Create a caller-owned Session idempotently
package main
import ( "fmt" "strings" "net/http" "io")
func main() {
url := "https://api.vampikez.fun/v1/sessions/9f2b7c14-59d3-4f7a-b8e1-2a6c05d4e731"
payload := strings.NewReader("{ \"title\": \"Rate limit the payments endpoint\", \"initialTurn\": { \"id\": \"c47a1e08-3d6b-4a92-9f15-8b70d2e5c6a4\", \"message\": \"Add rate limiting to the payments endpoint and open a PR\" }, \"origin\": { \"tenantKey\": \"acme\", \"objectType\": \"issue\", \"objectId\": \"PAY-4821\", \"endUserId\": \"9c1f0a7d4b62e35810af2d6c95b7e043\", \"label\": \"PAY-4821 Rate limit the payments endpoint\", \"url\": \"https://acme.example.com/issues/PAY-4821\" }, \"source\": { \"kind\": \"github\", \"grantId\": \"74c5a903-8e6f-4b1d-a052-3c9e18d7f64b\", \"baseBranch\": \"main\" }, \"model\": \"claude-opus-5\", \"runtime\": \"wamp\" }")
req, _ := http.NewRequest("PUT", url, payload)
req.Header.Add("Authorization", "Bearer <token>") req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close() body, _ := io.ReadAll(res.Body)
fmt.Println(res) fmt.Println(string(body))
}const url = 'https://api.vampikez.fun/v1/sessions/9f2b7c14-59d3-4f7a-b8e1-2a6c05d4e731';const options = { method: 'PUT', headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'}, body: '{"title":"Rate limit the payments endpoint","initialTurn":{"id":"c47a1e08-3d6b-4a92-9f15-8b70d2e5c6a4","message":"Add rate limiting to the payments endpoint and open a PR"},"origin":{"tenantKey":"acme","objectType":"issue","objectId":"PAY-4821","endUserId":"9c1f0a7d4b62e35810af2d6c95b7e043","label":"PAY-4821 Rate limit the payments endpoint","url":"https://acme.example.com/issues/PAY-4821"},"source":{"kind":"github","grantId":"74c5a903-8e6f-4b1d-a052-3c9e18d7f64b","baseBranch":"main"},"model":"claude-opus-5","runtime":"wamp"}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request PUT \ --url https://api.vampikez.fun/v1/sessions/9f2b7c14-59d3-4f7a-b8e1-2a6c05d4e731 \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "title": "Rate limit the payments endpoint", "initialTurn": { "id": "c47a1e08-3d6b-4a92-9f15-8b70d2e5c6a4", "message": "Add rate limiting to the payments endpoint and open a PR" }, "origin": { "tenantKey": "acme", "objectType": "issue", "objectId": "PAY-4821", "endUserId": "9c1f0a7d4b62e35810af2d6c95b7e043", "label": "PAY-4821 Rate limit the payments endpoint", "url": "https://acme.example.com/issues/PAY-4821" }, "source": { "kind": "github", "grantId": "74c5a903-8e6f-4b1d-a052-3c9e18d7f64b", "baseBranch": "main" }, "model": "claude-opus-5", "runtime": "wamp" }'Optionally admits the first caller-owned Turn and its 1:1 Run atomically with the Session. Omit initialTurn only when intentionally creating an idle workspace. Repeating the same Session id and immutable body returns the existing Session; changing the body returns a conflict.
Authorizations
Section titled “Authorizations”Parameters
Section titled “ Parameters ”Path Parameters
Section titled “Path Parameters”A UUID identifying one Cloud resource; Session, Turn, Publication and Merge ids are minted by the caller so an ambiguous retry addresses the same durable command instead of creating a second one.
