Create a new Seclai client.
Credentials are resolved via a chain (first match wins):
apiKey optionaccessToken option (static string or provider function)SECLAI_API_KEY environment variable~/.seclai/config + cached tokens in ~/.seclai/sso/cache/Client configuration.
SeclaiConfigurationError If no fetch implementation is available.
SeclaiConfigurationError If both apiKey and accessToken are provided.
Accept an AI assistant suggestion.
Conversation identifier.
Acceptance request payload.
Accept/mark an AI memory bank suggestion.
Conversation identifier.
Acceptance payload for the memory bank suggestion.
Accept a governance AI plan.
Conversation identifier.
Acceptance result.
Accept a memory bank AI suggestion.
Conversation identifier.
Accept request payload.
Accept a solution AI plan.
Solution identifier.
Conversation identifier.
Accept request.
Acceptance result with executed actions.
Add a comment to an alert.
Alert identifier.
Comment payload.
Add and provision a new agent-email domain.
Pass kind: "vanity" with value: "<slug>", or kind: "custom" with
value: "agent.mycompany.com" (optionally delegated: true to let Seclai
manage a dedicated Route53 zone). Stands up the SES identity + DNS and
returns the records the customer must publish. Requires an account
owner/admin.
The domain to add. delegated defaults to false server-side.
Add a conversation turn to a solution.
Solution identifier.
Conversation turn payload.
Updated conversation.
Generate a knowledge base configuration via AI assistant.
Generation request.
Generate a memory bank configuration via AI assistant.
Generation request.
Generate a solution via AI assistant.
Generation request.
Generate a source configuration via AI assistant.
Generation request.
Add a sender address or a whole domain to the account blocklist.
Idempotent. match_type is "address" (default) or "domain".
Requires an account owner/admin.
The sender or domain to block.
The blocked-sender entry.
Cancel a running agent run.
Cancellation is DELETE on the run resource — the API exposes no
POST .../cancel route, and no operation that deletes a run. Rejected when
the run has already reached a terminal state.
Run identifier.
Updated run (with cancelled status).
Cancel a running model playground experiment.
Experiment identifier.
Fail all of the account's QUEUED (over-quota parked) inbound-email runs at once.
A queued run consumed no quota or credits at queue time, so this merely fails them. Requires an account owner/admin.
The count cancelled.
Cancel a source embedding migration.
Source connection identifier.
Updated migration status.
Cancel a source export.
Source connection identifier.
Export identifier.
Change the status of an alert.
Alert identifier.
Status change request.
Compact a memory bank (trigger compaction).
Memory bank identifier.
Create a new agent.
Agent creation payload (name, trigger type, template, etc.).
Summary of the created agent.
Create an alert configuration.
Alert config definition.
Created alert config.
Create evaluation criteria for an agent.
Agent identifier.
Criteria definition.
Created evaluation criteria.
Create a manual evaluation result for a criteria.
Criteria identifier.
Evaluation result payload.
Created evaluation result.
Create a model playground experiment.
Experiment configuration.
Create a new knowledge base.
Knowledge base configuration.
The created knowledge base.
Create a new memory bank.
Memory banks give agents persistent memory across conversations.
Types: conversation (chat-style history) or general (flat factual entries).
Memory bank configuration.
The created memory bank.
Create a new solution.
Solution configuration.
The created solution.
Create a new content source.
Source configuration (type, name, knowledge base link, etc.).
The created source.
Create a source data export.
Source connection identifier.
Export configuration (format, etc.).
Export response with job status.
Decline an AI assistant suggestion.
Conversation identifier.
Decline a governance AI plan.
Conversation identifier.
Decline a solution AI plan.
Solution identifier.
Conversation identifier.
Delete an agent.
Agent identifier.
Cancel an agent run.
Run identifier.
This never deleted anything — the endpoint it calls is documented as "Cancel an agent run", and the API has no delete-a-run operation. It also discards the returned run state. Use cancelAgentRun instead.
