Publish a function version

Publish source code as the function’s new current version. A version never changes: publishing again appends one. allowedActions lists the actions the function may call, by name; each must exist in this environment and be enabled (400 ALLOWED_ACTION_UNAVAILABLE). A call to any other action is refused in the runner and again by the API. Budgets default to 50 action calls, 1,000 ms of CPU, 100 binding calls and 30,000 ms per run. straightThrough lets a run skip the plan for writes to some of those actions, up to a number of writes per run; without it a straight-through run reads and does not write.

JavaScript: an ES module whose default export is async function run(input, anlyon). Python: a module that defines run(input, anlyon). anlyon.invoke(action, input) and anlyon.read(action, input) call actions; anlyon.log(message) adds a line to the run. The function has no network, no environment variables and no secrets. A call answers { ok: true, result } or { ok: false, error }. result is the action invocation: the provider’s reply as text in result.body, and parsed in result.json (null when it is not JSON).

POST/api/v2/functions/{name}/versions

Authorization

AuthorizationBearer token (Anlyon API key) · headerrequired

Workspace API key sent as Authorization: Bearer <key>.

better-auth.session_tokenAPI key · cookierequired

Browser session used by dashboard-only operations.

Path parameters

namestringrequired

The function's name or id (fn_...).

min length 1 · max length 100

Header parameters

X-Request-Idstring

Optional caller correlation ID. Unsafe or oversized values are replaced.

max length 128

Request body

requiredapplication/json

languagestringrequired

Allowed:javascriptpython

sourcestringrequired

One module. At most 256 KB.

min length 1 · max length 262144

allowedActionsstring[]

Action names the function may call. Each must exist and be enabled. Omitted, the list is read from the source's literal anlyon.invoke("…") and anlyon.read("…") calls; a source that computes an action name, or does not parse, needs it listed (400 ALLOWED_ACTIONS_REQUIRED).

max items 100

inputSchemaobject

A JSON Schema the run's input must match.

budgetsFunctionBudgets

Per-run budgets. When one runs out the run ends budget_exceeded.

Show properties

maxActionCallsinteger

Action calls dispatched in one run. Default 50.

min 1 · max 500

maxCpuMsinteger

CPU time in one run. Default 1000.

min 1 · max 30000

maxSubrequestsinteger

Calls through the anlyon binding in one run

min 1 · max 1000

timeoutMsinteger

Wall time of one run. Default 30000.

min 100 · max 300000

straightThroughFunctionStraightThroughPolicy | null

When a run may skip the plan. Omitted or null

Show properties

Any of:

FunctionStraightThroughPolicy

actionsstring[]required

Allowed actions a straight-through run may write to. Each must be in allowedActions.

min items 1 · max items 100

maxWritesintegerrequired

Writes in one straight-through run.

min 1 · max 500

null

null

Responses

201

The function and its new current version.

successbooleanrequired

Allowed:true

dataobjectrequired

Show properties

functionFunctionrequired

Show properties

idstringrequired

namestringrequired

descriptionstring | nullrequired

environmentIdstring<uuid>required

currentVersionFunctionVersion | nullrequired

Null until the first publish.

Show properties

Any of:

FunctionVersion

idstringrequired

The version id.

versionintegerrequired

min 1

languagestringrequired

Allowed:javascriptpython

digeststringrequired

SHA-256 of the source.

allowedActionsstring[]required

inputSchemaobjectrequired

budgetsobjectrequired

Show properties

maxActionCallsintegerrequired

maxCpuMsintegerrequired

maxSubrequestsintegerrequired

timeoutMsintegerrequired

straightThroughFunctionStraightThroughPolicy | nullrequired

Show properties

Any of:

FunctionStraightThroughPolicy

FunctionStraightThroughPolicy

null

null

reviewFunctionVersionReview | nullrequired

Show properties

Any of:

FunctionVersionReview

FunctionVersionReview

null

null

createdAtstring<date-time>required

null

null

createdAtstring<date-time>required

updatedAtstring<date-time>required

versionFunctionVersionrequired

Show properties

idstringrequired

The version id.

versionintegerrequired

min 1

languagestringrequired

Allowed:javascriptpython

digeststringrequired

SHA-256 of the source.

allowedActionsstring[]required

inputSchemaobjectrequired

budgetsobjectrequired

Show properties

maxActionCallsintegerrequired

maxCpuMsintegerrequired

maxSubrequestsintegerrequired

timeoutMsintegerrequired

straightThroughFunctionStraightThroughPolicy | nullrequired

Show properties

Any of:

FunctionStraightThroughPolicy

actionsstring[]required

Allowed actions a straight-through run may write to. Each must be in allowedActions.

min items 1 · max items 100

maxWritesintegerrequired

Writes in one straight-through run.

min 1 · max 500

null

null

reviewFunctionVersionReview | nullrequired

Show properties

Any of:

FunctionVersionReview

astFunctionSourceFindingsrequired

What the source says it calls and uses, read from its syntax tree. Advice for people; what a run may call is the version's allowedActions.

