Delete an unreferenced tool credential
Conservative safe deletion. Refuses with 409 deletion_blocked (details.reason) while any current draft tool or MCP server connection, or any retained published agent version, references any version of this secret; published history can be restored by rollback, so it keeps the secret. Remove those draft references and use emergency revocation for compromised material. An unreferenced secret is permanently destroyed (all versions crypto-shredded) and disappears from reads. Call evidence keeps the opaque reference only. Not reversible.
Authentication
Create and manage workspace-owned keys through the existing app session routes, outside this public API. Creator and manager identities are audit actors only. Key validity follows workspace policy, expiry and explicit revocation, independently of creator membership. Do not include a workspace-selection header.
Path parameters
Headers
Stable key per logical intent, 1–255 printable characters. Persist it before sending. Retry the same key/body after an uncertain result for 24 hours. A changed body conflicts. Beyond retention, reconcile the resource before retrying; this is not permanent deduplication. Current authorization is rechecked on replay. Evaluation order: authenticate and check current authorization; look up intent; replay its stored receipt before checking the current revision; only a new intent evaluates If-Match and executes. Fingerprint includes method, path, body and original If-Match. A changed request returns idempotency_key_reused. The server stores only a keyed (HMAC) fingerprint, and no error or response ever returns a fingerprint or hash of a request. In-flight intent returns 409 idempotency_in_progress with Retry-After; retry the same intent after reconciliation. Receipts describe that attempt, not current resource state. A replay returns the original status code and body, with the response header Idempotent-Replayed: true.