Delete an alert configuration.
Alert config identifier.
Delete a specific content version.
Content version identifier.
Delete an evaluation criteria and all associated results.
Criteria identifier.
Soft-delete a model playground experiment.
Removes the experiment from list/detail views while preserving audit history. Returns HTTP 204 with no body.
Experiment identifier.
Delete a knowledge base.
Knowledge base identifier.
Delete a memory bank.
Memory bank identifier.
Delete a memory bank source.
Memory bank identifier.
Delete a solution.
Solution identifier.
Delete a source.
Source connection identifier.
Delete a source export.
Source connection identifier.
Export identifier.
Pause (disable) an agent so it stops firing from every trigger path.
API runs return HTTP 409, inbound email is turned away, and scheduled / content triggers are skipped.
Fails with HTTP 409 when other live agents still call this one via a
call_agent step — use getAgentCallers to list them, and disable
those first.
Agent identifier.
The updated agent summary.
Download a file attachment emitted by a step in an agent run.
Returns the raw Response so you can stream or save the binary data.
Run identifier.
URL-safe-base64-encoded storage_key of the attachment
(as surfaced in run output manifests and webhook/email payloads).
Optional downloadName filename hint for the download disposition.
Raw response with the attachment bytes.
Download a source export file.
Returns the raw Response so you can stream or save the binary data.
Source connection identifier.
Export identifier.
Raw response with the export file.
Resume (enable) a paused agent.
Clears the disable state whether the agent was paused manually or auto-paused by the inbound-email overload safeguard.
Agent identifier.
The updated agent summary.
Estimate a source export.
Source connection identifier.
Estimate request.
Export estimate.
Export an agent definition as a portable JSON snapshot.
Agent identifier.
When true (default), the server sets Content-Disposition: attachment.
The exported agent snapshot.
Generate agent workflow steps from natural language using AI.
Agent identifier.
Generation request with user instructions.
AI-generated step configuration.
Generate governance policy suggestions using AI.
AI governance request.
AI-generated governance suggestions.
Generate memory bank configuration using AI.
AI assistant request with user instructions.
AI-generated memory bank config.
Generate a knowledge base configuration via solution AI.
Solution identifier.
Generation request.
AI-generated knowledge base config.
Generate a solution AI plan.
Solution identifier.
Generation request.
AI-generated plan.
Generate a source configuration via solution AI.
Solution identifier.
Generation request.
AI-generated source config.
Generate a single step configuration using AI.
Agent identifier.
Step config generation request.
AI-generated step config.
Get agent details including its definition.
Agent identifier.
Full agent metadata.
Get AI conversation history for an agent.
Agent identifier.
Conversation history.
Get the static attachment-reference contract for an agent — what files (if any) its definition expects on a run.
Call this before staging uploads to learn whether the agent accepts files
at all (requires_uploads) and which specific filenames, indexes, or glob
patterns its templates reference. A run-time upload batch that doesn't
satisfy every declared selector is rejected with HTTP 400.
Agent identifier.
The agent's attachment-reference contract.
List the live agents that call this agent via a call_agent step.
These must be disabled before this agent can be paused.
Agent identifier.
The calling agents.
Get an agent's full definition (steps, model config, etc.).
Agent identifier.
The agent definition.
Get the status of an agent input upload.
Agent identifier.
Upload identifier.
Upload status and metadata.
Get details of a specific agent run.
Run identifier.
Optionalopts: { includeStepOutputs?: boolean }Optional flags.
Agent run details.
Get agents that are using a specific memory bank.
Memory bank identifier.
Get AI assistant memory bank conversation history.
Get alert details by ID.
Alert identifier.
Alert details.
Get an alert configuration by ID.
Alert config identifier.
Alert config details.
Read the API version this request resolved to, and the versions available.
Resolution order is the Seclai-Version header, then the account pin, then
the default — so effective_version reflects the client's apiVersion
option when that is set.