Example
9f2b7c14-59d3-4f7a-b8e1-2a6c05d4e731A UUID you mint and own; it is the idempotency key for creation and the address of every Turn, artifact and publication underneath
Request Bodyrequired
Section titled “Request Bodyrequired”Body of the idempotent Session create. initialTurn is the ordinary one-shot path; omit it only to create an idle workspace and submit a Turn later. Repeating the same caller-owned Session id with the same body returns the existing Session and initial Run; the same id with a different body is a conflict. For native WAMP, omitting model selects the caller’s resolved agent slot default at new Session admission. A replay uses the stored model even if that default or the catalog has changed. If no agent slot is available, creation returns 400 cloud_agent_model_unavailable. A runtime-managed agent must omit the Session model. When initialTurn.runtime is set, the Session-level runtime must also be set to the same agent.
object
Human-facing Session name; when omitted a title is derived from initialTurn.message, or defaults to New workspace for an idle Session
First caller-owned Turn to admit atomically with the Session. It may override model, runtime, and runtime-owned configuration for that immutable Turn. Its id also names the 1:1 Run. Replaying the same Session body cannot create a second Run.
object
A UUID identifying one Cloud resource; Session, Turn, Publication and Merge ids are minted by the caller so an ambiguous retry addresses the same durable command instead of creating a second one.
object
Correlation metadata linking this Session to the originating record in the caller’s product
object
Stable opaque identifier for the external tenant the work belongs to, not its display name
The caller’s own kind name for the originating record, such as ticket or issue
The caller’s stable opaque id for that record, so a Session can always be traced back to the business object
Stable one-way hash of the external tenant/user pair; never raw PII.
Short human-readable name for the originating record, shown when the Session is handed to a person
HTTPS deep link back to the originating record in the caller’s product
Repository to check out into the sandbox; a grant source pins the Session to that exact repository, branch and base commit
object
object
object
A UUID identifying one Cloud resource; Session, Turn, Publication and Merge ids are minted by the caller so an ambiguous retry addresses the same durable command instead of creating a second one.
Branch to pin the Session to. It must already exist; a name that does not resolve is 400 cloud_repository_branch_not_found. Defaults to the repository’s default branch.
The provider repository id, as a decimal string. A grant names a GitHub App installation, so every request must select a repository. Not echoed back on the Session resource — /v1 publishes no provider ids.
Optional for native WAMP: omission uses the caller’s resolved agent slot default from GET /v1/capabilities, stored on the Session and its initial Turn. Omit with a runtime-managed agent to use that runtime’s default model.
Agent runtime id taken from /v1/capabilities, such as wamp, claude-code or codex; it settles at creation and cannot be changed once a Turn is accepted
Example
{ "title": "Rate limit the payments endpoint", "initialTurn": { "id": "c47a1e08-3d6b-4a92-9f15-8b70d2e5c6a4", "message": "Add rate limiting to the payments endpoint and open a PR" }, "origin": { "tenantKey": "acme", "objectType": "issue", "objectId": "PAY-4821", "endUserId": "9c1f0a7d4b62e35810af2d6c95b7e043", "label": "PAY-4821 Rate limit the payments endpoint", "url": "https://acme.example.com/issues/PAY-4821" }, "source": { "kind": "github", "grantId": "74c5a903-8e6f-4b1d-a052-3c9e18d7f64b", "baseBranch": "main" }, "model": "claude-opus-5", "runtime": "wamp"}Responses
Section titled “ Responses ”Idempotent replay
Atomic Session admission. The response contains the complete durable outcome of the create intent.
object
The Session as it stands after this request; a create that was an idempotent replay returns the already-stored Session unchanged
object
The caller-owned Session id, unchanged from the create request
Canonical first-party browser URL for handing this Session to a human
Organization that owns the Session; every credential is authorized against this organization
Human-facing name — the supplied title, first non-empty line of initialTurn.message, or New workspace for an idle Session
Correlation metadata supplied at creation; absent when none was sent
object
Stable opaque identifier for the external tenant the work belongs to, not its display name
The caller’s own kind name for the originating record, such as ticket or issue
The caller’s stable opaque id for that record, so a Session can always be traced back to the business object
Stable one-way hash of the external tenant/user pair; never raw PII.
Short human-readable name for the originating record, shown when the Session is handed to a person
HTTPS deep link back to the originating record in the caller’s product
Repository checked out into the sandbox, with the exact base the Session was pinned to; absent for a Session with no repository
object
object
object
A UUID identifying one Cloud resource; Session, Turn, Publication and Merge ids are minted by the caller so an ambiguous retry addresses the same durable command instead of creating a second one.
