadenya, a tool that is used within an agent objective
        might be a user-defined tool (IE: MCP, HTTP), another Agent (useful to separate context), or a Cadenya Tool (one Cadenya provides).

        - `agent: optional object { id, accountId, createdAt, 5 more }`

          Standard metadata for persistent, named resources (e.g., agents, tools, prompts)

          - `id: string`

            Unique identifier for the resource (prefixed ULID, e.g., "agent_01HXK...")

          - `accountId: string`

            Account this resource belongs to for multi-tenant isolation (prefixed ULID)

          - `createdAt: string`

            Timestamp when this resource was created

          - `name: string`

            Human-readable name for the resource (e.g., "Customer Support Agent", "Email Tool")
            Required for resources that users interact with directly

          - `profileId: string`

            ID of the actor (user or service account) that created this resource

          - `workspaceId: string`

            Workspace this resource belongs to for organizational grouping (prefixed ULID)

          - `externalId: optional string`

            External ID for the resource (e.g., a workflow ID from an external system)

          - `labels: optional map[string]`

            Arbitrary key-value pairs for categorization and filtering
            Examples: {"environment": "production", "team": "platform", "version": "v2"}

        - `cadenyaProvidedTool: optional object { id, accountId, createdAt, 5 more }`

          Standard metadata for persistent, named resources (e.g., agents, tools, prompts)

          - `id: string`

            Unique identifier for the resource (prefixed ULID, e.g., "agent_01HXK...")

          - `accountId: string`

            Account this resource belongs to for multi-tenant isolation (prefixed ULID)

          - `createdAt: string`

            Timestamp when this resource was created

          - `name: string`

            Human-readable name for the resource (e.g., "Customer Support Agent", "Email Tool")
            Required for resources that users interact with directly

          - `profileId: string`

            ID of the actor (user or service account) that created this resource

          - `workspaceId: string`

            Workspace this resource belongs to for organizational grouping (prefixed ULID)

          - `externalId: optional string`

            External ID for the resource (e.g., a workflow ID from an external system)

          - `labels: optional map[string]`

            Arbitrary key-value pairs for categorization and filtering
            Examples: {"environment": "production", "team": "platform", "version": "v2"}

        - `tool: optional object { id, accountId, createdAt, 5 more }`

          Standard metadata for persistent, named resources (e.g., agents, tools, prompts)

          - `id: string`

            Unique identifier for the resource (prefixed ULID, e.g., "agent_01HXK...")

          - `accountId: string`

            Account this resource belongs to for multi-tenant isolation (prefixed ULID)

          - `createdAt: string`

            Timestamp when this resource was created

          - `name: string`

            Human-readable name for the resource (e.g., "Customer Support Agent", "Email Tool")
            Required for resources that users interact with directly

          - `profileId: string`

            ID of the actor (user or service account) that created this resource

          - `workspaceId: string`

            Workspace this resource belongs to for organizational grouping (prefixed ULID)

          - `externalId: optional string`

            External ID for the resource (e.g., a workflow ID from an external system)

          - `labels: optional map[string]`

            Arbitrary key-value pairs for categorization and filtering
            Examples: {"environment": "production", "team": "platform", "version": "v2"}

      - `arguments: optional map[unknown]`

        The arguments passed to the tool

      - `memo: optional string`

        A memo supplied by the reviewer when denying the tool call

      - `result: optional string`

        The result content returned by the tool after execution

      - `statusChangedBy: optional object { metadata, spec }`

        Profile represents a human user at the account level.
        Profiles are account-scoped resources that can be associated with multiple workspaces
        through the Actor model. Authentication for profiles is handled via SSO/OAuth (WorkOS).

        - `metadata: object { id, accountId, name, 3 more }`

          AccountResourceMetadata is used to represent a resource that is associated to an account but not to a workspace.

          - `id: string`

            Unique identifier for the resource (prefixed ULID, e.g., "apikey_01HXK...")

          - `accountId: string`

            Account this resource belongs to for multi-tenant isolation (prefixed ULID)

          - `name: string`

            Human-readable name for the resource (e.g., "Customer Support Agent", "Email Tool")
            Required for resources that users interact with directly

          - `profileId: string`

          - `externalId: optional string`

            External ID for the resource (e.g., a workflow ID from an external system)

          - `labels: optional map[string]`

            Arbitrary key-value pairs for categorization and filtering
            Examples: {"environment": "production", "team": "platform", "version": "v2"}

        - `spec: object { type, email, name }`

          ProfileSpec contains the profile-specific fields

          - `type: "PROFILE_TYPE_USER" or "PROFILE_TYPE_API_KEY" or "PROFILE_TYPE_SYSTEM"`

            Type is the type of profile. User's are humans, API keys are computers. You know the deal.

            - `"PROFILE_TYPE_USER"`

            - `"PROFILE_TYPE_API_KEY"`

            - `"PROFILE_TYPE_SYSTEM"`

          - `email: optional string`

            Email address of the user (required, unique per account)

          - `name: optional string`

            Display name for the user (e.g., "Bobby Tables")

    - `metadata: object { id, accountId, createdAt, 4 more }`

      Metadata for ephemeral operations and activities (e.g., objectives, executions, runs)

      - `id: string`

        Unique identifier for the operation (prefixed ULID, e.g., "obj_01HXK...")

      - `accountId: string`

        Account this operation belongs to for multi-tenant isolation (prefixed ULID)

      - `createdAt: string`

        Timestamp when this operation was created
        ULID includes timestamp information, but this explicit field enables easier querying

      - `profileId: string`

        ID of the actor (user or service account) that created this operation

      - `workspaceId: string`

        Workspace this operation belongs to for organizational grouping (prefixed ULID)

      - `externalId: optional string`

        External ID for the operation (e.g., a workflow ID from an external system)

      - `labels: optional map[string]`

        Arbitrary key-value pairs for categorization and filtering
        Examples: {"priority": "high", "source": "api", "workflow": "onboarding"}

    - `status: "TOOL_CALL_STATUS_UNSPECIFIED" or "TOOL_CALL_STATUS_AUTO_APPROVED" or "TOOL_CALL_STATUS_WAITING_FOR_APPROVAL" or 2 more`

      Current status of the tool call

      - `"TOOL_CALL_STATUS_UNSPECIFIED"`

      - `"TOOL_CALL_STATUS_AUTO_APPROVED"`

      - `"TOOL_CALL_STATUS_WAITING_FOR_APPROVAL"`

      - `"TOOL_CALL_STATUS_APPROVED"`

      - `"TOOL_CALL_STATUS_DENIED"`

    - `executionStatus: optional "TOOL_CALL_EXECUTION_STATUS_UNSPECIFIED" or "TOOL_CALL_EXECUTION_STATUS_PENDING" or "TOOL_CALL_EXECUTION_STATUS_RUNNING" or 2 more`

      - `"TOOL_CALL_EXECUTION_STATUS_UNSPECIFIED"`

      - `"TOOL_CALL_EXECUTION_STATUS_PENDING"`

      - `"TOOL_CALL_EXECUTION_STATUS_RUNNING"`

      - `"TOOL_CALL_EXECUTION_STATUS_COMPLETED"`

      - `"TOOL_CALL_EXECUTION_STATUS_ERRORED"`

    - `info: optional object { createdBy, objective }`

      - `createdBy: optional object { metadata, spec }`

        Profile represents a human user at the account level.
        Profiles are account-scoped resources that can be associated with multiple workspaces
        through the Actor model. Authentication for profiles is handled via SSO/OAuth (WorkOS).