The pinned, effective, default and latest versions.
Get content detail for a specific content version.
Content version identifier.
Range options for slicing large content.
Content details for the requested range.
Get the DMARC aggregate-report summary for a domain.
Pass rate, disposition breakdown (none/quarantine/reject), and top
failing source IPs from the DMARC rua reports over the last days
(clamped by the service).
Populated for domains whose DNS zone Seclai controls (vanity + delegated custom); a self-managed custom domain keeps its own DMARC reporting and returns an all-zero summary.
Domain identifier.
Reporting window options.
Optionaldays?: numberWindow length in days (default 30).
OptionaltopSources?: numberNumber of top failing sources to return (default 10).
Get a single evaluation criteria by ID.
Criteria identifier.
Evaluation criteria details.
Get the evaluation summary for a specific criteria.
Criteria identifier.
Evaluation result summary.
Get a model playground experiment by ID.
Experiment identifier.
List the media-generation quality tiers and the model + cost each resolves to.
On a prompt_call's media_generation tool — and the dedicated
generate_* steps via tier routing — the author/LLM picks a tier
(fast/balanced/thorough), never a model. This maps each
(modality, tier) to its concrete generator, raw credits_per_unit,
unit_label, and a human-readable scaled price_label.
Global routing/pricing (the same for every account); read-only.
Get the account's inbound-email overload status — whether the circuit breaker has paused new inbound email, and the size of the QUEUED (over-quota parked) run backlog.
Get a knowledge base by ID.
Knowledge base identifier.
Knowledge base details.
Get the authenticated user's identity.
Returns the personal account_id plus every organization the user belongs
to — each with its own id, display name, and account_id. Use it to
discover the account IDs that can be passed as the client's accountId
option (sent as the X-Account-Id header) to target an org context.
The current user's account ID and organization memberships.
Get a memory bank by ID.
Memory bank identifier.
Memory bank details.
Get the last AI conversation for memory banks.
Get stats for a memory bank.
Memory bank identifier.
Get full details for a specific model.
Model identifier.
Get model recommendations.
Model identifier.
Get a summary of non-manual evaluations across an agent's runs.
Agent identifier.
Get a solution by ID.
Solution identifier.
Solution details.
Get a source by ID.
Source connection identifier.
Source details.
Get the status of a source embedding migration.
Source connection identifier.
Migration status.
Get a specific source export.
Source connection identifier.
Export identifier.
Export details.
Get unread model alert count.
Link agents to a solution.
Solution identifier.
Resource IDs to link.
Updated solution.
Link knowledge bases to a solution.
Solution identifier.
Resource IDs to link.
Updated solution.
Link source connections to a solution.
Solution identifier.
Resource IDs to link.
Updated solution.
List recipients who have opted out of this account's agent emails.
Optional agent filter and limit/offset pagination.
OptionalagentId?: stringFilter to one agent (account-wide opt-outs still apply).
Optionallimit?: numberPage size (1-200, default 50).
Optionaloffset?: numberRows to skip (default 0).
The page of opt-outs plus the total count.
List all evaluation results for an agent.
Agent identifier.
Pagination options.
List runs for a specific agent.
Agent identifier.
Pagination and filter options.
Paginated list of runs.
List agents.
Pagination options.
Paginated list of agents.
The configurations arrive under configs alongside total by default.
Once the caller opts in with apiVersion 2026-07-27 or later the endpoint
returns the canonical {data, pagination} envelope instead, so the
top-level key changes.
List alerts.
Pagination and filter options.
Paginated list of alerts.
List the account's blocked inbound email senders (newest first), plus the
governance auto_block_mode.
Optional limit/offset pagination.
Optionallimit?: numberPage size (1-200, default 50).
Optionaloffset?: numberRows to skip (default 0).
List runs compatible with a specific evaluation criteria.
Criteria identifier.
Pagination options.
List embeddings for a content version.