Lowercase hex 40-character Git object id naming an exact commit or tree in the source repository.
Model in effect for the next Turn; absent when a runtime-managed agent supplies its own default
The settled foreign agent runtime id, such as claude-code or codex; absent means the native WAMP runtime
Sandbox attachment — unavailable when no lease is held, attached with the lease expiresAt, expired once that lease has lapsed; losing it does not end the Session
object
Whether and at what fidelity this Session can be carried into another Run
object
Whether a new Turn can be admitted for this Session — nothing more. It is NOT the answer to “did my previous work survive”: a fresh Session reports canContinue: true with both fidelities none, so a caller that branches on this field alone starts over believing it resumed. reason is the field that answers the other question, and it is present here whenever prior work will not carry. canContinue is false only while state is unavailable.
live while a sandbox lease is still held, fresh before any Run has been accepted, restorable when a sealed checkpoint can be replayed into a new sandbox, unavailable when neither is possible
Fidelity the conversation would be restored at — live in an attached sandbox, exact from a full checkpoint, result_only when just prior results survive, none when nothing does
object
Fidelity the working tree would be restored at — live, portable_tree from a checkpointed tree, or none
object
The Run whose completion sealed the checkpoint this projection describes; absent when no checkpoint exists
Why a next Turn will NOT carry this Session’s previous work. Present exactly when it will not, and absent exactly when it will — so reason == null is the one check that means “resuming here keeps what happened”. no_prior_work accompanies state: fresh and canContinue: true: the Session accepts a Turn and has nothing to carry. The other four accompany state: unavailable and canContinue: false, and name why a restore is impossible rather than merely empty.
Last execution phase the control plane recorded for this Session — a closed set, safe to switch on exhaustively, and additions arrive with a contract change. It remains advisory presentation state: the Run carries the authoritative status, and phase may lag it between a Run’s terminal transition and reconciliation.
Whether a human user or an App installation created the Session, and that actor’s id; an installation-created Session keeps its App authority even when a human later manages it
object
A UUID identifying one Cloud resource; Session, Turn, Publication and Merge ids are minted by the caller so an ambiguous retry addresses the same durable command instead of creating a second one.
Present exactly while this Session has a Run that is not terminal, awaiting included. It is set at admission, so it is already there while the Run is queued or dispatching and before the Run reaches a sandbox or writes its first event — which is the window in which a Turn is refused with 409 cloud_run_in_progress and the Event log is still empty. The one exception is a Run that has ended and is finalizing (phase: finalizing): a follow-up Turn is admitted and queued behind it, and becomes this field. This is the id to cancel, and the id to read GET /v1/sessions/{sessionId}/runs/{runId} with when you did not mint the Turn yourself.
object
A UUID identifying one Cloud resource; Session, Turn, Publication and Merge ids are minted by the caller so an ambiguous retry addresses the same durable command instead of creating a second one.
When the Session was admitted
Last time durable Session state changed; the Session list is ordered by this value descending
Sequence of the newest Event in this Session’s log, 0 before the first. Page GET /v1/sessions/{sessionId}/events only when your cursor is below it
When the Session was archived. Present only on an archived Session — which is readable but closed: it is hidden from the default catalog page, reports continuation.canContinue false with reason session_archived, and rejects every command
Durable initial Turn and 1:1 Run admitted atomically with the Session. Absent only for an intentionally idle create; created is false on an exact replay.
object
The durably admitted Turn, normally still pending dispatch at this point
object
The caller-owned Turn id; the one Run admitted with it carries this exact same value
Session this Turn belongs to
Session-local admission order starting at 0, and the value Turn paging is keyed on
The immutable admitted input — the message plus whatever model, runtime and reply the caller actually requested
object
object
object
Durable hand-off state to the engine: pending before a worker claims it, attempted once delivery started, confirmed when the engine accepted it, rejected when it definitively did not
The single Run this Turn created; its id equals the Turn id
object
A UUID identifying one Cloud resource; Session, Turn, Publication and Merge ids are minted by the caller so an ambiguous retry addresses the same durable command instead of creating a second one.