        - `metadata: object { id, accountId, name, 3 more }`

          AccountResourceMetadata is used to represent a resource that is associated to an account but not to a workspace.

        - `spec: object { type, email, name }`

          ProfileSpec contains the profile-specific fields

      - `objective: optional object { id, accountId, createdAt, 4 more }`

        Metadata for ephemeral operations and activities (e.g., objectives, executions, runs)

        - `id: string`

          Unique identifier for the operation (prefixed ULID, e.g., "obj_01HXK...")

        - `accountId: string`

          Account this operation belongs to for multi-tenant isolation (prefixed ULID)

        - `createdAt: string`

          Timestamp when this operation was created
          ULID includes timestamp information, but this explicit field enables easier querying

        - `profileId: string`

          ID of the actor (user or service account) that created this operation

        - `workspaceId: string`

          Workspace this operation belongs to for organizational grouping (prefixed ULID)

        - `externalId: optional string`

          External ID for the operation (e.g., a workflow ID from an external system)

        - `labels: optional map[string]`

          Arbitrary key-value pairs for categorization and filtering
          Examples: {"priority": "high", "source": "api", "workflow": "onboarding"}

  - `pagination: optional object { nextCursor, total }`

    - `nextCursor: optional string`

    - `total: optional number`

### Example

```cli
cadenya objectives:tool-calls list \
  --api-key 'My API Key' \
  --objective-id objectiveId
```

#### Response

```json
{
  "items": [
    {
      "data": {
        "callable": {
          "agent": {
            "id": "id",
            "accountId": "accountId",
            "createdAt": "2019-12-27T18:11:19.117Z",
            "name": "name",
            "profileId": "profileId",
            "workspaceId": "workspaceId",
            "externalId": "externalId",
            "labels": {
              "foo": "string"
            }
          },
          "cadenyaProvidedTool": {
            "id": "id",
            "accountId": "accountId",
            "createdAt": "2019-12-27T18:11:19.117Z",
            "name": "name",
            "profileId": "profileId",
            "workspaceId": "workspaceId",
            "externalId": "externalId",
            "labels": {
              "foo": "string"
            }
          },
          "tool": {
            "id": "id",
            "accountId": "accountId",
            "createdAt": "2019-12-27T18:11:19.117Z",
            "name": "name",
            "profileId": "profileId",
            "workspaceId": "workspaceId",
            "externalId": "externalId",
            "labels": {
              "foo": "string"
            }
          }
        },
        "arguments": {
          "foo": "bar"
        },
        "memo": "memo",
        "result": "result",
        "statusChangedBy": {
          "metadata": {
            "id": "id",
            "accountId": "accountId",
            "name": "name",
            "profileId": "profileId",
            "externalId": "externalId",
            "labels": {
              "foo": "string"
            }
          },
          "spec": {
            "type": "PROFILE_TYPE_USER",
            "email": "email",
            "name": "name"
          }
        }
      },
      "metadata": {
        "id": "id",
        "accountId": "accountId",
        "createdAt": "2019-12-27T18:11:19.117Z",
        "profileId": "profileId",
        "workspaceId": "workspaceId",
        "externalId": "externalId",
        "labels": {
          "foo": "string"
        }
      },
      "status": "TOOL_CALL_STATUS_UNSPECIFIED",
      "executionStatus": "TOOL_CALL_EXECUTION_STATUS_UNSPECIFIED",
      "info": {
        "createdBy": {
          "metadata": {
            "id": "id",
            "accountId": "accountId",
            "name": "name",
            "profileId": "profileId",
            "externalId": "externalId",
            "labels": {
              "foo": "string"
            }
          },
          "spec": {
            "type": "PROFILE_TYPE_USER",
            "email": "email",
            "name": "name"
          }
        },
        "objective": {
          "id": "id",
          "accountId": "accountId",
          "createdAt": "2019-12-27T18:11:19.117Z",
          "profileId": "profileId",
          "workspaceId": "workspaceId",
          "externalId": "externalId",
          "labels": {
            "foo": "string"
          }
        }
      }
    }
  ],
  "pagination": {
    "nextCursor": "nextCursor",
    "total": 0
  }
}
```

## Approve a tool call

`$ cadenya objectives:tool-calls approve`

**put** `/v1/objectives/{objectiveId}/tool_calls/{toolCallId}/approve`

When an agent attempts to use a tool that requires approval, use this endpoint to mark it as approved.

### Parameters

- `--objective-id: string`

  The ID of the objective. Supports "external_id:" prefix for external IDs.

- `--tool-call-id: string`

  The ID of the tool call to approve

### Returns

- `objective_tool_call: object { data, metadata, status, 2 more }`

  ObjectiveToolCall is a record of a tool call made during an objective's execution.
  Tool calls are mutable — their status changes as they are approved, denied, or executed.

  - `data: object { callable, arguments, memo, 2 more }`

    - `callable: object { agent, cadenyaProvidedTool, tool }`

      CallableTool is a union that represents a tool that can be called by an agent. In Cadenya, a tool that is used within an agent objective
      might be a user-defined tool (IE: MCP, HTTP), another Agent (useful to separate context), or a Cadenya Tool (one Cadenya provides).

      - `agent: optional object { id, accountId, createdAt, 5 more }`

        Standard metadata for persistent, named resources (e.g., agents, tools, prompts)

        - `id: string`

          Unique identifier for the resource (prefixed ULID, e.g., "agent_01HXK...")

