Skip to main content
Response actions follow one policy: nothing runs on its own by default, a project can turn on auto-run for reversible actions, and an irreversible action always needs a person. See Response actions.

​
Propose an action

actions.propose and actions.undo need an Idempotency-Key header. The same key returns the first proposal and runs nothing again. The same key with a different action returns 422.
The response has action (with effect, undo_action_id, status, and decided_by_type), auto_run, created, and run_reason. When auto_run is true, the policy approved the action and it ran at once; action.status is the result.

​
Preview

Add ?dry_run=true to actions.propose or actions.undo. The response has dry_run: true, the change, the precondition read from the provider, effect, undo_action_id, auto_run, and requires_approval. Nothing is stored and nothing changes. A dry run needs no Idempotency-Key.

​
Undo

POST /v1/projects/{project_id}/actions/{action_id}/undo proposes the undo action of a succeeded reversible action on the same target. It returns 409 for an irreversible action or an action that did not succeed.

​
Policy

Only an owner or admin, signed in as a person, can change the policy. The body is { "auto_reversible": true }; there is no setting for irreversible actions. Each change is written to the audit log.

​
Approve

Approve with actions.approve (see Investigations). An irreversible action can be approved only in the dashboard. OAuth tokens, such as the token of an MCP client or the CLI, get 403.