Invoke an action

Execute an enabled action inline, or park it behind a human approval when the action is gated. Which definition runs depends on how the call is attributed. Passing a runId whose run names an agent runs the action version that agent’s published version pins, if it pins one – this is the path a rollback restores. Without a runId, or when the agent pins nothing for this action, the action’s current definition runs. The response reports the version that actually executed as actionVersionId. With an Idempotency-Key, the key is also recorded on the invocation and kept for its whole life, including after it fails. A retry with the same key after the 24-hour replay window (or after the replay store loses the key) is answered from the invocation’s current state with X-Idempotent-Replay: current-state and 200, or 202 while it still waits for approval. It is never executed, admitted or charged again. The same key from a different credential or with a different body returns 409 idempotency_key_reuse. A request refused before the invocation is recorded (for example invalid input) leaves the key unused. To run the action again deliberately, use a new key.

POST/api/v2/actions/{ref}/invoke

Authorization

AuthorizationBearer token (Anlyon API key) · headerrequired

Workspace API key sent as Authorization: Bearer <key>.

better-auth.session_tokenAPI key · cookierequired

Browser session used by dashboard-only operations.

Path parameters

refstringrequired

Action name or public action identifier.

min length 1 · max length 100

Header parameters

X-Request-Idstring

Optional caller correlation ID. Unsafe or oversized values are replaced.

max length 128

Idempotency-Keystring

Stable retry key for a mutation. The key is claimed atomically before the handler runs, so concurrent retries execute the side effect at most once. Replaying the key for the same request (same method, path, workspace and JSON body) returns the original response with an X-Idempotent-Replay: true header. Reusing the key for a different request returns 409 with error code idempotency_key_reuse. A duplicate arriving while the first is still in flight waits and then replays; if the first does not finish in time the duplicate gets 409 idempotency_request_in_progress. Keys are retained for 24 hours. Only successful (2xx) responses are stored; a failed request frees the key so it can be retried.

min length 1 · max length 255

Request body

application/json

inputobject

runIdstring

Existing run in this API key environment to receive the automatic action_call span.

max length 80

parentSpanIdstring

Optional parent span within runId.

max length 80

retryOfstring

A failed invocation of the same action that this call deliberately retries. Needs its own Idempotency-Key. Refused while the original is unknown (resolve it first) or succeeded, and once it has already been retried.

max length 100 · matches ^inv_[A-Za-z0-9_-]+$

operationKeystring

Governed actions only (an adapter or a declaration). Stable operation identity: the same key with the same request returns the existing effect. The same key with a different request is a 409. Defaults to the Idempotency-Key. Different keys do not make two requests different business operations.

matches ^[A-Za-z0-9._:-]{1,200}$

previewIdstring

Governed actions only. A reviewed preview this invocation must match exactly (409 PREVIEW_MISMATCH, PREVIEW_EXPIRED or PREVIEW_ALREADY_USED otherwise).

matches ^prv_[A-Za-z0-9_-]{1,64}$

dependsOnobject[]

Governed actions only. Effects that must already have the stated outcome. Pending and unknown never satisfy a dependency (409 DEPENDENCY_UNRESOLVED).

max items 10

Show properties

Array of object

effectstringrequired

matches ^eff_[A-Za-z0-9_-]{1,64}$

outcomestringrequired

Allowed:succeededfailed

compensatesstring

Governed actions only. The effect this one compensates. A compensation is its own governed effect.

matches ^eff_[A-Za-z0-9_-]{1,64}$

Responses

200

Invocation completed or parked for approval.

successbooleanrequired

Allowed:true

dataActionInvocationrequired

Show properties

idstringrequired

effectIdstring | nullrequired

The governed effect this invocation created, for a governed action (an adapter or a declaration). Its outcome, evidence and recovery are at GET /api/v2/actions/effects/{id}. Null for template actions.

gradestring | null

On invoke responses and single reads: the receipt grade of the effect this invocation created. See Effect.grade. Absent when the invocation has no effect, and on list reads.

