STACK API

openapi: 3.1.0
info:
  title: STACK API
  version: '2026-11-10'
  description: 'GENERATED FROM DOCUMENTATION by API Evangelist on 2026-11-10: 16 operation(s) read from 6 public documentation page(s) (each operation
    names its page in x-source). This is not the provider''s published contract; STACK has published no machine-readable contract that the pipeline
    could find. Engine: local.'
  x-evidence-tiers:
    code-example: 7
    documentation: 9
    pages-with-code: 6
    pages-read: 6
  x-generated-from: documentation
  x-provenance: generated
  x-authored-by: API Evangelist
  x-generated: '2026-11-10'
  x-generator: generate-contract-from-docs.py
  x-engine: local
  x-sources:
  - https://getstack.run/docs/api/scan
  - https://getstack.run/docs/api/team
  - https://getstack.run/docs/api/audit
  - https://getstack.run/docs/api/proxy
  - https://getstack.run/docs/api/usage
  - https://getstack.run/docs/api/agents
servers:
- url: https://api.getstack.run
paths:
  /v1/agents/register:
    post:
      operationId: post_v1_agents_register
      tags:
      - Agents
      summary: POST /v1/agents/register
      x-source: https://getstack.run/docs/api/agents
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostV1AgentsRegisterRequest'
      responses:
        '201':
          description: Success (shape read from the example response on the page)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostV1AgentsRegisterResponse'
      x-evidence:
        kind: code-example
        language: curl
        snippet: "curl -X POST https://api.getstack.run/v1/agents/register  -H \"Content-Type: application/json\"  -H \"Authorization: Bearer\
          \ sk_live_op_abc123\"  -d '{\n \"name\": \"invoice-processor\",\n \"description\": \"Processes incoming invoices and extracts line items\"\
          ,\n \"accountability_mode\": \"enforced\",\n \"on_critical\": \"block\"\n }' Response - 201 Created json {\n \"id\": \"agt_7kx9m2nq4p\"\
          ,\n \"operator_id\": \"op_abc123\",\n \"na"
  /v1/audit:
    get:
      operationId: get_v1_audit
      tags:
      - Audit
      summary: GET /v1/audit
      x-source: https://getstack.run/docs/api/audit
      parameters:
      - name: agent_id
        in: query
        required: false
        schema:
          type: string
      - name: limit
        in: query
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Success (shape read from the example response on the page)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetV1AuditResponse'
      x-evidence:
        kind: code-example
        language: curl
        snippet: 'curl -s "https://api.getstack.run/v1/audit?limit=20&agent_id=agt_support"  -H "Authorization: Bearer $STACK_API_KEY"'
  /v1/audit/chain-head:
    get:
      operationId: get_v1_audit_chain_head
      tags:
      - Audit
      summary: Returns the most recent entry_hash for your operator along with the total number of rows.
      description: GET /v1/audit/chain-head Returns the most recent entry_hash for your operator along with the total number of rows.
      x-source: https://getstack.run/docs/api/audit
      responses:
        '200':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetV1AuditChainHeadResponse'
      x-evidence:
        kind: documentation
  /v1/audit/export:
    get:
      operationId: get_v1_audit_export
      tags:
      - Audit
      summary: Paginated export of audit rows for the authenticated operator.
      description: GET /v1/audit/export Paginated export of audit rows for the authenticated operator. Supports JSON, NDJSON, and CSV.
      x-source: https://getstack.run/docs/api/audit
      parameters:
      - name: from
        in: query
        required: false
        schema:
          type: string
        description: ISO-8601 datetime, inclusive lower bound on timestamp
      - name: to
        in: query
        required: false
        schema:
          type: string
        description: ISO-8601 datetime, exclusive upper bound on timestamp
      - name: format
        in: query
        required: false
        schema:
          type: string
        description: 'json | ndjson | csv (default: json)'
      - name: limit
        in: query
        required: false
        schema:
          type: integer
        description: '1–50000 (default: 10000)'
      - name: offset
        in: query
        required: false
        schema:
          type: integer
        description: '≥ 0 for pagination (default: 0)'
      responses:
        '200':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetV1AuditExportResponse'
      x-evidence:
        kind: documentation
  /v1/audit/verify-chain:
    get:
      operationId: get_v1_audit_verify_chain
      tags:
      - Audit
      summary: Re-walks the chain for your operator and reports whether it is intact.
      description: GET /v1/audit/verify-chain Re-walks the chain for your operator and reports whether it is intact.