Show properties

languagestringrequired

Allowed:javascriptpython

parsedbooleanrequired

parseErrorstring | nullrequired

callsobject[]required

Show properties

Array of object

kindstringrequired

Allowed:invokeread

actionstringrequired

lineintegerrequired

proposedAllowedActionsstring[]required

computedActionNamesobject[]required

Show properties

Array of object

kindstringrequired

Allowed:invokeread

lineintegerrequired

riskyobject[]required

Network, file, process, environment and eval APIs. They fail inside a function anyway.

Show properties

Array of object

apistringrequired

categorystringrequired

Allowed:networkfileprocessenvironmenteval

lineintegerrequired

writesInLoopobject[]required

Show properties

Array of object

actionstring | nullrequired

lineintegerrequired

aiobject | nullrequired

The AI review, for a workspace with Anlyon Vigil on. Null until it is done.

Show properties

statusstringrequired

Allowed:reviewedskippedfailed

reasonstring | nullrequired

modelstring | nullrequired

summarystring | nullrequired

purposestring | nullrequired

Allowed:refundspaymentsmessagesrecordsaccountslookupsother

riskyPatternsobject[]required

Show properties

Array of object

patternstringrequired

Allowed:writes_in_loopmoney_per_itemamount_from_inputunchecked_write

descriptionstringrequired

probabilitynumberrequired

min 0 · max 1

suggestedRiskTierstring | nullrequired

Allowed:routinelowmoderatehighcritical

confidencenumber | nullrequired

min 0 · max 1

truncatedbooleanrequired

reviewedAtstring<date-time>required

null

null

createdAtstring<date-time>required

400

Bad Request - Invalid input data

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

How to get past this error, for a person or an agent. Present on refusals with a known next step, such as a missing scope or role, a plan or billing limit, a halted environment, or a missing secret, connected account, OAuth app or end-user header. Absent when there is no fix to give. Kept in production responses, unlike details.

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

401

Unauthorized - Invalid or missing API key

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

403

Authenticated credential lacks the required scope or workspace access.

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

404

Not Found - Resource does not exist

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

429

Too Many Requests - Rate limit exceeded. A workspace's API requests are limited per minute and per UTC clock hour by plan; Retry-After says when to try again, and an hourly refusal names the limit and when the count resets. Successful responses carry the same limits in X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset (the minute) and X-RateLimit-Limit-Hour, X-RateLimit-Remaining-Hour, X-RateLimit-Reset-Hour (the hour).

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

Try it

Server

Base URLCustom base URLOverrides the selected server when set.

Authorization

Bearer token (Anlyon API key)Remember on this deviceInclude my values in samples

Parameters

X-Request-IdheaderOptional caller correlation ID. Unsafe or oversized values are replaced.namepath*The function's name or id (fn_...).

Bodyapplication/json

Request body

Request

curl -X POST 'https://api.anlyon.com/api/v2/functions/string/versions' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
  "language": "javascript",
  "source": "export default async function run(input, anlyon) { return anlyon.invoke(\"refund\", { order: input.order }); }",
  "allowedActions": [
    "refund"
  ],
  "inputSchema": {},
  "budgets": {
    "maxActionCalls": 50,
    "maxCpuMs": 1000,
    "maxSubrequests": 100,
    "timeoutMs": 30000
  },
  "straightThrough": {
    "actions": [
      "send-receipt"
    ],
    "maxWrites": 1
  }
}'

const response = await fetch("https://api.anlyon.com/api/v2/functions/string/versions", {
  method: "POST",
  headers: {
    "Authorization": "Bearer YOUR_TOKEN",
    "Content-Type": "application/json"
  },
  body: "{\n  \"language\": \"javascript\",\n  \"source\": \"export default async function run(input, anlyon) { return anlyon.invoke(\\\"refund\\\", { order: input.order }); }\",\n  \"allowedActions\": [\n    \"refund\"\n  ],\n  \"inputSchema\": {},\n  \"budgets\": {\n    \"maxActionCalls\": 50,\n    \"maxCpuMs\": 1000,\n    \"maxSubrequests\": 100,\n    \"timeoutMs\": 30000\n  },\n  \"straightThrough\": {\n    \"actions\": [\n      \"send-receipt\"\n    ],\n    \"maxWrites\": 1\n  }\n}"
});

import requests

response = requests.post(
    "https://api.anlyon.com/api/v2/functions/string/versions",
    headers={
        "Authorization": "Bearer YOUR_TOKEN",
        "Content-Type": "application/json"
    },
    data="{\n  \"language\": \"javascript\",\n  \"source\": \"export default async function run(input, anlyon) { return anlyon.invoke(\\\"refund\\\", { order: input.order }); }\",\n  \"allowedActions\": [\n    \"refund\"\n  ],\n  \"inputSchema\": {},\n  \"budgets\": {\n    \"maxActionCalls\": 50,\n    \"maxCpuMs\": 1000,\n    \"maxSubrequests\": 100,\n    \"timeoutMs\": 30000\n  },\n  \"straightThrough\": {\n    \"actions\": [\n      \"send-receipt\"\n    ],\n    \"maxWrites\": 1\n  }\n}",
)

