Goosy Bear Items API

openapi: 3.2.0
info:
  title: Goosybear Ai Items API
  version: 1.0.0-beta
  description: 'Operations tagged items across 2 of this provider''s published API definitions: goosybear-ai-openapi.json, goosybear-ai-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://app.goosybear.ai
  description: Production
security:
- tenantApiKey: []
tags:
- name: Items
paths:
  /api/v1/tools/items.place:
    post:
      operationId: call_items_place
      summary: Call items.place
      description: 'Bring an existing item — a photo, video, document, file, table, post, site, automation — onto the canvas the member is on now, as its home; a project the member names is `work.file` — ''put the leads table on this canvas'', ''bring the logo file into this project'', ''add the welcome email here''. Any item: a site, an automation, a video or short, a post, an image or photo, a document, an uploaded file, a data table or a widget. This verb finds the item itself, so call it on the ask: put the member''s words for the thing in item_name, a generic name too (''the new doc'', ''that photo from Friday''), for any item but a widget. Among several matches it takes the one in the project the member is on, then the exact name; otherwise it moves nothing and answers with the matches by name and place, so you can ask which. The item then lives in the project the member is on (where their new work starts when they are on none); if it lived in another project it leaves that one, because an item lives in one place. Nothing is copied or deleted, and the member can undo it. Send item_id instead only when this conversation already showed you the item''s id. Not for putting it in a project the member names (`work.file`), for showing the item here while it stays where it lives (`work.shortcut`), or for changing the item''s name, which leaves it where it is (`item.rename`).


        Every result names the workspace it ran in. Say which workspace the answer is about. When the account has more than one workspace and none is selected, this tool refuses with `workspace_ambiguous` and lists the choices — offer them, never pick one.'
      tags:
      - Items
      parameters:
      - name: x-request-id
        in: header
        required: false
        description: 'Your own id for this request, echoed back and recorded on the audit trail. 1–128 characters from `A–Z a–z 0–9 . _ : -`, starting with a letter or digit; anything else is replaced by a generated id.'
        schema:
          type: string
          maxLength: 128
      - name: Idempotency-Key
        in: header
        required: true
        description: 'Your key for this write: send the same key when you retry and the first result comes back instead of a second action. Keys are honoured for at least 24 hours. 1–200 visible ASCII characters. Replaces the `idempotency_key` body field, which still works until 2026-12-31; this action needs a key on one of the two, and the header is the one to send.'
        schema:
          type: string
          maxLength: 200
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                item_kind:
                  type: string
                  enum:
                  - site
                  - automation
                  - video
                  - post
                  - image
                  - document
                  - file
                  - table
                  - widget
                  description: 'What it is: a site, an automation, a video (or short), a post, an image (a photo or picture), a document, a file (one they uploaded, or a chart, deck or spreadsheet Goosy made, whose storage_object_id is its item_id), a data table or a widget.'
                item_id:
                  description: 'Its id, only when a verb or the page already showed it to you (a project''s from `board.tree`, a widget''s from `widget.list`). Otherwise send item_name: never call a list just to find an id.'
                  type: string
                  format: uuid
                  pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$
                item_name:
                  description: The member's words for its name, title or subject ('the latte video', 'price list', 'the Monday report automation'), a generic name included. It works for every kind but a widget (a project too, with item_kind project); the tool finds the item itself, with no read first, and when several things match the answer lists them by name and place so you can ask which.
                  type: string
                  minLength: 1
                  maxLength: 200
                idempotency_key:
                  type: string
                  minLength: 1
                  maxLength: 200
                  description: 'Deprecated on REST: send the `Idempotency-Key` header instead. Still accepted until 2026-12-31; if both are sent they must match.'
                workspace:
                  description: Which workspace to run in — its slug. Omit to use your default. With more than one reachable workspace and no default, the call is refused and the choices are listed.
