Update an action

PATCH/api/v2/actions/{ref}

Authorization

AuthorizationBearer token (Anlyon API key) · headerrequired

Workspace API key sent as Authorization: Bearer <key>.

better-auth.session_tokenAPI key · cookierequired

Browser session used by dashboard-only operations.

Path parameters

refstringrequired

Action name or public action identifier.

min length 1 · max length 100

Header parameters

X-Request-Idstring

Optional caller correlation ID. Unsafe or oversized values are replaced.

max length 128

Idempotency-Keystring

Stable retry key for a mutation. The key is claimed atomically before the handler runs, so concurrent retries execute the side effect at most once. Replaying the key for the same request (same method, path, workspace and JSON body) returns the original response with an X-Idempotent-Replay: true header. Reusing the key for a different request returns 409 with error code idempotency_key_reuse. A duplicate arriving while the first is still in flight waits and then replays; if the first does not finish in time the duplicate gets 409 idempotency_request_in_progress. Keys are retained for 24 hours. Only successful (2xx) responses are stored; a failed request frees the key so it can be retried.

min length 1 · max length 255

Request body

requiredapplication/json

namestring

min length 1 · max length 100 · matches ^[a-zA-Z0-9_-]+$

descriptionstring

max length 1000

methodstring

Allowed:GETPOSTPUTPATCHDELETE

urlTemplatestring

min length 1 · max length 2048

headersobject

bodyTemplateobject

inputSchemaobject

requiresApprovalboolean

enabledboolean

adapterobject

Retarget an adapter action (same type). Needs actions:govern.

Show properties

typestringrequired

Allowed:stripe.refundgithub.file_updateresend.email_send

configobjectrequired

credentialSecretstringrequired

matches ^[A-Z0-9_]+$

impactActionImpact | null

Declare or replace the impact. null removes it. Omit it to keep what the action declares. Changing what a governed action declares needs actions:govern.

Show properties

Any of:

ActionImpact

dimensionstringrequired

money, resource_mutations, or a workspace-declared unit such as emails, messages or rows.

matches ^[a-z][a-z0-9_]{0,31}$

unitstring

The currency for money (lowercase ISO 4217, required). For every other dimension the unit is the dimension name and may be left out.

min length 1 · max length 32

amountstringrequired

min length 1 · max length 200

boundstringrequired

Allowed:exactupper_bound

null

null

verifyActionVerify | null

Declare or replace the read-back. null removes it. Omit it to keep what the action declares. Changing what a governed action declares needs actions:govern.

Show properties

Any of:

ActionVerify

urlstringrequired

min length 1 · max length 2048

statusintegerrequired

The status the read-back must answer with.

min 100 · max 599

matchobject[]

JSON path equality checks on the read-back body. Every one must hold.

max items 10

Show properties

Array of object

pathstringrequired

A dotted path into the read-back body. A numeric segment indexes an array.

min length 1 · max length 200

equalsany | nullrequired

A string, number, boolean or null. A string may be exactly one {{input.field}} or {{response.field}}.

null

null

governedboolean

false removes every declaration and returns the action to the template executor. Needs actions:govern.

Responses

200

Action returned.

successbooleanrequired

Allowed:true

dataActionrequired

Show properties

idstringrequired

environmentIdstring<uuid>required

The environment this action lives in. An action belongs to exactly one.

namestringrequired

descriptionstring | nullrequired

methodstringrequired

Allowed:GETPOSTPUTPATCHDELETE

urlTemplatestringrequired

headersobjectrequired

bodyTemplateobject | nullrequired

inputSchemaobjectrequired

requiresApprovalbooleanrequired

enabledbooleanrequired

secretsstring[]required

Referenced secret names only; values are never returned.

currentVersionIdstring | nullrequired

The immutable version this definition currently is. An agent version pins a version id, so this is what to pin to hold an action at its present definition. Null only for actions that predate versioning and have not been edited since.

adapterActionAdapter | nullrequired

The governed-effect adapter, or null for a template action.

Show properties

Any of:

ActionAdapter

typestringrequired

Allowed:stripe.refundgithub.file_updateresend.email_send

configobjectrequired

credentialSecretstringrequired

matches ^[A-Z0-9_]+$

null

null

governedbooleanrequired

True when every invocation creates a governed effect. The action has an adapter, or it carries a declaration.

impactActionImpact | nullrequired

The declared impact, or null when the action declares none.