Content version identifier.
Pagination options.
Paginated list of embeddings.
List the account's vanity (<slug>.seclai.com) and custom
(agent.mycompany.com) agent-email domains.
Includes each domain's verification status and the DNS records the customer
must publish, plus the plan capabilities (can_add_vanity /
can_add_custom) and whether one of each kind already exists
(has_vanity / has_custom — the per-kind limit is 1).
Requires a user-bound credential; an account-only API key is refused with 403.
List evaluation criteria for an agent.
Agent identifier.
Pagination options.
List evaluation criteria for an agent, with pagination metadata.
Accepts either wire shape. The endpoint answered with a bare array before
2026-07 and with a paginated envelope after, so a client that decodes only
one breaks the day the other ships. total, page and limit are absent
when the endpoint answers with a bare array.
Agent identifier.
Pagination options.
The criteria under data, plus the page metadata when present.
List evaluation results for a specific criteria.
Criteria identifier.
Pagination options.
List evaluation run summaries for an agent.
Agent identifier.
Pagination options.
List model playground experiments.
Optional filters and pagination.
List governance AI conversations.
List recent inbound emails that were quietly discarded before running an agent (unauthorized sender, unknown alias, spam/virus, flood-shed).
Optional agent filter and result limit.
OptionalagentId?: stringFilter to a single agent's rejections.
Optionallimit?: numberMaximum results (1-200, default 50).
List knowledge bases.
Pagination and sorting options.
Paginated list of knowledge bases.
List memory banks.
Pagination and sorting options.
Paginated list of memory banks.
List available memory bank templates.
List model alerts.
Pagination options.
List all enabled LLM models grouped by provider.
Optional filters.
List organization alert preferences.
List evaluation results for a specific agent run.
Agent identifier.
Run identifier.
Pagination options.
Paginated list of evaluation results.
List conversations for a solution.
Solution identifier.
List of conversations.
List solutions.
Pagination and sorting options.
Paginated list of solutions.
List exports for a source.
Source connection identifier.
Pagination options.
Paginated list of exports.
List sources.
Pagination, sorting, and filter options.
Paginated list of sources.
Mark an AI suggestion as accepted or rejected.
Agent identifier.
Conversation turn identifier.
Mark request payload.
Mark all model alerts as read.
Mark a specific model alert as read.
Model alert identifier.
Mark a conversation turn (e.g. accepted/rejected).
Solution identifier.
Conversation identifier.
Mark payload.
Auto-paginate through a list endpoint.
Yields individual items from each page, automatically fetching the next page until all items have been returned.
A function that fetches a single page given { page, limit }.
Optionalopts: { limit?: number }Page size (default: 50).
Validate an agent_definition payload (same shape as exportAgent)
without creating or modifying any agent.
Use this before createAgent or updateAgent with an
agent_definition to surface unresolved_refs — workflow references to
knowledge bases, memory banks, source connections, or sub-agents that
don't exist in the target account. Pass the returned ids back in
entity_remap on the commit call to substitute them.
The preview payload ({ agent_definition: ... }).
Summary of the validated payload (step counts, schedules,
alert configs, evaluation criteria, governance policies, and any
unresolved_refs).
On HTTP 422 — the body is an
AgentDefinitionImportErrorResponse with 1-indexed
line/column-anchored errors against a canonical source echo.
Revoke an opt-out, opting the recipient back in to agent emails.
Opt-out identifier.
Remove a domain and tear down its SES identity + DNS / receipt-rule recipient.
Returns a cleanup_note when the removed domain was Seclai-managed
(delegated), reminding you to delete the registrar NS delegation record
(dangling-delegation / subdomain-takeover guard). Requires an account
owner/admin.
Domain identifier.
Replace content with inline text.
Content version identifier.
Inline text replacement payload.
Make a raw HTTP request to the Seclai API.
This is a low-level escape hatch. For most operations, prefer the typed convenience methods.