                  type: string
                  minLength: 1
              required:
              - item_kind
              additionalProperties: false
      responses:
        '200':
          description: The call was admitted and dispatched. `ok` says whether the tool succeeded — a refusal the tool itself produced is still a 200, exactly as it is a successful JSON-RPC result over MCP.
          headers:
            x-goosy-api:
              description: Present while this API is in beta; the value is `beta`.
              schema:
                type: string
                const: beta
            x-request-id:
              description: 'This request''s id: the `x-request-id` you sent when it was well formed, otherwise one generated for you. Quote it to support; it is recorded on every audit row the call wrote.'
              schema:
                type: string
            RateLimit-Limit:
              description: Requests this key may make in a rolling minute.
              schema:
                type: integer
                minimum: 1
            RateLimit-Remaining:
              description: Requests left in the current rolling minute.
              schema:
                type: integer
                minimum: 0
            RateLimit-Reset:
              description: Whole seconds until the window frees more requests.
              schema:
                type: integer
                minimum: 1
            x-goosy-tool-error:
              description: '`true` when a boundary step refused the call — workspace resolution failed or could not be read. A tool that ran and returned its own typed `ok: false` reports `false` here. **Branch on `ok` in the body for the outcome; this header is the transport-level hint.**'
              schema:
                type: string
                enum:
                - 'true'
                - 'false'
          content:
            application/json:
              schema:
                oneOf:
                - type: object
                  description: The tool ran and answered.
                  properties:
                    ok:
                      type: boolean
                      const: true
                    item_kind:
                      type: string
                      enum:
                      - site
                      - automation
                      - video
                      - post
                      - image
                      - document
                      - file
                      - table
                      - widget
                    item_id:
                      type: string
                      format: uuid
                      pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$
                    name:
                      type: string
                    project_id:
                      anyOf:
                      - type: string
                        format: uuid
                        pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$
                      - type: 'null'
                    from_project_id:
                      anyOf:
                      - type: string
                        format: uuid
                        pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$
                      - type: 'null'
                    trail:
                      type: string
                    answer_note:
                      type: string
                    replayed:
                      type: boolean
                      description: True when this is the first result of an earlier call with the same idempotency_key, returned without changing anything again.
                    workspace:
                      type: string
                      description: The slug of the workspace this call ran in.
                    working_in:
                      type: object
                      properties:
                        label:
                          type: string
                          description: 'The chip words — e.g. "working in: Acme Main".'
                        note:
                          type: string
                          description: Why this workspace — e.g. "your default", "this call only".
                        workspace:
                          type: string
                          description: The resolved workspace's slug.
                        source:
                          type: string
                          enum:
                          - call-override
                          - key-pin
                          - stored-default
                          - sole-reachable
                          description: 'Why this workspace was chosen: the call named it (`call-override`), the key is pinned to it (`key-pin`), it is your default (`stored-default`), or it is the only one the key reaches (`sole-reachable`).'
                      required:
                      - label
                      - note
                      - workspace
                      - source
                      description: Which workspace this call ran in, and how that was decided. Present on every workspace-scoped result.
                      additionalProperties: false
                  required:
                  - ok
                  - answer_note
                  - from_project_id
                  - item_id
                  - item_kind
                  - name
                  - project_id
                  - replayed
                  - trail
                  - working_in
                  - workspace
                - $ref: '#/components/schemas/ToolRefusal'
        '400':
          description: 'The request could not be used: the body is present but not a JSON object (`tenant_api.malformed_body`); it is a top-level array carrying more messages than this endpoint accepts (`tenant_mcp.batch_too_large`); or the `Idempotency-Key` header is malformed (`tenant_api.idempotency_key_invalid`), disagrees with the body''s `idempotency_key` (`tenant_api.idempotency_key_conflict`), or was sent to an action that cannot replay a retry (`tenant_api.idempotency_unsupported`). Nothing ran.'
          headers:
            x-goosy-api:
              description: Present while this API is in beta; the value is `beta`.