        - `accountId: string`

          Account this resource belongs to for multi-tenant isolation (prefixed ULID)

        - `createdAt: string`

          Timestamp when this resource was created

        - `name: string`

          Human-readable name for the resource (e.g., "Customer Support Agent", "Email Tool")
          Required for resources that users interact with directly

        - `profileId: string`

          ID of the actor (user or service account) that created this resource

        - `workspaceId: string`

          Workspace this resource belongs to for organizational grouping (prefixed ULID)

        - `externalId: optional string`

          External ID for the resource (e.g., a workflow ID from an external system)

        - `labels: optional map[string]`

          Arbitrary key-value pairs for categorization and filtering
          Examples: {"environment": "production", "team": "platform", "version": "v2"}

      - `cadenyaProvidedTool: optional object { id, accountId, createdAt, 5 more }`

        Standard metadata for persistent, named resources (e.g., agents, tools, prompts)

        - `id: string`

          Unique identifier for the resource (prefixed ULID, e.g., "agent_01HXK...")

        - `accountId: string`

          Account this resource belongs to for multi-tenant isolation (prefixed ULID)

        - `createdAt: string`

          Timestamp when this resource was created

        - `name: string`

          Human-readable name for the resource (e.g., "Customer Support Agent", "Email Tool")
          Required for resources that users interact with directly

        - `profileId: string`

          ID of the actor (user or service account) that created this resource

        - `workspaceId: string`

          Workspace this resource belongs to for organizational grouping (prefixed ULID)

        - `externalId: optional string`

          External ID for the resource (e.g., a workflow ID from an external system)

        - `labels: optional map[string]`

          Arbitrary key-value pairs for categorization and filtering
          Examples: {"environment": "production", "team": "platform", "version": "v2"}

      - `tool: optional object { id, accountId, createdAt, 5 more }`

        Standard metadata for persistent, named resources (e.g., agents, tools, prompts)

        - `id: string`

          Unique identifier for the resource (prefixed ULID, e.g., "agent_01HXK...")

        - `accountId: string`

          Account this resource belongs to for multi-tenant isolation (prefixed ULID)

        - `createdAt: string`

          Timestamp when this resource was created

        - `name: string`

          Human-readable name for the resource (e.g., "Customer Support Agent", "Email Tool")
          Required for resources that users interact with directly

        - `profileId: string`

          ID of the actor (user or service account) that created this resource

        - `workspaceId: string`

          Workspace this resource belongs to for organizational grouping (prefixed ULID)

        - `externalId: optional string`

          External ID for the resource (e.g., a workflow ID from an external system)

        - `labels: optional map[string]`

          Arbitrary key-value pairs for categorization and filtering
          Examples: {"environment": "production", "team": "platform", "version": "v2"}

    - `arguments: optional map[unknown]`

      The arguments passed to the tool

    - `memo: optional string`

      A memo supplied by the reviewer when denying the tool call

    - `result: optional string`

      The result content returned by the tool after execution

    - `statusChangedBy: optional object { metadata, spec }`

      Profile represents a human user at the account level.
      Profiles are account-scoped resources that can be associated with multiple workspaces
      through the Actor model. Authentication for profiles is handled via SSO/OAuth (WorkOS).

      - `metadata: object { id, accountId, name, 3 more }`

        AccountResourceMetadata is used to represent a resource that is associated to an account but not to a workspace.

        - `id: string`

          Unique identifier for the resource (prefixed ULID, e.g., "apikey_01HXK...")

        - `accountId: string`

          Account this resource belongs to for multi-tenant isolation (prefixed ULID)

        - `name: string`

          Human-readable name for the resource (e.g., "Customer Support Agent", "Email Tool")
          Required for resources that users interact with directly

        - `profileId: string`

        - `externalId: optional string`

          External ID for the resource (e.g., a workflow ID from an external system)

        - `labels: optional map[string]`

          Arbitrary key-value pairs for categorization and filtering
          Examples: {"environment": "production", "team": "platform", "version": "v2"}

      - `spec: object { type, email, name }`

        ProfileSpec contains the profile-specific fields

        - `type: "PROFILE_TYPE_USER" or "PROFILE_TYPE_API_KEY" or "PROFILE_TYPE_SYSTEM"`

          Type is the type of profile. User's are humans, API keys are computers. You know the deal.

          - `"PROFILE_TYPE_USER"`

          - `"PROFILE_TYPE_API_KEY"`

          - `"PROFILE_TYPE_SYSTEM"`

        - `email: optional string`

          Email address of the user (required, unique per account)

        - `name: optional string`

          Display name for the user (e.g., "Bobby Tables")

  - `metadata: object { id, accountId, createdAt, 4 more }`

    Metadata for ephemeral operations and activities (e.g., objectives, executions, runs)

    - `id: string`

      Unique identifier for the operation (prefixed ULID, e.g., "obj_01HXK...")

    - `accountId: string`

      Account this operation belongs to for multi-tenant isolation (prefixed ULID)

    - `createdAt: string`

      Timestamp when this operation was created
      ULID includes timestamp information, but this explicit field enables easier querying

    - `profileId: string`

      ID of the actor (user or service account) that created this operation

    - `workspaceId: string`

      Workspace this operation belongs to for organizational grouping (prefixed ULID)

    - `externalId: optional string`

      External ID for the operation (e.g., a workflow ID from an external system)

    - `labels: optional map[string]`

      Arbitrary key-value pairs for categorization and filtering
      Examples: {"priority": "high", "source": "api", "workflow": "onboarding"}

  - `status: "TOOL_CALL_STATUS_UNSPECIFIED" or "TOOL_CALL_STATUS_AUTO_APPROVED" or "TOOL_CALL_STATUS_WAITING_FOR_APPROVAL" or 2 more`

    Current status of the tool call

    - `"TOOL_CALL_STATUS_UNSPECIFIED"`

    - `"TOOL_CALL_STATUS_AUTO_APPROVED"`

    - `"TOOL_CALL_STATUS_WAITING_FOR_APPROVAL"`

    - `"TOOL_CALL_STATUS_APPROVED"`

    - `"TOOL_CALL_STATUS_DENIED"`

  - `executionStatus: optional "TOOL_CALL_EXECUTION_STATUS_UNSPECIFIED" or "TOOL_CALL_EXECUTION_STATUS_PENDING" or "TOOL_CALL_EXECUTION_STATUS_RUNNING" or 2 more`

    - `"TOOL_CALL_EXECUTION_STATUS_UNSPECIFIED"`

    - `"TOOL_CALL_EXECUTION_STATUS_PENDING"`

    - `"TOOL_CALL_EXECUTION_STATUS_RUNNING"`

    - `"TOOL_CALL_EXECUTION_STATUS_COMPLETED"`

    - `"TOOL_CALL_EXECUTION_STATUS_ERRORED"`

  - `info: optional object { createdBy, objective }`

    - `createdBy: optional object { metadata, spec }`

      Profile represents a human user at the account level.
      Profiles are account-scoped resources that can be associated with multiple workspaces
      through the Actor model. Authentication for profiles is handled via SSO/OAuth (WorkOS).