Allowed:confirmedacknowledgedunknownfailedrefuseddeniedpendingnull

retryOfstring | nullrequired

The failed invocation this one deliberately retried.

retriedBystring | null

On single reads: the invocation that retried this one.

resolutionobject | null

On single reads: the operator's confirmed outcome for an invocation that was unknown.

Show properties

outcomestringrequired

Allowed:succeededfailed

evidencestringrequired

externalReferencestring | nullrequired

resolvedByobjectrequired

Show properties

typestringrequired

Allowed:api_keyuser

idstringrequired

resolvedAtstring<date-time>required

actionNamestringrequired

actionVersionIdstring | nullrequired

The immutable action version this invocation ran. Lets an audit answer which definition executed a given call rather than inferring it. Null only for invocations recorded before versioning existed.

statusstringrequired

unknown means the request may have reached the destination and Anlyon cannot confirm what happened a timeout, or a socket that died after the request was written. It is deliberately distinct from failed, which means the call did not happen: an error before anything left, such as a blocked URL or an invalid template. Do not retry an unknown invocation automatically. Reconcile it with the destination first; retrying is how one refund becomes two. This value is additive clients that do not know it should treat an unrecognised status as not-successful rather than as failed.

Allowed:pending_approvalrunningsucceededfailedunknowndeniedexpired

responseStatusinteger | nullrequired

min 100 · max 599

bodystring | nullrequired

Redacted and truncated upstream response body.

errorstring | nullrequired

durationMsinteger | nullrequired

min 0

approvalIdstring | nullrequired

decisionInvocationDecision | nullrequired

Why the request was allowed or refused, when a policy, a person or expiry decided it. Persisted on the invocation, so it reads the same after the policy is edited or deleted. Null while undecided, for an invocation that ran with no gate, and on rows recorded before this field existed. For a request that was never sent, responseStatus and body stay null: no response is fabricated.

Show properties

Any of:

InvocationDecision

sourcestringrequired

Allowed:policyhumansystemassistant

codestringrequired

Allowed:POLICY_DENIEDPOLICY_APPROVEDHUMAN_APPROVEDHUMAN_DENIEDAPPROVAL_EXPIREDASSISTANT_APPROVED

effectstringrequired

What actually happened to the request.

Allowed:approveddeniedexpired

explanationstringrequired

policyobject | nullrequired

The policy that decided, as it stood at decision time. Null when no policy decided.

Show properties

idstringrequired

namestringrequired

versionintegerrequired

decidedAtstring<date-time>required

Database time the decision was committed.

null

null

createdAtstring<date-time>required

completedAtstring<date-time> | nullrequired

pendingApprovalbooleanrequired

202

Invocation completed or parked for approval.

successbooleanrequired

Allowed:true

dataActionInvocationrequired

Show properties

idstringrequired

effectIdstring | nullrequired

gradestring | null

On invoke responses and single reads: the receipt grade of the effect this invocation created. See Effect.grade. Absent when the invocation has no effect, and on list reads.

Allowed:confirmedacknowledgedunknownfailedrefuseddeniedpendingnull

retryOfstring | nullrequired

The failed invocation this one deliberately retried.

retriedBystring | null

On single reads: the invocation that retried this one.

resolutionobject | null

On single reads: the operator's confirmed outcome for an invocation that was unknown.