              schema:
                type: string
                const: beta
            x-request-id:
              description: 'This request''s id: the `x-request-id` you sent when it was well formed, otherwise one generated for you. Quote it to support; it is recorded on every audit row the call wrote.'
              schema:
                type: string
            Deprecation:
              description: 'RFC 9745: this refusal''s nested `error` object is deprecated, since this instant (`@<unix seconds>`).'
              schema:
                type: string
            Sunset:
              description: 'RFC 8594: the nested `error` object may be removed after this date (2026-12-31).'
              schema:
                type: string
            Link:
              description: The page that says what to read instead (`rel="deprecation"`).
              schema:
                type: string
            RateLimit-Limit:
              description: Requests this key may make in a rolling minute.
              schema:
                type: integer
                minimum: 1
            RateLimit-Remaining:
              description: Requests left in the current rolling minute.
              schema:
                type: integer
                minimum: 0
            RateLimit-Reset:
              description: Whole seconds until the window frees more requests.
              schema:
                type: integer
                minimum: 1
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: No bearer credential, or one that did not resolve. Deliberately ONE undifferentiated answer for absent / unknown / revoked / expired, so the endpoint is never an oracle over the key space.
          headers:
            x-goosy-api:
              description: Present while this API is in beta; the value is `beta`.
              schema:
                type: string
                const: beta
            x-request-id:
              description: 'This request''s id: the `x-request-id` you sent when it was well formed, otherwise one generated for you. Quote it to support; it is recorded on every audit row the call wrote.'
              schema:
                type: string
            Deprecation:
              description: 'RFC 9745: this refusal''s nested `error` object is deprecated, since this instant (`@<unix seconds>`).'
              schema:
                type: string
            Sunset:
              description: 'RFC 8594: the nested `error` object may be removed after this date (2026-12-31).'
              schema:
                type: string
            Link:
              description: The page that says what to read instead (`rel="deprecation"`).
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: The credential is good but the surface is not open to it — the platform or account API switch is off, or the holder lacks the `api.access` capability. The `code` says which.
          headers:
            x-goosy-api:
              description: Present while this API is in beta; the value is `beta`.
              schema:
                type: string
                const: beta
            x-request-id:
              description: 'This request''s id: the `x-request-id` you sent when it was well formed, otherwise one generated for you. Quote it to support; it is recorded on every audit row the call wrote.'
              schema:
                type: string
            Deprecation:
              description: 'RFC 9745: this refusal''s nested `error` object is deprecated, since this instant (`@<unix seconds>`).'
              schema:
                type: string
            Sunset:
              description: 'RFC 8594: the nested `error` object may be removed after this date (2026-12-31).'
              schema:
                type: string
            Link:
              description: The page that says what to read instead (`rel="deprecation"`).
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: No such tool. The body names no tool and is identical for every unrecognised name.
          headers:
            x-goosy-api:
              description: Present while this API is in beta; the value is `beta`.
              schema:
                type: string
                const: beta
            x-request-id:
              description: 'This request''s id: the `x-request-id` you sent when it was well formed, otherwise one generated for you. Quote it to support; it is recorded on every audit row the call wrote.'
              schema:
                type: string
            Deprecation:
              description: 'RFC 9745: this refusal''s nested `error` object is deprecated, since this instant (`@<unix seconds>`).'
              schema:
                type: string
            Sunset:
              description: 'RFC 8594: the nested `error` object may be removed after this date (2026-12-31).'
              schema:
                type: string
            Link:
              description: The page that says what to read instead (`rel="deprecation"`).
              schema:
                type: string
            RateLimit-Limit:
              description: Requests this key may make in a rolling minute.
              schema:
                type: integer
                minimum: 1
            RateLimit-Remaining:
              description: Requests left in the current rolling minute.
              schema:
                type: integer
                minimum: 0
            RateLimit-Reset:
              description: Whole seconds until the window frees more requests.
