# Administration and IAM Policies, users, teams, API tokens, tenant configuration, logs and archives. ## Operations ```graphql # Administration and IAM (admin-iam) # Policies, users, teams, API tokens, tenant configuration, logs and archives. # Query compileSchemaXML: String! # Compile standalone XML schema syntax into JSON Schema without persisting it; host restrictions apply when embedded generateDefaultDataQuery: String # Generate a default GraphQL data query for an event topic getAPIToken: APITokenState # Fetch an API token by ID (user can only see their own tokens) getArchiveExecution: ArchiveExecutionOutput # A single archive execution by id, or null if no such execution exists in the caller's tenant getArchiveJob: ArchiveJobOutput # Fetch a single archive job by id, scoped to the caller's tenant getConfig: TenantConfigOutput # Get current tenant configuration getConfigVersion: TenantConfigOutput # Get a specific version of tenant configuration getExistingUser: ExistingUser # Read an existing user without claiming IaC ownership getExistingUserBy: ExistingUser # Look up an existing user by email or external identifier without claiming IaC ownership getIAMPolicy: IAMPolicyState # Fetch an IAM policy by ID getIAMPolicyAttachment: IAMPolicyAttachment # Read a policy attachment in the current tenant getIncomingWebhookStats: IncomingWebhookStats! # Get aggregate statistics for an incoming webhook endpoint getMagicQueryGraphQL: MagicQueryOperation! # Resolves a Magic Query string to the real GraphQL operation and variables it runs, so consumers can graduate from the façade to raw GraphQL getMagicQuerySchema: MagicQuerySchema! # Returns the input JSON Schema and output introspection for a Magic Query noun, so consumers (especially LLMs) can learn its contract before calling magicQuery getServiceAccount: UserState # Read a BOT service account getTaskDefinition: TaskDefinitionState # Fetch a task definition by ID getTeam: TeamState # Fetch a team by ID getTeamBy: TeamState # Find a team by its unique name in the authenticated tenant getTeamMembers: TeamMemberConnection! # Fetch members of a team getTeamMembership: TeamMembershipState # Read a team membership by its own identity getUser: UserState # Fetch a user by ID getUserBy: UserState # Fetch a user by external ID or email helpChapter: HelpChapter # Read a chapter of the current published manual edition helpChapters: [HelpChapterInfo!]! # List human-facing manual chapters from the running deployment iacAdvisoryPlan: IaCHostedValue! # Non-executable advisory plan; persists no source, approval, lease or execution state iacAdvisorySnapshot: IaCHostedValue! # Read-only coordinator capability; ordinary clients cannot invoke it iacApplyStatus: IaCHostedValue! # Reconcile a lost Apply response iacChangeTimeline: IaCChangeTimeline! # Read up to 100 comments and events, oldest first, with an exclusive cursor iacDeclaredVariables: [IaCDeclaredVariable!]! # List the variables a commit's source declares, in declaration order, for checking that a stack holds a value for each before promoting that commit iacGitChange: IaCGitChangeValue # Read one draft Change Request in its owning stack iacGitChangeReview: IaCChangeReview # Read a safe projection of the original stored plan iacGitChangeReviews: [IaCChangeReviewEntry!]! # Read bounded plan highlights for at most 100 stack-local Change Requests iacGitChanges: [IaCGitChangeValue!]! # List up to 100 Change Requests, newest first, optionally filtered by branch, status or author iacGitRepository: IaCGitRepositoryValue! # Discover the authenticated Git remote for an authorized stack iacGitSnapshot: IaCGitSnapshotValue! # Read a bounded source snapshot after tenant, IAM and stack-grant authorization iacGuides: [IaCGuide!]! # Every authoring guide, for a tool that syncs them to a folder iacModulePackages: IaCHostedValue! # Read immutable public GitHub package bytes for editor intelligence; validates lock integrity and creates no executable identity iacSchema: IaCSchemaDocument! # The infrastructure-only view of this schema, for declarative tooling iacSchemaDocument: IaCSchemaDocumentPayload! # Fetch the JSON Schema document a SCHEMA-kind validator references, for declarative tooling iacStackHistory: IaCStackHistoryPage! # List a stack's applied revisions, newest first, each linked to the Change Request that produced it iacStackOverview: IaCStackOverview! # Summarise a stack: revision, owner, last apply, resource kinds and pending changes iacStackPermissions: IaCStackPermissions! # Read what the viewer may do on a stack, and who may apply its changes iacStackReadme: String # Read README iacStackResources: IaCStackResourcePage! # List deployed resources and those only open Change Requests would create, with the last and pending Change Requests for each iacStackRules: IaCStackRules! # Read a stack's rules; a stack that never set any reads the defaults iacStackSecrets: [IaCStackSecret!]! # List a stack's secrets by name with their version history, never their values iacStackState: IaCHostedValue! # Read current deployment state; source is held separately in Git iacStackValues: [IaCStackVariable!]