HTTP method (e.g. "GET", "POST").
Request path relative to baseUrl (e.g. "/sources/").
Optionalopts: {Query params, JSON body, per-request headers, and optional AbortSignal.
Parsed JSON for JSON responses, raw text for non-JSON responses, or null for empty bodies.
SeclaiAPIValidationError For validation errors (typically HTTP 422).
SeclaiAPIStatusError For other non-success HTTP status codes.
Make a raw HTTP request and return the raw Response object (for binary downloads, etc.).
HTTP method.
Request path relative to baseUrl.
Optionalopts: {Query params, JSON body, per-request headers, and optional AbortSignal.
The raw Response object.
Manually lift the account-wide inbound-email pause.
If the queued backlog is still above the ceiling the breaker re-arms on the next evaluation — this is a one-shot override, not a permanent disable. Requires an account owner/admin.
Start an agent run.
Agent identifier.
Run request payload (input, metadata, priority, etc.).
The created agent run.
Run an agent and poll until it reaches a terminal status.
This is useful in environments where SSE streaming is unavailable.
Agent identifier.
Run request payload.
Optionalopts: {Polling configuration and abort signal.
OptionalincludeStepOutputs?: booleanInclude per-step outputs in the final result.
OptionalpollIntervalMs?: numberPolling interval in ms (default: 2000).
Optionalsignal?: AbortSignalOptionaltimeoutMs?: numberMaximum time to wait in ms (default: 300000 = 5 min).
The terminal agent run.
SeclaiStreamingError On timeout.
Run an agent in streaming mode and yield each SSE event as it arrives.
This is an AsyncGenerator suitable for real-time UIs that want to render
step progress as it happens.
Agent identifier.
Streaming run request payload.
Optionalopts: { signal?: AbortSignal; timeoutMs?: number }Timeout and abort signal options.
AgentRunEvent for each SSE message.
Run an agent in streaming mode (SSE) and wait for the final result.
Consumes the entire SSE stream and returns only the terminal done payload.
For real-time event access, use runStreamingAgent instead.
Agent identifier.
Streaming run request payload.
Optionalopts: { signal?: AbortSignal; timeoutMs?: number }Timeout and abort signal options.
Final agent run payload from the done event.
SeclaiStreamingError If the stream ends before a done event.
Search across all resource types in your account.
Accepts a free-text keyword query or a UUID. Results are ranked: name-prefix > name-substring > description-substring.
Search options.
OptionalentityType?: stringOptional entity type filter (e.g. "agent", "knowledge_base").
Optionallimit?: numberMaximum results (1-50, default 10).
Search query string (required, 1-200 chars).
Search results.
Search agent runs (traces) across all agents.
Search query and filters.
Search results with matching runs.
Search the Seclai documentation by content.
mode: "keyword" matches page titles and summaries (fast, no AI cost);
mode: "semantic" matches page body content by meaning (uses an embedding).
Each result carries a doc_slug and an optional section anchor for
building a https://seclai.com/docs/<doc_slug>[#<anchor>] link, a score
(not comparable across modes), and — in semantic mode — a highlight
(best matching verbatim sentence; null for keyword).
Documentation is global, so results are not account-scoped.
Search options.
Optionallimit?: numberMaximum results (1-20, default 8).
Optionalmode?: "keyword" | "semantic"Search strategy (default "keyword").
Search query string (required, 1-200 chars).
Send a test message FROM a verified domain (noreply@<domain>) TO the
account owner's email.
Confirms end-to-end that the domain actually sends (SES verified, DKIM/SPF aligned). Never sends to any other address, so it can't be used as an open relay. Requires an account owner/admin.
Domain identifier.
Set whether a governance BLOCK on an authenticated inbound sender auto-adds them to the blocklist.
mode is "disabled", "input", or "input_and_output".
Requires an account owner/admin.
The mode to set.
The updated blocked-sender list.