Show properties

Any of:

ActionImpact

dimensionstringrequired

money, resource_mutations, or a workspace-declared unit such as emails, messages or rows.

matches ^[a-z][a-z0-9_]{0,31}$

unitstring

The currency for money (lowercase ISO 4217, required). For every other dimension the unit is the dimension name and may be left out.

min length 1 · max length 32

amountstringrequired

min length 1 · max length 200

boundstringrequired

Allowed:exactupper_bound

null

null

verifyActionVerify | nullrequired

The declared read-back, or null when the action declares none.

Show properties

Any of:

ActionVerify

urlstringrequired

min length 1 · max length 2048

statusintegerrequired

The status the read-back must answer with.

min 100 · max 599

matchobject[]

JSON path equality checks on the read-back body. Every one must hold.

max items 10

Show properties

Array of object

pathstringrequired

A dotted path into the read-back body. A numeric segment indexes an array.

min length 1 · max length 200

equalsany | nullrequired

A string, number, boolean or null. A string may be exactly one {{input.field}} or {{response.field}}.

null

null

createdAtstring<date-time>required

updatedAtstring<date-time>required

400

Bad Request - Invalid input data

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

401

Unauthorized - Invalid or missing API key

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

403

Authenticated credential lacks the required scope or workspace access.

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

404

Not Found - Resource does not exist

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

409

The request conflicts with current resource state or a concurrent decision.

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

429

Too Many Requests - Rate limit exceeded

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

Try it

Server

Base URLCustom base URLOverrides the selected server when set.

Authorization

Bearer token (Anlyon API key)Remember on this deviceInclude my values in samples

Parameters

X-Request-IdheaderOptional caller correlation ID. Unsafe or oversized values are replaced.refpath*Action name or public action identifier.Idempotency-KeyheaderStable retry key for a mutation. The key is claimed atomically before the handler runs, so concurrent retries execute the side effect at most once. Replaying the key for the same request (same method, path, workspace and JSON body) returns the original response with an `X-Idempotent-Replay: true` header. Reusing the key for a different request returns `409` with error code `idempotency_key_reuse`. A duplicate arriving while the first is still in flight waits and then replays; if the first does not finish in time the duplicate gets `409 idempotency_request_in_progress`. Keys are retained for 24 hours. Only successful (2xx) responses are stored; a failed request frees the key so it can be retried.

Bodyapplication/json

Request body

Request

curl -X PATCH 'https://api.anlyon.com/api/v2/actions/string' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
  "name": "string",
  "description": "string",
  "method": "GET",
  "urlTemplate": "string",
  "headers": {
    "property1": "string",
    "property2": "string"
  },
  "bodyTemplate": {},
  "inputSchema": {},
  "requiresApproval": true,
  "enabled": true,
  "adapter": {
    "type": "stripe.refund",
    "config": {
      "account": "acct_123",
      "mode": "test",
      "currency": "usd"
    },
    "credentialSecret": "STRIPE_TEST_KEY"
  },
  "impact": {
    "dimension": "emails",
    "unit": "emails",
    "amount": "count(input.to)",
    "bound": "exact"
  },
  "verify": {
    "url": "https://api.example.com/v1/messages/{{response.id}}",
    "status": 200,
    "match": [
      {
        "path": "status",
        "equals": "sent"
      }
    ]
  },
  "governed": true
}'