      - `metadata: object { id, accountId, name, 3 more }`

        AccountResourceMetadata is used to represent a resource that is associated to an account but not to a workspace.

      - `spec: object { type, email, name }`

        ProfileSpec contains the profile-specific fields

    - `objective: optional object { id, accountId, createdAt, 4 more }`

      Metadata for ephemeral operations and activities (e.g., objectives, executions, runs)

      - `id: string`

        Unique identifier for the operation (prefixed ULID, e.g., "obj_01HXK...")

      - `accountId: string`

        Account this operation belongs to for multi-tenant isolation (prefixed ULID)

      - `createdAt: string`

        Timestamp when this operation was created
        ULID includes timestamp information, but this explicit field enables easier querying

      - `profileId: string`

        ID of the actor (user or service account) that created this operation

      - `workspaceId: string`

        Workspace this operation belongs to for organizational grouping (prefixed ULID)

      - `externalId: optional string`

        External ID for the operation (e.g., a workflow ID from an external system)

      - `labels: optional map[string]`

        Arbitrary key-value pairs for categorization and filtering
        Examples: {"priority": "high", "source": "api", "workflow": "onboarding"}

### Example

```cli
cadenya objectives:tool-calls approve \
  --api-key 'My API Key' \
  --objective-id objectiveId \
  --tool-call-id toolCallId
```

#### Response

```json
{
  "data": {
    "callable": {
      "agent": {
        "id": "id",
        "accountId": "accountId",
        "createdAt": "2019-12-27T18:11:19.117Z",
        "name": "name",
        "profileId": "profileId",
        "workspaceId": "workspaceId",
        "externalId": "externalId",
        "labels": {
          "foo": "string"
        }
      },
      "cadenyaProvidedTool": {
        "id": "id",
        "accountId": "accountId",
        "createdAt": "2019-12-27T18:11:19.117Z",
        "name": "name",
        "profileId": "profileId",
        "workspaceId": "workspaceId",
        "externalId": "externalId",
        "labels": {
          "foo": "string"
        }
      },
      "tool": {
        "id": "id",
        "accountId": "accountId",
        "createdAt": "2019-12-27T18:11:19.117Z",
        "name": "name",
        "profileId": "profileId",
        "workspaceId": "workspaceId",
        "externalId": "externalId",
        "labels": {
          "foo": "string"
        }
      }
    },
    "arguments": {
      "foo": "bar"
    },
    "memo": "memo",
    "result": "result",
    "statusChangedBy": {
      "metadata": {
        "id": "id",
        "accountId": "accountId",
        "name": "name",
        "profileId": "profileId",
        "externalId": "externalId",
        "labels": {
          "foo": "string"
        }
      },
      "spec": {
        "type": "PROFILE_TYPE_USER",
        "email": "email",
        "name": "name"
      }
    }
  },
  "metadata": {
    "id": "id",
    "accountId": "accountId",
    "createdAt": "2019-12-27T18:11:19.117Z",
    "profileId": "profileId",
    "workspaceId": "workspaceId",
    "externalId": "externalId",
    "labels": {
      "foo": "string"
    }
  },
  "status": "TOOL_CALL_STATUS_UNSPECIFIED",
  "executionStatus": "TOOL_CALL_EXECUTION_STATUS_UNSPECIFIED",
  "info": {
    "createdBy": {
      "metadata": {
        "id": "id",
        "accountId": "accountId",
        "name": "name",
        "profileId": "profileId",
        "externalId": "externalId",
        "labels": {
          "foo": "string"
        }
      },
      "spec": {
        "type": "PROFILE_TYPE_USER",
        "email": "email",
        "name": "name"
      }
    },
    "objective": {
      "id": "id",
      "accountId": "accountId",
      "createdAt": "2019-12-27T18:11:19.117Z",
      "profileId": "profileId",
      "workspaceId": "workspaceId",
      "externalId": "externalId",
      "labels": {
        "foo": "string"
      }
    }
  }
}
```

## Deny a tool call

`$ cadenya objectives:tool-calls deny`

**put** `/v1/objectives/{objectiveId}/tool_calls/{toolCallId}/deny`

When an agent attempts to use a tool that requires approval, use this endpoint to mark it as denied. Use a memo to steer the LLM to a different decision or usage of the tool.

### Parameters

- `--objective-id: string`

  The ID of the objective. Supports "external_id:" prefix for external IDs.

- `--tool-call-id: string`

  The ID of the tool call to deny

- `--memo: optional string`

  A memo to associate to the tool call denial. Use a memo to steer the LLM to a different decision or usage of the tool.

### Returns

- `objective_tool_call: object { data, metadata, status, 2 more }`

  ObjectiveToolCall is a record of a tool call made during an objective's execution.
  Tool calls are mutable — their status changes as they are approved, denied, or executed.

  - `data: object { callable, arguments, memo, 2 more }`

    - `callable: object { agent, cadenyaProvidedTool, tool }`

      CallableTool is a union that represents a tool that can be called by an agent. In Cadenya, a tool that is used within an agent objective
      might be a user-defined tool (IE: MCP, HTTP), another Agent (useful to separate context), or a Cadenya Tool (one Cadenya provides).

      - `agent: optional object { id, accountId, createdAt, 5 more }`

        Standard metadata for persistent, named resources (e.g., agents, tools, prompts)

        - `id: string`

          Unique identifier for the resource (prefixed ULID, e.g., "agent_01HXK...")

        - `accountId: string`

          Account this resource belongs to for multi-tenant isolation (prefixed ULID)

        - `createdAt: string`

          Timestamp when this resource was created

        - `name: string`

          Human-readable name for the resource (e.g., "Customer Support Agent", "Email Tool")
          Required for resources that users interact with directly

        - `profileId: string`

          ID of the actor (user or service account) that created this resource

        - `workspaceId: string`

          Workspace this resource belongs to for organizational grouping (prefixed ULID)

        - `externalId: optional string`

          External ID for the resource (e.g., a workflow ID from an external system)

        - `labels: optional map[string]`

          Arbitrary key-value pairs for categorization and filtering
          Examples: {"environment": "production", "team": "platform", "version": "v2"}

      - `cadenyaProvidedTool: optional object { id, accountId, createdAt, 5 more }`

        Standard metadata for persistent, named resources (e.g., agents, tools, prompts)

        - `id: string`

          Unique identifier for the resource (prefixed ULID, e.g., "agent_01HXK...")