              schema:
                type: integer
                minimum: 1
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: Over this key's per-minute cap. Carries `Retry-After` and `error.retry_after_seconds`.
          headers:
            x-goosy-api:
              description: Present while this API is in beta; the value is `beta`.
              schema:
                type: string
                const: beta
            x-request-id:
              description: 'This request''s id: the `x-request-id` you sent when it was well formed, otherwise one generated for you. Quote it to support; it is recorded on every audit row the call wrote.'
              schema:
                type: string
            Deprecation:
              description: 'RFC 9745: this refusal''s nested `error` object is deprecated, since this instant (`@<unix seconds>`).'
              schema:
                type: string
            Sunset:
              description: 'RFC 8594: the nested `error` object may be removed after this date (2026-12-31).'
              schema:
                type: string
            Link:
              description: The page that says what to read instead (`rel="deprecation"`).
              schema:
                type: string
            RateLimit-Limit:
              description: Requests this key may make in a rolling minute.
              schema:
                type: integer
                minimum: 1
            RateLimit-Remaining:
              description: Requests left in the current rolling minute.
              schema:
                type: integer
                minimum: 0
            RateLimit-Reset:
              description: Whole seconds until the window frees more requests.
              schema:
                type: integer
                minimum: 1
            Retry-After:
              description: Whole seconds to wait before retrying.
              schema:
                type: integer
                minimum: 1
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    servers:
    - url: https://app.goosybear.ai
      description: Production
components:
  schemas:
    Error:
      type: object
      properties:
        ok:
          type: boolean
          const: false
        code:
          type: string
          description: The typed refusal code — e.g. `tenant_mcp.rate_limited`, `tenant_api.unknown_tool`.
        message:
          type: string
          description: A sentence a person can act on.
        retry_after_seconds:
          description: 'On a 429: whole seconds to wait. Mirrors `Retry-After`.'
          type: number
        error:
          type: object
          properties:
            code:
              type: string
            message:
              type: string
            retry_after_seconds:
              type: number
          required:
          - code
          - message
          description: 'Deprecated: the same values as the top-level fields, kept until 2026-12-31. Read `code` and `message` at the top level.'
          additionalProperties: false
      required:
      - ok
      - code
      - message
      - error
      description: A request the boundary refused before dispatching anything. The same shape the MCP endpoint answers its own refusals with, and the same top-level fields a dispatched call's refusal carries, so one client branch covers both.
      additionalProperties: false
    ToolRefusal:
      type: object
      properties:
        ok:
          type: boolean
          const: false
        code:
          type: string
          description: The typed reason — e.g. `workspace_ambiguous`, `invalid_arguments`, or the tool's own failure code.
        message:
          type: string
          description: A sentence a person can act on.
        workspaces:
          description: 'On a workspace refusal: the slugs this key may pass as `workspace`.'
          type: array
          items:
            type: string
        issues:
          description: 'On `invalid_arguments`: which fields failed, and why.'
          type: array
          items:
            type: object
            properties:
              path:
                type: string
              message:
                type: string
            required:
            - path
            - message
            additionalProperties: false
        path:
          description: 'On an authoring refusal: where in your call''s input it points, e.g. `steps.<key>.params.<field>`.'
          type: string
        fix:
          description: 'On an authoring refusal: the change to your call that would pass.'
          type: string
        instruction:
          description: 'On an authoring refusal: what to do next with it.'
          type: string
      required:
      - ok
      - code
      - message
      description: A call that was admitted and dispatched, and did not succeed.
      additionalProperties: false
  securitySchemes:
    tenantApiKey:
      type: http
      scheme: bearer
      description: 'An API key minted at Settings › API & MCP. Send it as `Authorization: Bearer <key>`. A key carries its holder''s own permissions, resolved on every call — revoking a membership closes the key''s reach immediately. Keep it in an environment variable (`GOOSY_API_KEY`), never in a committed file.'
x-refined-from:
- goosybear-ai-openapi.json
- goosybear-ai-openapi.yml