const response = await fetch("https://api.anlyon.com/api/v2/actions/string", {
  method: "PATCH",
  headers: {
    "Authorization": "Bearer YOUR_TOKEN",
    "Content-Type": "application/json"
  },
  body: "{\n  \"name\": \"string\",\n  \"description\": \"string\",\n  \"method\": \"GET\",\n  \"urlTemplate\": \"string\",\n  \"headers\": {\n    \"property1\": \"string\",\n    \"property2\": \"string\"\n  },\n  \"bodyTemplate\": {},\n  \"inputSchema\": {},\n  \"requiresApproval\": true,\n  \"enabled\": true,\n  \"adapter\": {\n    \"type\": \"stripe.refund\",\n    \"config\": {\n      \"account\": \"acct_123\",\n      \"mode\": \"test\",\n      \"currency\": \"usd\"\n    },\n    \"credentialSecret\": \"STRIPE_TEST_KEY\"\n  },\n  \"impact\": {\n    \"dimension\": \"emails\",\n    \"unit\": \"emails\",\n    \"amount\": \"count(input.to)\",\n    \"bound\": \"exact\"\n  },\n  \"verify\": {\n    \"url\": \"https://api.example.com/v1/messages/{{response.id}}\",\n    \"status\": 200,\n    \"match\": [\n      {\n        \"path\": \"status\",\n        \"equals\": \"sent\"\n      }\n    ]\n  },\n  \"governed\": true\n}"
});

import requests

response = requests.patch(
    "https://api.anlyon.com/api/v2/actions/string",
    headers={
        "Authorization": "Bearer YOUR_TOKEN",
        "Content-Type": "application/json"
    },
    data="{\n  \"name\": \"string\",\n  \"description\": \"string\",\n  \"method\": \"GET\",\n  \"urlTemplate\": \"string\",\n  \"headers\": {\n    \"property1\": \"string\",\n    \"property2\": \"string\"\n  },\n  \"bodyTemplate\": {},\n  \"inputSchema\": {},\n  \"requiresApproval\": true,\n  \"enabled\": true,\n  \"adapter\": {\n    \"type\": \"stripe.refund\",\n    \"config\": {\n      \"account\": \"acct_123\",\n      \"mode\": \"test\",\n      \"currency\": \"usd\"\n    },\n    \"credentialSecret\": \"STRIPE_TEST_KEY\"\n  },\n  \"impact\": {\n    \"dimension\": \"emails\",\n    \"unit\": \"emails\",\n    \"amount\": \"count(input.to)\",\n    \"bound\": \"exact\"\n  },\n  \"verify\": {\n    \"url\": \"https://api.example.com/v1/messages/{{response.id}}\",\n    \"status\": 200,\n    \"match\": [\n      {\n        \"path\": \"status\",\n        \"equals\": \"sent\"\n      }\n    ]\n  },\n  \"governed\": true\n}",
)

Response

{
  "success": true,
  "data": {
    "id": "act_01JABCDEF",
    "environmentId": "19f5cc2e-7657-437a-9268-83cd3d563563",
    "name": "create-ticket",
    "description": "string",
    "method": "GET",
    "urlTemplate": "string",
    "headers": {},
    "bodyTemplate": {},
    "inputSchema": {},
    "requiresApproval": true,
    "enabled": true,
    "secrets": [
      "string"
    ],
    "currentVersionId": "acv_01JABCDEF",
    "adapter": {
      "type": "stripe.refund",
      "config": {
        "account": "acct_123",
        "mode": "test",
        "currency": "usd"
      },
      "credentialSecret": "STRIPE_TEST_KEY"
    },
    "governed": true,
    "impact": {
      "dimension": "emails",
      "unit": "emails",
      "amount": "count(input.to)",
      "bound": "exact"
    },
    "verify": {
      "url": "https://api.example.com/v1/messages/{{response.id}}",
      "status": 200,
      "match": [
        {
          "path": "status",
          "equals": "sent"
        }
      ]
    },
    "createdAt": "2019-08-24T14:15:22Z",
    "updatedAt": "2019-08-24T14:15:22Z"
  }
}

{
  "success": false,
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid request data",
    "details": {
      "url": "Invalid URL format"
    }
  }
}

{
  "success": false,
  "error": {
    "code": "AUTHENTICATION_ERROR",
    "message": "Invalid or missing API key"
  }
}

{
  "success": false,
  "requestId": "req_0123456789abcdef0123456789abcdef",
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid request data",
    "details": {}
  }
}

{
  "success": false,
  "error": {
    "code": "NOT_FOUND",
    "message": "Resource not found"
  }
}

{
  "success": false,
  "requestId": "req_0123456789abcdef0123456789abcdef",
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid request data",
    "details": {}
  }
}

{
  "success": false,
  "error": {
    "code": "RATE_LIMIT_EXCEEDED",
    "message": "Rate limit exceeded. Please try again later."
  }
}