      x-source: https://getstack.run/docs/api/audit
      parameters:
      - name: from
        in: query
        required: false
        schema:
          type: string
        description: ISO-8601 datetime, inclusive lower bound (optional)
      - name: to
        in: query
        required: false
        schema:
          type: string
        description: ISO-8601 datetime, exclusive upper bound (optional)
      - name: limit
        in: query
        required: false
        schema:
          type: integer
        description: 1–100000 (optional, no default)
      responses:
        '200':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetV1AuditVerifyChainResponse'
      x-evidence:
        kind: documentation
  /v1/proxy:
    post:
      operationId: post_v1_proxy
      tags:
      - Proxy
      summary: POST /v1/proxy
      x-source: https://getstack.run/docs/api/proxy
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostV1ProxyRequest'
      responses:
        '201':
          description: Success (shape read from the example response on the page)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostV1ProxyResponse'
      x-evidence:
        kind: code-example
        language: curl
        snippet: "curl -X POST https://api.getstack.run/v1/proxy  -H \"Authorization: Bearer sk_live_your_key\"  -H \"X-Passport-Token: eyJhbGciOiJFZERTQSIs...\"\
          \  -H \"Content-Type: application/json\"  -d '{\n \"service\": \"github\",\n \"method\": \"GET\",\n \"url\": \"https://api.github.com/user/repos?per_page=5\"\
          \n }' ProxyRequestInput Fields service (string, required) - provider slug (e.g. \"github\", \"slack\", \"openai\"). Maps to a con"
  /v1/proxy/operations/get:
    post:
      operationId: post_v1_proxy_operations_get
      tags:
      - Proxy
      summary: Write operation recovery
      x-source: https://getstack.run/docs/api/proxy
      parameters:
      - name: Authorization
        in: header
        required: true
        schema:
          type: string
        description: Bearer $STACK_TOKEN
      - name: X-Passport-Token
        in: header
        required: true
        schema:
          type: string
        description: a valid passport JWT
      - name: Content-Type
        in: header
        required: true
        schema:
          type: string
        description: application/json
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostV1ProxyOperationsGetRequest'
      responses:
        '201':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostV1ProxyOperationsGetResponse'
      x-evidence:
        kind: documentation
  /v1/proxy/usage:
    get:
      operationId: get_v1_proxy_usage
      tags:
      - Proxy
      summary: Check Proxy Usage
      x-source: https://getstack.run/docs/api/proxy
      parameters:
      - name: Authorization
        in: header
        required: true
        schema:
          type: string
        description: Bearer $STACK_TOKEN
      responses:
        '200':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetV1ProxyUsageResponse'
      x-evidence:
        kind: documentation
  /v1/scan:
    post:
      operationId: post_v1_scan
      tags:
      - Scan
      summary: POST /v1/scan
      x-source: https://getstack.run/docs/api/scan
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostV1ScanRequest'
      responses:
        '201':
          description: Success (shape read from the example response on the page)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostV1ScanResponse'
      x-evidence:
        kind: code-example
        language: curl
        snippet: "curl -X POST https://api.getstack.run/v1/scan  -H \"Authorization: Bearer sk_live_your_key\"  -H \"Content-Type: application/json\"\
          \  -d '{\n \"content\": \"<the email body, document text, or scraped webpage>\",\n \"context\": \"email\",\n \"source\": \"sender@external.com\"\
          \n }' Request Fields content (string | object, required) - the content to scan. Strings scanned directly; objects walked one level deep,\
          \ same as p"
  /v1/scan/usage:
    get:
      operationId: get_v1_scan_usage
      tags:
      - Scan
      summary: GET /v1/scan/usage
      x-source: https://getstack.run/docs/api/scan
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: "curl https://api.getstack.run/v1/scan/usage  -H \"Authorization: Bearer sk_live_your_key\" json {\n \"tier\": \"developer\"\
          ,\n \"limit\": 250000,\n \"used\": 1523,\n \"remaining\": 248477,\n \"period\": \"2026-04\"\n} Security Events Every match (warning\
          \ or critical) records a prompt_injection security event with: pattern_id - which L1 pattern caught it field_path - where in the content\
          \ matched_excerpt - first ~80 char"
  /v1/services/conn_abc123/proxy-toggle:
    post:
      operationId: post_v1_services_conn_abc123_proxy_toggle
      tags:
      - Services
      summary: Toggle it using the service proxy-toggle endpoint
      x-source: https://getstack.run/docs/api/proxy
      parameters:
      - name: Authorization
        in: header
        required: true
        schema:
          type: string
        description: Bearer $STACK_TOKEN
      - name: Content-Type
        in: header
        required: true
        schema:
          type: string
        description: application/json
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostV1ServicesConnAbc123ProxyToggleRequest'
      responses:
        '201':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /v1/team/members:
    get:
      operationId: get_v1_team_members
      tags:
      - Team
      summary: List Team Members