        - `accountId: string`

          Account this resource belongs to for multi-tenant isolation (prefixed ULID)

        - `createdAt: string`

          Timestamp when this resource was created

        - `name: string`

          Human-readable name for the resource (e.g., "Customer Support Agent", "Email Tool")
          Required for resources that users interact with directly

        - `profileId: string`

          ID of the actor (user or service account) that created this resource

        - `workspaceId: string`

          Workspace this resource belongs to for organizational grouping (prefixed ULID)

        - `externalId: optional string`

          External ID for the resource (e.g., a workflow ID from an external system)

        - `labels: optional map[string]`

          Arbitrary key-value pairs for categorization and filtering
          Examples: {"environment": "production", "team": "platform", "version": "v2"}

      - `tool: optional object { id, accountId, createdAt, 5 more }`

        Standard metadata for persistent, named resources (e.g., agents, tools, prompts)

        - `id: string`

          Unique identifier for the resource (prefixed ULID, e.g., "agent_01HXK...")

        - `accountId: string`

          Account this resource belongs to for multi-tenant isolation (prefixed ULID)

        - `createdAt: string`

          Timestamp when this resource was created

        - `name: string`

          Human-readable name for the resource (e.g., "Customer Support Agent", "Email Tool")
          Required for resources that users interact with directly

        - `profileId: string`

          ID of the actor (user or service account) that created this resource

        - `workspaceId: string`

          Workspace this resource belongs to for organizational grouping (prefixed ULID)

        - `externalId: optional string`

          External ID for the resource (e.g., a workflow ID from an external system)

        - `labels: optional map[string]`

          Arbitrary key-value pairs for categorization and filtering
          Examples: {"environment": "production", "team": "platform", "version": "v2"}

    - `arguments: optional map[unknown]`

      The arguments passed to the tool

    - `memo: optional string`

      A memo supplied by the reviewer when denying the tool call

    - `result: optional string`

      The result content returned by the tool after execution

    - `statusChangedBy: optional object { metadata, spec }`

      Profile represents a human user at the account level.
      Profiles are account-scoped resources that can be associated with multiple workspaces
      through the Actor model. Authentication for profiles is handled via SSO/OAuth (WorkOS).

      - `metadata: object { id, accountId, name, 3 more }`

        AccountResourceMetadata is used to represent a resource that is associated to an account but not to a workspace.

        - `id: string`

          Unique identifier for the resource (prefixed ULID, e.g., "apikey_01HXK...")

        - `accountId: string`

          Account this resource belongs to for multi-tenant isolation (prefixed ULID)

        - `name: string`

          Human-readable name for the resource (e.g., "Customer Support Agent", "Email Tool")
          Required for resources that users interact with directly

        - `profileId: string`

        - `externalId: optional string`

          External ID for the resource (e.g., a workflow ID from an external system)

        - `labels: optional map[string]`

          Arbitrary key-value pairs for categorization and filtering
          Examples: {"environment": "production", "team": "platform", "version": "v2"}

      - `spec: object { type, email, name }`

        ProfileSpec contains the profile-specific fields

        - `type: "PROFILE_TYPE_USER" or "PROFILE_TYPE_API_KEY" or "PROFILE_TYPE_SYSTEM"`

          Type is the type of profile. User's are humans, API keys are computers. You know the deal.

          - `"PROFILE_TYPE_USER"`

          - `"PROFILE_TYPE_API_KEY"`

          - `"PROFILE_TYPE_SYSTEM"`

        - `email: optional string`

          Email address of the user (required, unique per account)

        - `name: optional string`

          Display name for the user (e.g., "Bobby Tables")

  - `metadata: object { id, accountId, createdAt, 4 more }`

    Metadata for ephemeral operations and activities (e.g., objectives, executions, runs)

    - `id: string`

      Unique identifier for the operation (prefixed ULID, e.g., "obj_01HXK...")

    - `accountId: string`

      Account this operation belongs to for multi-tenant isolation (prefixed ULID)

    - `createdAt: string`

      Timestamp when this operation was created
      ULID includes timestamp information, but this explicit field enables easier querying

    - `profileId: string`

      ID of the actor (user or service account) that created this operation

    - `workspaceId: string`

      Workspace this operation belongs to for organizational grouping (prefixed ULID)

    - `externalId: optional string`

      External ID for the operation (e.g., a workflow ID from an external system)

    - `labels: optional map[string]`

      Arbitrary key-value pairs for categorization and filtering
      Examples: {"priority": "high", "source": "api", "workflow": "onboarding"}

  - `status: "TOOL_CALL_STATUS_UNSPECIFIED" or "TOOL_CALL_STATUS_AUTO_APPROVED" or "TOOL_CALL_STATUS_WAITING_FOR_APPROVAL" or 2 more`

    Current status of the tool call

    - `"TOOL_CALL_STATUS_UNSPECIFIED"`

    - `"TOOL_CALL_STATUS_AUTO_APPROVED"`

    - `"TOOL_CALL_STATUS_WAITING_FOR_APPROVAL"`

    - `"TOOL_CALL_STATUS_APPROVED"`

    - `"TOOL_CALL_STATUS_DENIED"`

  - `executionStatus: optional "TOOL_CALL_EXECUTION_STATUS_UNSPECIFIED" or "TOOL_CALL_EXECUTION_STATUS_PENDING" or "TOOL_CALL_EXECUTION_STATUS_RUNNING" or 2 more`

    - `"TOOL_CALL_EXECUTION_STATUS_UNSPECIFIED"`

    - `"TOOL_CALL_EXECUTION_STATUS_PENDING"`

    - `"TOOL_CALL_EXECUTION_STATUS_RUNNING"`

    - `"TOOL_CALL_EXECUTION_STATUS_COMPLETED"`

    - `"TOOL_CALL_EXECUTION_STATUS_ERRORED"`

  - `info: optional object { createdBy, objective }`

    - `createdBy: optional object { metadata, spec }`

      Profile represents a human user at the account level.
      Profiles are account-scoped resources that can be associated with multiple workspaces
      through the Actor model. Authentication for profiles is handled via SSO/OAuth (WorkOS).

      - `metadata: object { id, accountId, name, 3 more }`

        AccountResourceMetadata is used to represent a resource that is associated to an account but not to a workspace.

      - `spec: object { type, email, name }`

        ProfileSpec contains the profile-specific fields

    - `objective: optional object { id, accountId, createdAt, 4 more }`

      Metadata for ephemeral operations and activities (e.g., objectives, executions, runs)

      - `id: string`

        Unique identifier for the operation (prefixed ULID, e.g., "obj_01HXK...")