! # List the current value of every variable the stack holds, set ones only, with secrets listed by name and never by value iacStacks: [IaCStackValue!]! # List stacks visible to this user, up to 100 per page iacValidate: IaCValidationResult! # Validate an infrastructure artifact listArchiveExecutions: ArchiveExecutionConnection! # Run history for one archive job, newest run first (by startedAt), with pagination listArchiveJobs: ArchiveJobConnection! # List the tenant's archive jobs as a cursor-paginated connection, filtered and sorted in the database listBotAPITokens: APITokenConnection! # List the API tokens belonging to a bot user listConfigVersions: TenantConfigVersionConnection! # List version history for tenant configuration, newest first, with pagination listDataChangeEventTopics: [DataChangeEventGroup!]! # List all valid data change event topics, grouped by resource listEndpointLogs: EndpointLogConnection! # List endpoint logs with pagination listIAMActions: [IAMActionGroup!]! # List all available IAM actions grouped by resource listIAMPolicies: IAMPolicyConnection! # List IAM policies with pagination listMagicQueries: [MagicQueryInfo!]! # Lists every available Magic Query noun with a short description and its options — the discovery entry point listMyAPITokens: APITokenConnection! # List the current user's API tokens with pagination listTaskDefinitions: TaskDefinitionConnection! # List task definitions with pagination listTeams: TeamConnection! # List teams with pagination listUserPolicies: IAMPolicyConnection! # List policies attached to a user listUsers: UserConnection! # List users with pagination and filtering magicQuery: JSON! # Executes a Magic Query string and returns the predefined query's JSON result me: Viewer! # Who the caller is and which tenant they are acting in myEffectivePermissions: MyPermissions! # Get current user's effective permissions ping: String! # Health check endpoint platformInfo: PlatformInfo! # Which build of the platform is answering queryLogs: UnifiedLogConnection! # Query logs across all drains (webhook, execution, edge app, archive) renderSchemaXML: String! # Render JSON Schema as native XML without dropping unsupported keywords or changing a saved document schemaAuthoringCatalog: JSON! # Compiler-owned vocabulary for the standalone XML JSON Schema dialect, including native form annotations searchHelp: HelpSearchResult! # Search human-facing manuals using shared semantic and text retrieval settings: Settings! # This instance's settings teamsForUser: [TeamState!]! # Teams an account belongs to # Mutation addTeamMember: TeamMemberPayload! # Add a user to a team attachPolicy: AttachPolicyPayload! # Attach a policy to a user createAPIToken: CreateAPITokenPayload! # Create a new API token for the calling user createArchiveJob: UpsertArchiveJobPayload! # Create a new archive job createBotAPIToken: CreateAPITokenPayload! # Create a new API token on behalf of a bot user createIAMPolicy: IAMPolicyPayload! # Create an IAM policy createIAMPolicyAttachment: IAMPolicyAttachmentPayload! # Attach a policy for IaC ownership; an existing attachment must be imported createTaskDefinition: UpsertTaskDefinitionPayload! # Create a new task definition createTeam: UpsertTeamPayload! # Create a new team createTeamMembership: CreateTeamMembershipPayload! # Create a new membership without adopting an existing one createUser: UpsertUserPayload! # Create a new service account deleteArchiveJob: DeletePayload! # Delete an archive job, cancelling its schedule deleteConfigKey: DeleteConfigKeyPayload! # Delete a config key deleteIAMPolicy: DeletePayload! # Delete an IAM policy deleteIAMPolicyAttachment: DetachPolicyPayload! # Detach the policy without deleting its user or policy deleteTaskDefinition: DeletePayload! # Delete a task definition deleteTeam: DeletePayload! # Delete a team deleteTeamMembership: DeleteTeamMembershipPayload! # Delete only the membership, leaving the user and team intact deleteUser: DeletePayload! # Delete a service account detachPolicy: DetachPolicyPayload! # Detach a policy from a user generateJmfToken: JmfTokenPayload! # Sets or replaces the JMF access token with a new random one, returned once in the result iacAddChangeComment: IaCChangeComment! # Append a plain text comment to a proposed or applied Change Request iacApplyChange: IaCHostedValue! # Atomically Apply the reviewed plan as the actual user, publishing main only on success iacCancelChange: IaCGitChangeValue! # Close a draft Change Request without applying it iacConfigureStack: IaCStackUpdateResult! # Configure stack ownership and archival under stack administration permissions iacCreateStack: IaCStackValue! # Create a hosted Git stack iacDeleteStackSecret: Boolean! # Mark a stack secret deleted by writing a deleted version; earlier versions are kept for audit iacDismissReview: IaCGitChangeValue! # Withdraw your own review, or, as a stack admin, dismiss someone else's with a reason iacGitCreateChange: IaCGitChangeValue! # Capture an immutable draft Change Request; no client-supplied