Response

{
  "success": true,
  "data": {
    "function": {
      "id": "fn_V1StGXR8_Z5jdHi6B-myT",
      "name": "refund-with-checks",
      "description": "string",
      "environmentId": "19f5cc2e-7657-437a-9268-83cd3d563563",
      "currentVersion": {
        "id": "fnv_V1StGXR8_Z5jdHi6B-myT",
        "version": 1,
        "language": "javascript",
        "digest": "sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
        "allowedActions": [
          "lookup-order",
          "refund"
        ],
        "inputSchema": {},
        "budgets": {
          "maxActionCalls": 50,
          "maxCpuMs": 1000,
          "maxSubrequests": 100,
          "timeoutMs": 30000
        },
        "straightThrough": {
          "actions": [
            "send-receipt"
          ],
          "maxWrites": 1
        },
        "review": {
          "ast": {
            "language": "javascript",
            "parsed": true,
            "parseError": "string",
            "calls": [
              {
                "kind": "invoke",
                "action": "refund",
                "line": 5
              }
            ],
            "proposedAllowedActions": [
              "lookup-order",
              "refund"
            ],
            "computedActionNames": [
              {
                "kind": "invoke",
                "line": 0
              }
            ],
            "risky": [
              {
                "api": "fetch",
                "category": "network",
                "line": 0
              }
            ],
            "writesInLoop": [
              {
                "action": "string",
                "line": 0
              }
            ]
          },
          "ai": {
            "status": "reviewed",
            "reason": "assistant_disabled",
            "model": "vigil-1",
            "summary": "string",
            "purpose": "refunds",
            "riskyPatterns": [
              {
                "pattern": "writes_in_loop",
                "description": "string",
                "probability": 0
              }
            ],
            "suggestedRiskTier": "routine",
            "confidence": 0,
            "truncated": true,
            "reviewedAt": "2019-08-24T14:15:22Z"
          }
        },
        "createdAt": "2019-08-24T14:15:22Z"
      },
      "createdAt": "2019-08-24T14:15:22Z",
      "updatedAt": "2019-08-24T14:15:22Z"
    },
    "version": {
      "id": "fnv_V1StGXR8_Z5jdHi6B-myT",
      "version": 1,
      "language": "javascript",
      "digest": "sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
      "allowedActions": [
        "lookup-order",
        "refund"
      ],
      "inputSchema": {},
      "budgets": {
        "maxActionCalls": 50,
        "maxCpuMs": 1000,
        "maxSubrequests": 100,
        "timeoutMs": 30000
      },
      "straightThrough": {
        "actions": [
          "send-receipt"
        ],
        "maxWrites": 1
      },
      "review": {
        "ast": {
          "language": "javascript",
          "parsed": true,
          "parseError": "string",
          "calls": [
            {
              "kind": "invoke",
              "action": "refund",
              "line": 5
            }
          ],
          "proposedAllowedActions": [
            "lookup-order",
            "refund"
          ],
          "computedActionNames": [
            {
              "kind": "invoke",
              "line": 0
            }
          ],
          "risky": [
            {
              "api": "fetch",
              "category": "network",
              "line": 0
            }
          ],
          "writesInLoop": [
            {
              "action": "string",
              "line": 0
            }
          ]
        },
        "ai": {
          "status": "reviewed",
          "reason": "assistant_disabled",
          "model": "vigil-1",
          "summary": "string",
          "purpose": "refunds",
          "riskyPatterns": [
            {
              "pattern": "writes_in_loop",
              "description": "string",
              "probability": 0
            }
          ],
          "suggestedRiskTier": "routine",
          "confidence": 0,
          "truncated": true,
          "reviewedAt": "2019-08-24T14:15:22Z"
        }
      },
      "createdAt": "2019-08-24T14:15:22Z"
    }
  }
}

{
  "success": false,
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid request data",
    "details": {
      "url": "Invalid URL format"
    }
  }
}

{
  "success": false,
  "error": {
    "code": "AUTHENTICATION_ERROR",
    "message": "Invalid or missing API key"
  }
}

{
  "success": false,
  "requestId": "req_0123456789abcdef0123456789abcdef",
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid request data",
    "details": {},
    "fix": {
      "summary": "Log in again and approve the anlyon:secrets consent group, which grants secrets:write.",
      "command": "anlyon auth login --scope anlyon:secrets",
      "url": "https://console.anlyon.com/settings/api-keys",
      "docs": "https://docs.anlyon.com/cli/authentication"
    }
  }
}

{
  "success": false,
  "error": {
    "code": "NOT_FOUND",
    "message": "Resource not found"
  }
}

{
  "success": false,
  "error": {
    "code": "RATE_LIMIT_EXCEEDED",
    "message": "Rate limit exceeded. Please try again later."
  }
}