      - `accountId: string`

        Account this operation belongs to for multi-tenant isolation (prefixed ULID)

      - `createdAt: string`

        Timestamp when this operation was created
        ULID includes timestamp information, but this explicit field enables easier querying

      - `profileId: string`

        ID of the actor (user or service account) that created this operation

      - `workspaceId: string`

        Workspace this operation belongs to for organizational grouping (prefixed ULID)

      - `externalId: optional string`

        External ID for the operation (e.g., a workflow ID from an external system)

      - `labels: optional map[string]`

        Arbitrary key-value pairs for categorization and filtering
        Examples: {"priority": "high", "source": "api", "workflow": "onboarding"}

### Example

```cli
cadenya objectives:tool-calls deny \
  --api-key 'My API Key' \
  --objective-id objectiveId \
  --tool-call-id toolCallId
```

#### Response

```json
{
  "data": {
    "callable": {
      "agent": {
        "id": "id",
        "accountId": "accountId",
        "createdAt": "2019-12-27T18:11:19.117Z",
        "name": "name",
        "profileId": "profileId",
        "workspaceId": "workspaceId",
        "externalId": "externalId",
        "labels": {
          "foo": "string"
        }
      },
      "cadenyaProvidedTool": {
        "id": "id",
        "accountId": "accountId",
        "createdAt": "2019-12-27T18:11:19.117Z",
        "name": "name",
        "profileId": "profileId",
        "workspaceId": "workspaceId",
        "externalId": "externalId",
        "labels": {
          "foo": "string"
        }
      },
      "tool": {
        "id": "id",
        "accountId": "accountId",
        "createdAt": "2019-12-27T18:11:19.117Z",
        "name": "name",
        "profileId": "profileId",
        "workspaceId": "workspaceId",
        "externalId": "externalId",
        "labels": {
          "foo": "string"
        }
      }
    },
    "arguments": {
      "foo": "bar"
    },
    "memo": "memo",
    "result": "result",
    "statusChangedBy": {
      "metadata": {
        "id": "id",
        "accountId": "accountId",
        "name": "name",
        "profileId": "profileId",
        "externalId": "externalId",
        "labels": {
          "foo": "string"
        }
      },
      "spec": {
        "type": "PROFILE_TYPE_USER",
        "email": "email",
        "name": "name"
      }
    }
  },
  "metadata": {
    "id": "id",
    "accountId": "accountId",
    "createdAt": "2019-12-27T18:11:19.117Z",
    "profileId": "profileId",
    "workspaceId": "workspaceId",
    "externalId": "externalId",
    "labels": {
      "foo": "string"
    }
  },
  "status": "TOOL_CALL_STATUS_UNSPECIFIED",
  "executionStatus": "TOOL_CALL_EXECUTION_STATUS_UNSPECIFIED",
  "info": {
    "createdBy": {
      "metadata": {
        "id": "id",
        "accountId": "accountId",
        "name": "name",
        "profileId": "profileId",
        "externalId": "externalId",
        "labels": {
          "foo": "string"
        }
      },
      "spec": {
        "type": "PROFILE_TYPE_USER",
        "email": "email",
        "name": "name"
      }
    },
    "objective": {
      "id": "id",
      "accountId": "accountId",
      "createdAt": "2019-12-27T18:11:19.117Z",
      "profileId": "profileId",
      "workspaceId": "workspaceId",
      "externalId": "externalId",
      "labels": {
        "foo": "string"
      }
    }
  }
}
```

## Domain Types

### Objective Tool Call

- `objective_tool_call: object { data, metadata, status, 2 more }`

  ObjectiveToolCall is a record of a tool call made during an objective's execution.
  Tool calls are mutable — their status changes as they are approved, denied, or executed.

  - `data: object { callable, arguments, memo, 2 more }`

    - `callable: object { agent, cadenyaProvidedTool, tool }`

      CallableTool is a union that represents a tool that can be called by an agent. In Cadenya, a tool that is used within an agent objective
      might be a user-defined tool (IE: MCP, HTTP), another Agent (useful to separate context), or a Cadenya Tool (one Cadenya provides).

      - `agent: optional object { id, accountId, createdAt, 5 more }`

        Standard metadata for persistent, named resources (e.g., agents, tools, prompts)

        - `id: string`

          Unique identifier for the resource (prefixed ULID, e.g., "agent_01HXK...")

        - `accountId: string`

          Account this resource belongs to for multi-tenant isolation (prefixed ULID)

        - `createdAt: string`

          Timestamp when this resource was created

        - `name: string`

          Human-readable name for the resource (e.g., "Customer Support Agent", "Email Tool")
          Required for resources that users interact with directly

        - `profileId: string`

          ID of the actor (user or service account) that created this resource

        - `workspaceId: string`

          Workspace this resource belongs to for organizational grouping (prefixed ULID)

        - `externalId: optional string`

          External ID for the resource (e.g., a workflow ID from an external system)

        - `labels: optional map[string]`

          Arbitrary key-value pairs for categorization and filtering
          Examples: {"environment": "production", "team": "platform", "version": "v2"}

      - `cadenyaProvidedTool: optional object { id, accountId, createdAt, 5 more }`

        Standard metadata for persistent, named resources (e.g., agents, tools, prompts)

        - `id: string`

          Unique identifier for the resource (prefixed ULID, e.g., "agent_01HXK...")

        - `accountId: string`

          Account this resource belongs to for multi-tenant isolation (prefixed ULID)

        - `createdAt: string`

          Timestamp when this resource was created

        - `name: string`

          Human-readable name for the resource (e.g., "Customer Support Agent", "Email Tool")
          Required for resources that users interact with directly

        - `profileId: string`

          ID of the actor (user or service account) that created this resource

        - `workspaceId: string`

          Workspace this resource belongs to for organizational grouping (prefixed ULID)

        - `externalId: optional string`

          External ID for the resource (e.g., a workflow ID from an external system)

        - `labels: optional map[string]`

          Arbitrary key-value pairs for categorization and filtering
          Examples: {"environment": "production", "team": "platform", "version": "v2"}

      - `tool: optional object { id, accountId, createdAt, 5 more }`

        Standard metadata for persistent, named resources (e.g., agents, tools, prompts)

        - `id: string`

          Unique identifier for the resource (prefixed ULID, e.g., "agent_01HXK...")

        - `accountId: string`

          Account this resource belongs to for multi-tenant isolation (prefixed ULID)

        - `createdAt: string`

          Timestamp when this resource was created

        - `name: string`

          Human-readable name for the resource (e.g., "Customer Support Agent", "Email Tool")
          Required for resources that users interact with directly

        - `profileId: string`

          ID of the actor (user or service account) that created this resource

        - `workspaceId: string`

          Workspace this resource belongs to for organizational grouping (prefixed ULID)

        - `externalId: optional string`

          External ID for the resource (e.g., a workflow ID from an external system)

        - `labels: optional map[string]`

          Arbitrary key-value pairs for categorization and filtering
          Examples: {"environment": "production", "team": "platform", "version": "v2"}

    - `arguments: optional map[unknown]`

      The arguments passed to the tool

    - `memo: optional string`

      A memo supplied by the reviewer when denying the tool call

    - `result: optional string`

      The result content returned by the tool after execution

    - `statusChangedBy: optional object { metadata, spec }`

      Profile represents a human user at the account level.
      Profiles are account-scoped resources that can be associated with multiple workspaces
      through the Actor model. Authentication for profiles is handled via SSO/OAuth (WorkOS).