      x-source: https://getstack.run/docs/api/team
      responses:
        '200':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetV1TeamMembersResponse'
      x-evidence:
        kind: documentation
    post:
      operationId: post_v1_team_members
      tags:
      - Team
      summary: POST /v1/team/members
      x-source: https://getstack.run/docs/api/team
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostV1TeamMembersRequest'
      responses:
        '201':
          description: Success (shape read from the example response on the page)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostV1TeamMembersResponse'
      x-evidence:
        kind: code-example
        language: curl
        snippet: "curl -X POST https://api.getstack.run/v1/team/members  -H \"Authorization: Bearer $STACK_API_KEY\"  -H \"Content-Type: application/json\"\
          \  -d '{\n \"email\": \"developer@example.com\",\n \"name\": \"Jane Developer\",\n \"role\": \"standard\",\n \"allowed_connections\"\
          : [\"scon_slack_prod\", \"scon_github_ops\"]\n }' email (string, required) - valid email address name (string, required) - display name,\
          \ 1-100 characters role "
  /v1/team/members/{id}:
    delete:
      operationId: delete_v1_team_members_id
      tags:
      - Team
      summary: Revoke a Team Member
      x-source: https://getstack.run/docs/api/team
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeleteV1TeamMembersIdResponse'
      x-evidence:
        kind: documentation
    patch:
      operationId: patch_v1_team_members_id
      tags:
      - Team
      summary: Update a Team Member
      x-source: https://getstack.run/docs/api/team
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      requestBody:
        required: false
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchV1TeamMembersIdRequest'
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /v1/usage:
    get:
      operationId: get_v1_usage
      tags:
      - Usage
      summary: GET /v1/usage
      x-source: https://getstack.run/docs/api/usage
      parameters:
      - name: since
        in: query
        required: false
        schema:
          type: string
      - name: until
        in: query
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: 'curl "https://api.getstack.run/v1/usage?since=2026-08-01T00:00:00Z&until=2026-09-01T00:00:00Z"  -H "Authorization: Bearer $STACK_TOKEN"
          Consumption consumption.activity.total counts every audit event only when total_coverage is complete. Partial coverage makes the total
          a lower bound. consumption.activity.total_coverage states whether the activity total is complete or partial. consumption.actions '
components:
  schemas:
    PostV1AgentsRegisterRequest:
      type: object
      properties:
        name:
          type: string
        description:
          type: string
        accountability_mode:
          type: string
        on_critical:
          type: string
    PostV1AgentsRegisterResponse:
      type: object
      properties:
        id:
          type: string
        operator_id:
          type: string
        name:
          type: string
        description:
          type: string
        status:
          type: string
        accountability_mode:
          type: string
        on_warning:
          type: string
        on_critical:
          type: string
        credential_access:
          type: string
        passport_blocked:
          type: boolean
        passport_blocked_reason:
          type:
          - string
          - 'null'
        passport_blocked_at:
          type:
          - string
          - 'null'
        icon_url:
          type:
          - string
          - 'null'
        llm_inject_system_prompt:
          type: boolean
        llm_redact_pii:
          type: boolean
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
    GetV1AuditResponse:
      type: object
      properties:
        entries:
          type: array
          items:
            type: object
            properties:
              entry_id:
                type: string
              timestamp:
                type: integer
              trace_id:
                type: string
              operator_id:
                type: string
              agent_id:
                type: string
              passport_jti:
                type: string
              layer:
                type: string
              action:
                type: string
              outcome:
                type: string
              duration_ms:
                type: integer
              error_code:
                type:
                - string
                - 'null'
              error_message:
                type:
                - string
                - 'null'
              prev_entry_hash:
                type: string
              entry_hash:
                type: string
        max_timestamp:
          type: integer
    GetV1AuditChainHeadResponse:
      type: object
      properties:
        operator_id:
          type: string
        latest_entry_hash:
          type: string
          description: null for brand‑new operators
        latest_timestamp:
          type: integer
          description: null for brand‑new operators
        total_entries:
          type: integer
        observed_at:
          type: string
    GetV1AuditExportResponse:
      type: object
      properties:
        operator_id:
          type: string
        count:
          type: integer
        from:
          type: string
        to:
          type: string
          description: nullable
        rows:
          type: array