Configure an agent's EMAIL_RECEIVED trigger and return its computed
email address(es).
Sets the custom alias, the sender allowlist, and the inbound-handling flags
(ignore_auto_generated, require_sender_auth, queue_on_quota). Omitted
fields are left unchanged; passing null (or "" for alias) clears them.
Agent identifier.
Trigger identifier.
The fields to set.
The trigger's resolved addresses and config.
Promote a verified domain to the account's primary domain.
Agent email then sends FROM and receives ON this domain
(<agentID>@<domain>, <alias>@<domain>) instead of the shared
agent.seclai.com. The domain must be verified. Requires an account
owner/admin.
Domain identifier.
Start a source embedding migration.
Source connection identifier.
Migration configuration (target embedding model, etc.).
Migration status.
Submit feedback on an AI assistant interaction.
Feedback payload (thumbs up/down, optional comment).
Feedback response.
Subscribe to an alert.
Alert identifier.
Test compaction prompt standalone (not tied to a specific memory bank).
Standalone compaction test request.
Test a draft evaluation criteria without persisting it.
Agent identifier.
Draft evaluation to test.
Test evaluation response.
Test compaction for a specific memory bank.
Memory bank identifier.
Test compaction request.
Remove a blocked sender by id. Requires an account owner/admin.
Blocked-sender identifier.
Unlink agents from a solution.
Solution identifier.
Resource IDs to unlink.
Updated solution.
Unlink knowledge bases from a solution.
Solution identifier.
Resource IDs to unlink.
Updated solution.
Unlink source connections from a solution.
Solution identifier.
Resource IDs to unlink.
Updated solution.
Unsubscribe from an alert.
Alert identifier.
Update an agent.
Agent identifier.
Fields to update.
Updated agent summary.
Update an agent's definition.
Agent identifier.
Updated definition payload.
Updated agent definition.
Update an alert configuration.
Alert config identifier.
Fields to update.
Updated alert config.
Pin the account to a dated API version, or clear the pin.
Owner/admin only. The pin applies to later header-less requests; a
Seclai-Version header still overrides it, so effective_version in the
response describes this request rather than the pin just written.
A YYYY-MM-DD date to pin to, or null to clear the pin.
The updated version state.
Update an evaluation criteria.
Criteria identifier.
Fields to update.
Updated evaluation criteria.
Update a knowledge base.
Knowledge base identifier.
Fields to update.
Updated knowledge base.
Update a memory bank.
Memory bank identifier.
Fields to update.
Updated memory bank.
Update a solution.
Solution identifier.
Fields to update.
Updated solution.
Update a source.
Source connection identifier.
Fields to update.
Updated source.
Upload a file to use as input for a dynamic_input agent run.
After uploading, poll getAgentInputUploadStatus until status is ready,
then pass input_upload_id to runAgent.
Agent identifier.
File payload and optional metadata.
Upload response with the upload ID and status.
Upload a file to replace content for an existing content version.
Content version identifier.
File payload and optional metadata.
Upload response.
Upload a file to a source.
Maximum file size: 200 MiB. Supports text, PDF, DOCX, audio, video, images, and more.
If mimeType is omitted, it will be inferred from the fileName extension when possible.
Source connection identifier.
File payload and optional metadata.
Upload response details.
Upload inline text to a source.
Source connection identifier.
Inline text upload payload.
Upload response.
Revert to the shared agent.seclai.com sending/inbound domain.
Clears the account's primary domain WITHOUT removing the configured domain(s) — they stay verified and can be promoted again later. Requires an account owner/admin.
Run a verification check immediately ("Check now").
Re-polls SES + DNS for this domain instead of waiting for the background verification sweep, and returns its updated status + DNS-record check results. Useful right after publishing the required records. Requires an account owner/admin.
Domain identifier.
Seclai JavaScript/TypeScript client.
Provides typed methods for every Seclai API endpoint, plus higher-level abstractions for streaming, polling, and pagination.
Example