      - `metadata: object { id, accountId, name, 3 more }`

        AccountResourceMetadata is used to represent a resource that is associated to an account but not to a workspace.

        - `id: string`

          Unique identifier for the resource (prefixed ULID, e.g., "apikey_01HXK...")

        - `accountId: string`

          Account this resource belongs to for multi-tenant isolation (prefixed ULID)

        - `name: string`

          Human-readable name for the resource (e.g., "Customer Support Agent", "Email Tool")
          Required for resources that users interact with directly

        - `profileId: string`

        - `externalId: optional string`

          External ID for the resource (e.g., a workflow ID from an external system)

        - `labels: optional map[string]`

          Arbitrary key-value pairs for categorization and filtering
          Examples: {"environment": "production", "team": "platform", "version": "v2"}

      - `spec: object { type, email, name }`

        ProfileSpec contains the profile-specific fields

        - `type: "PROFILE_TYPE_USER" or "PROFILE_TYPE_API_KEY" or "PROFILE_TYPE_SYSTEM"`

          Type is the type of profile. User's are humans, API keys are computers. You know the deal.

          - `"PROFILE_TYPE_USER"`

          - `"PROFILE_TYPE_API_KEY"`

          - `"PROFILE_TYPE_SYSTEM"`

        - `email: optional string`

          Email address of the user (required, unique per account)

        - `name: optional string`

          Display name for the user (e.g., "Bobby Tables")

  - `metadata: object { id, accountId, createdAt, 4 more }`

    Metadata for ephemeral operations and activities (e.g., objectives, executions, runs)

    - `id: string`

      Unique identifier for the operation (prefixed ULID, e.g., "obj_01HXK...")

    - `accountId: string`

      Account this operation belongs to for multi-tenant isolation (prefixed ULID)

    - `createdAt: string`

      Timestamp when this operation was created
      ULID includes timestamp information, but this explicit field enables easier querying

    - `profileId: string`

      ID of the actor (user or service account) that created this operation

    - `workspaceId: string`

      Workspace this operation belongs to for organizational grouping (prefixed ULID)

    - `externalId: optional string`

      External ID for the operation (e.g., a workflow ID from an external system)

    - `labels: optional map[string]`

      Arbitrary key-value pairs for categorization and filtering
      Examples: {"priority": "high", "source": "api", "workflow": "onboarding"}

  - `status: "TOOL_CALL_STATUS_UNSPECIFIED" or "TOOL_CALL_STATUS_AUTO_APPROVED" or "TOOL_CALL_STATUS_WAITING_FOR_APPROVAL" or 2 more`

    Current status of the tool call

    - `"TOOL_CALL_STATUS_UNSPECIFIED"`

    - `"TOOL_CALL_STATUS_AUTO_APPROVED"`

    - `"TOOL_CALL_STATUS_WAITING_FOR_APPROVAL"`

    - `"TOOL_CALL_STATUS_APPROVED"`

    - `"TOOL_CALL_STATUS_DENIED"`

  - `executionStatus: optional "TOOL_CALL_EXECUTION_STATUS_UNSPECIFIED" or "TOOL_CALL_EXECUTION_STATUS_PENDING" or "TOOL_CALL_EXECUTION_STATUS_RUNNING" or 2 more`

    - `"TOOL_CALL_EXECUTION_STATUS_UNSPECIFIED"`

    - `"TOOL_CALL_EXECUTION_STATUS_PENDING"`

    - `"TOOL_CALL_EXECUTION_STATUS_RUNNING"`

    - `"TOOL_CALL_EXECUTION_STATUS_COMPLETED"`

    - `"TOOL_CALL_EXECUTION_STATUS_ERRORED"`

  - `info: optional object { createdBy, objective }`

    - `createdBy: optional object { metadata, spec }`

      Profile represents a human user at the account level.
      Profiles are account-scoped resources that can be associated with multiple workspaces
      through the Actor model. Authentication for profiles is handled via SSO/OAuth (WorkOS).

      - `metadata: object { id, accountId, name, 3 more }`

        AccountResourceMetadata is used to represent a resource that is associated to an account but not to a workspace.

      - `spec: object { type, email, name }`

        ProfileSpec contains the profile-specific fields

    - `objective: optional object { id, accountId, createdAt, 4 more }`

      Metadata for ephemeral operations and activities (e.g., objectives, executions, runs)

      - `id: string`

        Unique identifier for the operation (prefixed ULID, e.g., "obj_01HXK...")

      - `accountId: string`

        Account this operation belongs to for multi-tenant isolation (prefixed ULID)

      - `createdAt: string`

        Timestamp when this operation was created
        ULID includes timestamp information, but this explicit field enables easier querying

      - `profileId: string`

        ID of the actor (user or service account) that created this operation

      - `workspaceId: string`

        Workspace this operation belongs to for organizational grouping (prefixed ULID)

      - `externalId: optional string`

        External ID for the operation (e.g., a workflow ID from an external system)

      - `labels: optional map[string]`

        Arbitrary key-value pairs for categorization and filtering
        Examples: {"priority": "high", "source": "api", "workflow": "onboarding"}

### Objective Tool Call Data

- `objective_tool_call_data: object { callable, arguments, memo, 2 more }`

  - `callable: object { agent, cadenyaProvidedTool, tool }`

    CallableTool is a union that represents a tool that can be called by an agent. In Cadenya, a tool that is used within an agent objective
    might be a user-defined tool (IE: MCP, HTTP), another Agent (useful to separate context), or a Cadenya Tool (one Cadenya provides).

    - `agent: optional object { id, accountId, createdAt, 5 more }`

      Standard metadata for persistent, named resources (e.g., agents, tools, prompts)

      - `id: string`

        Unique identifier for the resource (prefixed ULID, e.g., "agent_01HXK...")

      - `accountId: string`

        Account this resource belongs to for multi-tenant isolation (prefixed ULID)

      - `createdAt: string`

        Timestamp when this resource was created

      - `name: string`

        Human-readable name for the resource (e.g., "Customer Support Agent", "Email Tool")
        Required for resources that users interact with directly

      - `profileId: string`

        ID of the actor (user or service account) that created this resource

      - `workspaceId: string`

        Workspace this resource belongs to for organizational grouping (prefixed ULID)

      - `externalId: optional string`

        External ID for the resource (e.g., a workflow ID from an external system)

      - `labels: optional map[string]`

        Arbitrary key-value pairs for categorization and filtering
        Examples: {"environment": "production", "team": "platform", "version": "v2"}

    - `cadenyaProvidedTool: optional object { id, accountId, createdAt, 5 more }`

      Standard metadata for persistent, named resources (e.g., agents, tools, prompts)

      - `id: string`

        Unique identifier for the resource (prefixed ULID, e.g., "agent_01HXK...")