Show properties

outcomestringrequired

Allowed:succeededfailed

evidencestringrequired

externalReferencestring | nullrequired

resolvedByobjectrequired

Show properties

typestringrequired

Allowed:api_keyuser

idstringrequired

resolvedAtstring<date-time>required

actionNamestringrequired

actionVersionIdstring | nullrequired

The immutable action version this invocation ran. Lets an audit answer which definition executed a given call rather than inferring it. Null only for invocations recorded before versioning existed.

statusstringrequired

Allowed:pending_approvalrunningsucceededfailedunknowndeniedexpired

responseStatusinteger | nullrequired

min 100 · max 599

bodystring | nullrequired

Redacted and truncated upstream response body.

errorstring | nullrequired

durationMsinteger | nullrequired

min 0

approvalIdstring | nullrequired

decisionInvocationDecision | nullrequired

Show properties

Any of:

InvocationDecision

sourcestringrequired

Allowed:policyhumansystemassistant

codestringrequired

Allowed:POLICY_DENIEDPOLICY_APPROVEDHUMAN_APPROVEDHUMAN_DENIEDAPPROVAL_EXPIREDASSISTANT_APPROVED

effectstringrequired

What actually happened to the request.

Allowed:approveddeniedexpired

explanationstringrequired

policyobject | nullrequired

The policy that decided, as it stood at decision time. Null when no policy decided.

Show properties

idstringrequired

namestringrequired

versionintegerrequired

decidedAtstring<date-time>required

Database time the decision was committed.

null

null

createdAtstring<date-time>required

completedAtstring<date-time> | nullrequired

pendingApprovalbooleanrequired

400

Bad Request - Invalid input data

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

401

Unauthorized - Invalid or missing API key

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

402

Payment Required - Usage quota exceeded

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

403

Authenticated credential lacks the required scope or workspace access.

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

404

Not Found - Resource does not exist

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

409

The request conflicts with current resource state or a concurrent decision.

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

429

Too Many Requests - Rate limit exceeded

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

503

A required provider or platform dependency is not configured or available.

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

Try it

Server

Base URLCustom base URLOverrides the selected server when set.

Authorization

Bearer token (Anlyon API key)Remember on this deviceInclude my values in samples

Parameters

X-Request-IdheaderOptional caller correlation ID. Unsafe or oversized values are replaced.refpath*Action name or public action identifier.Idempotency-KeyheaderStable retry key for a mutation. The key is claimed atomically before the handler runs, so concurrent retries execute the side effect at most once. Replaying the key for the same request (same method, path, workspace and JSON body) returns the original response with an `X-Idempotent-Replay: true` header. Reusing the key for a different request returns `409` with error code `idempotency_key_reuse`. A duplicate arriving while the first is still in flight waits and then replays; if the first does not finish in time the duplicate gets `409 idempotency_request_in_progress`. Keys are retained for 24 hours. Only successful (2xx) responses are stored; a failed request frees the key so it can be retried.

Bodyapplication/json

Request body

Request

curl -X POST 'https://api.anlyon.com/api/v2/actions/string/invoke' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
  "input": {},
  "runId": "string",
  "parentSpanId": "string",
  "retryOf": "string",
  "operationKey": "string",
  "previewId": "string",
  "dependsOn": [
    {
      "effect": "string",
      "outcome": "succeeded"
    }
  ],
  "compensates": "string"
}'

const response = await fetch("https://api.anlyon.com/api/v2/actions/string/invoke", {
  method: "POST",
  headers: {
    "Authorization": "Bearer YOUR_TOKEN",
    "Content-Type": "application/json"
  },
  body: "{\n  \"input\": {},\n  \"runId\": \"string\",\n  \"parentSpanId\": \"string\",\n  \"retryOf\": \"string\",\n  \"operationKey\": \"string\",\n  \"previewId\": \"string\",\n  \"dependsOn\": [\n    {\n      \"effect\": \"string\",\n      \"outcome\": \"succeeded\"\n    }\n  ],\n  \"compensates\": \"string\"\n}"
});

import requests

response = requests.post(
    "https://api.anlyon.com/api/v2/actions/string/invoke",
    headers={
        "Authorization": "Bearer YOUR_TOKEN",
        "Content-Type": "application/json"
    },
    data="{\n  \"input\": {},\n  \"runId\": \"string\",\n  \"parentSpanId\": \"string\",\n  \"retryOf\": \"string\",\n  \"operationKey\": \"string\",\n  \"previewId\": \"string\",\n  \"dependsOn\": [\n    {\n      \"effect\": \"string\",\n      \"outcome\": \"succeeded\"\n    }\n  ],\n  \"compensates\": \"string\"\n}",
)