          description: array of audit entry objects
    GetV1AuditVerifyChainResponse:
      type: object
      properties:
        operator_id:
          type: string
        verified_at:
          type: string
        valid:
          type: boolean
        total_checked:
          type: integer
        head_entry_hash:
          type: string
        first_break:
          type: object
          description: present only when valid is false
    PostV1ProxyRequest:
      type: object
      properties:
        service:
          type: string
        method:
          type: string
        url:
          type: string
    PostV1ProxyResponse:
      type: object
      properties:
        status:
          type: integer
        headers:
          type: object
          properties:
            content-type:
              type: string
            x-ratelimit-remaining:
              type: string
        body:
          type: array
          items:
            type: object
            properties:
              id:
                type: integer
              name:
                type: string
              full_name:
                type: string
              private:
                type: boolean
    PostV1ProxyOperationsGetRequest:
      type: object
      properties:
        operation_id:
          type: string
          description: stable operation handle identifier
        include_response:
          type: boolean
          description: whether to include the stored response
      required:
      - operation_id
    PostV1ProxyOperationsGetResponse:
      type: object
      properties:
        delivery_state:
          type: string
          description: admitted | dispatching | response_received | outcome_unknown
        replay_state:
          type: string
          description: none | screening | available | expired | erased
        accounting_state:
          type: string
          description: reserved | committed | released
        provider_outcome:
          type: string
          description: provider reconciliation state; Stripe can also return provider_status
    GetV1ProxyUsageResponse:
      type: object
      properties:
        tier:
          type: string
          description: subscription tier
        limit:
          type: integer
          description: monthly action limit (null for unlimited enterprise tier)
        used:
          type: integer
          description: actions used this month
        remaining:
          type: integer
          description: actions remaining (null for unlimited enterprise tier)
        period:
          type: string
          description: calendar month of the usage data
    PostV1ScanRequest:
      type: object
      properties:
        content:
          type: string
        context:
          type: string
        source:
          type: string
    PostV1ScanResponse:
      type: object
      properties:
        verdict:
          type: string
        scan_id:
          type: string
        duration_ms:
          type: integer
        match:
          type: object
          properties:
            pattern_id:
              type: string
            severity:
              type: string
            field_path:
              type: string
            matched_excerpt:
              type: string
            encoding:
              type: string
        llm:
          type: object
          properties:
            verdict:
              type: string
            confidence:
              type: integer
            reasoning:
              type: string
            model:
              type: string
        l3_degraded:
          type:
          - string
          - 'null'
    PostV1ServicesConnAbc123ProxyToggleRequest:
      type: object
      properties:
        proxy_enabled:
          type: boolean
          description: set to true to enable proxy for the service connection
      required:
      - proxy_enabled
    GetV1TeamMembersResponse:
      type: object
      properties:
        members:
          type: array
          description: bare array of member objects
    PostV1TeamMembersRequest:
      type: object
      properties:
        email:
          type: string
        name:
          type: string
        role:
          type: string
        allowed_connections:
          type: array
          items:
            type: string
    PostV1TeamMembersResponse:
      type: object
      properties:
        id:
          type: string
        operator_id:
          type: string
        email:
          type: string
        name:
          type: string
        role:
          type: string
        status:
          type: string
        allowed_connections:
          type: array
          items:
            type: string
        invited_at:
          type: string
          format: date-time
        joined_at:
          type:
          - string
          - 'null'
        revoked_at:
          type:
          - string
          - 'null'
    DeleteV1TeamMembersIdResponse:
      type: object
      properties:
        success:
          type: boolean
    PatchV1TeamMembersIdRequest:
      type: object
      properties:
        role:
          type: string
          description: '"readonly", "standard", or "admin"'
        allowed_connections:
          type: string
          description: replacement allowlist. Use null for unrestricted access, [] for no service access, or omit the field to leave it unchanged.
  securitySchemes:
    bearer:
      type: http
      scheme: bearer
security:
- bearer: []
tags:
- name: Agents
- name: Audit
- name: Proxy
- name: Scan
- name: Services
- name: Team
- name: Usage