      - `accountId: string`

        Account this resource belongs to for multi-tenant isolation (prefixed ULID)

      - `createdAt: string`

        Timestamp when this resource was created

      - `name: string`

        Human-readable name for the resource (e.g., "Customer Support Agent", "Email Tool")
        Required for resources that users interact with directly

      - `profileId: string`

        ID of the actor (user or service account) that created this resource

      - `workspaceId: string`

        Workspace this resource belongs to for organizational grouping (prefixed ULID)

      - `externalId: optional string`

        External ID for the resource (e.g., a workflow ID from an external system)

      - `labels: optional map[string]`

        Arbitrary key-value pairs for categorization and filtering
        Examples: {"environment": "production", "team": "platform", "version": "v2"}

    - `tool: optional object { id, accountId, createdAt, 5 more }`

      Standard metadata for persistent, named resources (e.g., agents, tools, prompts)

      - `id: string`

        Unique identifier for the resource (prefixed ULID, e.g., "agent_01HXK...")

      - `accountId: string`

        Account this resource belongs to for multi-tenant isolation (prefixed ULID)

      - `createdAt: string`

        Timestamp when this resource was created

      - `name: string`

        Human-readable name for the resource (e.g., "Customer Support Agent", "Email Tool")
        Required for resources that users interact with directly

      - `profileId: string`

        ID of the actor (user or service account) that created this resource

      - `workspaceId: string`

        Workspace this resource belongs to for organizational grouping (prefixed ULID)

      - `externalId: optional string`

        External ID for the resource (e.g., a workflow ID from an external system)

      - `labels: optional map[string]`

        Arbitrary key-value pairs for categorization and filtering
        Examples: {"environment": "production", "team": "platform", "version": "v2"}

  - `arguments: optional map[unknown]`

    The arguments passed to the tool

  - `memo: optional string`

    A memo supplied by the reviewer when denying the tool call

  - `result: optional string`

    The result content returned by the tool after execution

  - `statusChangedBy: optional object { metadata, spec }`

    Profile represents a human user at the account level.
    Profiles are account-scoped resources that can be associated with multiple workspaces
    through the Actor model. Authentication for profiles is handled via SSO/OAuth (WorkOS).

    - `metadata: object { id, accountId, name, 3 more }`

      AccountResourceMetadata is used to represent a resource that is associated to an account but not to a workspace.

      - `id: string`

        Unique identifier for the resource (prefixed ULID, e.g., "apikey_01HXK...")

      - `accountId: string`

        Account this resource belongs to for multi-tenant isolation (prefixed ULID)

      - `name: string`

        Human-readable name for the resource (e.g., "Customer Support Agent", "Email Tool")
        Required for resources that users interact with directly

      - `profileId: string`

      - `externalId: optional string`

        External ID for the resource (e.g., a workflow ID from an external system)

      - `labels: optional map[string]`

        Arbitrary key-value pairs for categorization and filtering
        Examples: {"environment": "production", "team": "platform", "version": "v2"}

    - `spec: object { type, email, name }`

      ProfileSpec contains the profile-specific fields

      - `type: "PROFILE_TYPE_USER" or "PROFILE_TYPE_API_KEY" or "PROFILE_TYPE_SYSTEM"`

        Type is the type of profile. User's are humans, API keys are computers. You know the deal.

        - `"PROFILE_TYPE_USER"`

        - `"PROFILE_TYPE_API_KEY"`

        - `"PROFILE_TYPE_SYSTEM"`

      - `email: optional string`

        Email address of the user (required, unique per account)

      - `name: optional string`

        Display name for the user (e.g., "Bobby Tables")

### Objective Tool Call Info

- `objective_tool_call_info: object { createdBy, objective }`

  - `createdBy: optional object { metadata, spec }`

    Profile represents a human user at the account level.
    Profiles are account-scoped resources that can be associated with multiple workspaces
    through the Actor model. Authentication for profiles is handled via SSO/OAuth (WorkOS).

    - `metadata: object { id, accountId, name, 3 more }`

      AccountResourceMetadata is used to represent a resource that is associated to an account but not to a workspace.

      - `id: string`

        Unique identifier for the resource (prefixed ULID, e.g., "apikey_01HXK...")

      - `accountId: string`

        Account this resource belongs to for multi-tenant isolation (prefixed ULID)

      - `name: string`

        Human-readable name for the resource (e.g., "Customer Support Agent", "Email Tool")
        Required for resources that users interact with directly

      - `profileId: string`

      - `externalId: optional string`

        External ID for the resource (e.g., a workflow ID from an external system)

      - `labels: optional map[string]`

        Arbitrary key-value pairs for categorization and filtering
        Examples: {"environment": "production", "team": "platform", "version": "v2"}

    - `spec: object { type, email, name }`

      ProfileSpec contains the profile-specific fields

      - `type: "PROFILE_TYPE_USER" or "PROFILE_TYPE_API_KEY" or "PROFILE_TYPE_SYSTEM"`

        Type is the type of profile. User's are humans, API keys are computers. You know the deal.

        - `"PROFILE_TYPE_USER"`

        - `"PROFILE_TYPE_API_KEY"`

        - `"PROFILE_TYPE_SYSTEM"`

      - `email: optional string`

        Email address of the user (required, unique per account)

      - `name: optional string`

        Display name for the user (e.g., "Bobby Tables")

  - `objective: optional object { id, accountId, createdAt, 4 more }`

    Metadata for ephemeral operations and activities (e.g., objectives, executions, runs)

    - `id: string`

      Unique identifier for the operation (prefixed ULID, e.g., "obj_01HXK...")

    - `accountId: string`

      Account this operation belongs to for multi-tenant isolation (prefixed ULID)

    - `createdAt: string`

      Timestamp when this operation was created
      ULID includes timestamp information, but this explicit field enables easier querying

    - `profileId: string`

      ID of the actor (user or service account) that created this operation

    - `workspaceId: string`

      Workspace this operation belongs to for organizational grouping (prefixed ULID)

    - `externalId: optional string`

      External ID for the operation (e.g., a workflow ID from an external system)

    - `labels: optional map[string]`

      Arbitrary key-value pairs for categorization and filtering
      Examples: {"priority": "high", "source": "api", "workflow": "onboarding"}