Response

{
  "success": true,
  "data": {
    "id": "inv_01JABCDEF",
    "effectId": "eff_01JABCDEF",
    "grade": "confirmed",
    "retryOf": "string",
    "retriedBy": "string",
    "resolution": {
      "outcome": "succeeded",
      "evidence": "string",
      "externalReference": "string",
      "resolvedBy": {
        "type": "api_key",
        "id": "string"
      },
      "resolvedAt": "2019-08-24T14:15:22Z"
    },
    "actionName": "string",
    "actionVersionId": "acv_01JABCDEF",
    "status": "pending_approval",
    "responseStatus": 100,
    "body": "string",
    "error": "string",
    "durationMs": 0,
    "approvalId": "string",
    "decision": {
      "source": "policy",
      "code": "POLICY_DENIED",
      "effect": "approved",
      "explanation": "Denied by policy \"refund_order_denied\", version 2. The request was not sent.",
      "policy": {
        "id": "apol_01JABCDEF",
        "name": "string",
        "version": 0
      },
      "decidedAt": "2019-08-24T14:15:22Z"
    },
    "createdAt": "2019-08-24T14:15:22Z",
    "completedAt": "2019-08-24T14:15:22Z",
    "pendingApproval": true
  }
}

{
  "success": true,
  "data": {
    "id": "inv_01JABCDEF",
    "effectId": "eff_01JABCDEF",
    "grade": "confirmed",
    "retryOf": "string",
    "retriedBy": "string",
    "resolution": {
      "outcome": "succeeded",
      "evidence": "string",
      "externalReference": "string",
      "resolvedBy": {
        "type": "api_key",
        "id": "string"
      },
      "resolvedAt": "2019-08-24T14:15:22Z"
    },
    "actionName": "string",
    "actionVersionId": "acv_01JABCDEF",
    "status": "pending_approval",
    "responseStatus": 100,
    "body": "string",
    "error": "string",
    "durationMs": 0,
    "approvalId": "string",
    "decision": {
      "source": "policy",
      "code": "POLICY_DENIED",
      "effect": "approved",
      "explanation": "Denied by policy \"refund_order_denied\", version 2. The request was not sent.",
      "policy": {
        "id": "apol_01JABCDEF",
        "name": "string",
        "version": 0
      },
      "decidedAt": "2019-08-24T14:15:22Z"
    },
    "createdAt": "2019-08-24T14:15:22Z",
    "completedAt": "2019-08-24T14:15:22Z",
    "pendingApproval": true
  }
}

{
  "success": false,
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid request data",
    "details": {
      "url": "Invalid URL format"
    }
  }
}

{
  "success": false,
  "error": {
    "code": "AUTHENTICATION_ERROR",
    "message": "Invalid or missing API key"
  }
}

{
  "success": false,
  "error": {
    "code": "QUOTA_EXCEEDED",
    "message": "Daily message quota exceeded. Upgrade your plan to continue."
  }
}

{
  "success": false,
  "requestId": "req_0123456789abcdef0123456789abcdef",
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid request data",
    "details": {}
  }
}

{
  "success": false,
  "error": {
    "code": "NOT_FOUND",
    "message": "Resource not found"
  }
}

{
  "success": false,
  "requestId": "req_0123456789abcdef0123456789abcdef",
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid request data",
    "details": {}
  }
}

{
  "success": false,
  "error": {
    "code": "RATE_LIMIT_EXCEEDED",
    "message": "Rate limit exceeded. Please try again later."
  }
}

{
  "success": false,
  "requestId": "req_0123456789abcdef0123456789abcdef",
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid request data",
    "details": {}
  }
}