plan is trusted or applied iacGitDeleteWorkingRef: IaCGitStageValue! # Immediately delete a working branch with expected-head protection iacGitRenameChange: IaCGitChangeValue! # Rename a draft proposal without altering source, state, or approval iacGitReviseChange: IaCGitChangeValue! # Capture the Change Request branch's pushed head as its next revision, keeping the conversation iacGitStage: IaCGitStageValue! # Stage immutable objects without changing branch refs or deployed configuration iacGitUpdateChangeDescription: IaCGitChangeValue! # Replace a draft Change Request's description iacGitUpdateWorkingRef: IaCGitRefValue! # Compare and update a working branch; never publishes main or applies configuration iacGrantStack: IaCStackUpdateResult! # Manage stack grants; grants never bypass resource permissions iacHostedState: IaCHostedValue! # Coordinator-only state capability; unavailable to ordinary clients iacImportStackValues: [IaCStackVariable!]! # Seed a stack's non-sensitive values once, when it has none (otherwise VALUES_EXIST); every later change is a reviewed values change iacLeaveEditing: IaCHostedValue! # End an authoring presence session iacMigrateStack: IaCStackValue! # Atomically create an absent stack and import legacy state iacPlanChange: IaCHostedValue! # Produce a trusted server plan without applying resources iacProposeValuesChange: IaCGitChangeValue! # Propose new stack values as a values change: a Change Request on refs/cococo/values that plans main's source with the proposed values and is reviewed, gated and applied like any change iacPurgeStackSecret: IaCStackSecret! # Irreversibly destroy stored secret values, for example after a leak iacReviewChange: IaCGitChangeValue! # Give a verdict on the current revision; it replaces your earlier verdict on that revision iacSetStackSecret: IaCStackSecret! # Write a new version of a stack secret; earlier versions are kept iacUpdateEditing: IaCHostedValue! # Update authoring presence without changing source or deployment state iacUpdateStackRules: IaCStackRules! # Change a stack's rules removeJmfToken: UpdateJmfSettingsPayload! # Removes the JMF access token removeTeamMember: TeamMemberPayload! # Remove a user from a team revealJmfToken: JmfTokenPayload! # Shows the JMF access token so an operator can set up a device revokeAPIToken: RevokeAPITokenPayload! # Revoke an API token revokeBotAPIToken: RevokeAPITokenPayload! # Revoke an API token belonging to a bot user rollbackConfig: RollbackConfigPayload! # Rollback to a previous config version runArchiveJob: RunArchiveJobPayload! # Run an archive job immediately, regardless of its schedule or isEnabled flag setJmfToken: UpdateJmfSettingsPayload! # Sets or replaces the JMF access token with one you supply, e setTeamMemberRole: SetTeamMemberRolePayload! # Set a team member's role updateAppAccessSettings: UpdateAppAccessSettingsPayload! # Saves the app access section updateArchiveJob: UpsertArchiveJobPayload! # Update an archive job updateConfig: UpdateConfigPayload! # Update tenant configuration updateFulfillmentSettings: UpdateFulfillmentSettingsPayload! # Save only the fulfillment section, preserving every other settings section updateIAMPolicy: IAMPolicyPayload! # Update an IAM policy updateImposingSettings: UpdateImposingSettingsPayload! # Saves the imposing section updateJmfSettings: UpdateJmfSettingsPayload! # Turns the direct JMF endpoint on or off updateMachineLearningSettings: UpdateMachineLearningSettingsPayload! # Saves the machine-learning section updatePaperWeightSettings: UpdatePaperWeightSettingsPayload! # Saves the paper weight section updateProductionBoardSettings: UpdateProductionBoardSettingsPayload! # Saves the production board section updateQuotingSettings: UpdateQuotingSettingsPayload! # Saves the quoting section updateStatusRuleSettings: UpdateStatusRuleSettingsPayload! # Saves the status rules section updateTaskDefinition: UpsertTaskDefinitionPayload! # Update a task definition updateTeam: UpsertTeamPayload! # Update a team updateTimeSettings: UpdateTimeSettingsPayload! # Saves the time section updateUnitSettings: UpdateUnitSettingsPayload! # Saves the units section updateUser: UpsertUserPayload! # Update a service account upsertArchiveJob: UpsertArchiveJobPayload! # Create an archive job, or fully overwrite an existing one when `input upsertTaskDefinition: UpsertTaskDefinitionPayload! # Create or update a task definition upsertTeam: UpsertTeamPayload! # Create or update a team upsertUser: UpsertUserPayload! # Create or update a service account # Subscription dataChangeEvents: DataChangeEvent! # Subscribe to real-time data change events iacEditingPresence: IaCEditingSnapshot! # Observe current collaborators and stack revision changes while editing a stack streamLogs: UnifiedLogState! # Stream logs across drains (webhook, execution, edge app) as they are written # Call describe_operation(name) for arguments and input types. ``` ## Exact schema Download [complete SDL](/schemas/admin-iam.graphql) (196045 bytes). Use the SDL to validate operations; the digest omits argument signatures. ## Guides