object
A UUID identifying one Cloud resource; Session, Turn, Publication and Merge ids are minted by the caller so an ambiguous retry addresses the same durable command instead of creating a second one.
object
object
When admission committed the Turn, which is before any compute necessarily existed
The 1:1 Run created with it, normally still queued
object
Run id, always equal to the id of the Turn that created it
Session this Run belongs to
queued, dispatching and running are in flight, awaiting means the agent is blocked on human input, and completed, failed, cancelled and crashed are terminal
How many times a worker has claimed this Run; recovery after a lost worker increments it instead of creating a second Run
Whether cancellation was durably requested; it stays true after the Run terminates, and it never asserts that an external side effect was undone
Coarse machine code for the most recent failure, retained across retries; absent when nothing has failed. This is the whole declared vocabulary: a failure with no code of its own is recorded as dispatch_failed rather than as an undeclared value. Read status first — this field is present on a queued Run that is still retrying, where it names why the last attempt did not place, and the placement and cancellation codes appear there and never on an event. Treat the set as additive and tolerate a value you do not recognize.
object
When admission committed this Run in queued
Last durable Run state change
When a worker actually began executing; absent while the Run is still queued
When the Run reached a terminal status; absent otherwise
False when this request was an exact idempotent replay and the stored Turn was returned unchanged
Example
{ "session": { "id": "9f2b7c14-59d3-4f7a-b8e1-2a6c05d4e731", "sessionUrl": "https://cloud.wamp.dev/sessions/9f2b7c14-59d3-4f7a-b8e1-2a6c05d4e731", "organizationId": "0b9a6f3e-5c21-4d78-9e64-8f1a2b7c3d05", "title": "Rate limit the payments endpoint", "origin": { "tenantKey": "acme", "objectType": "issue", "objectId": "PAY-4821", "endUserId": "9c1f0a7d4b62e35810af2d6c95b7e043", "label": "PAY-4821 Rate limit the payments endpoint", "url": "https://acme.example.com/issues/PAY-4821" }, "source": { "kind": "github", "grantId": "74c5a903-8e6f-4b1d-a052-3c9e18d7f64b", "label": "acme/checkout-service", "private": true, "baseBranch": "main", "baseOid": "5a3e170c93eda8209e3f5592fe1e1d9976fe26ab" }, "model": "claude-opus-5", "runtime": "wamp", "workspace": { "state": "attached", "expiresAt": "2026-08-12T11:40:00Z" }, "continuation": { "canContinue": true, "state": "live", "conversation": { "fidelity": "live" }, "workspace": { "fidelity": "live" } }, "phase": "running", "createdBy": { "kind": "app_installation", "id": "e3f7b219-6c40-4a8e-b591-07d2c48f3a65" }, "activeRun": { "id": "c47a1e08-3d6b-4a92-9f15-8b70d2e5c6a4" }, "createdAt": "2026-08-12T09:20:14Z", "updatedAt": "2026-08-12T09:41:02Z", "lastEventSequence": 37, "environment": null, "parent": null }}Session created
Atomic Session admission. The response contains the complete durable outcome of the create intent.
object
The Session as it stands after this request; a create that was an idempotent replay returns the already-stored Session unchanged
object
The caller-owned Session id, unchanged from the create request
Canonical first-party browser URL for handing this Session to a human
Organization that owns the Session; every credential is authorized against this organization
Human-facing name — the supplied title, first non-empty line of initialTurn.message, or New workspace for an idle Session
Correlation metadata supplied at creation; absent when none was sent
object
Stable opaque identifier for the external tenant the work belongs to, not its display name
The caller’s own kind name for the originating record, such as ticket or issue
The caller’s stable opaque id for that record, so a Session can always be traced back to the business object
Stable one-way hash of the external tenant/user pair; never raw PII.
Short human-readable name for the originating record, shown when the Session is handed to a person
HTTPS deep link back to the originating record in the caller’s product
Repository checked out into the sandbox, with the exact base the Session was pinned to; absent for a Session with no repository
object
object
object
A UUID identifying one Cloud resource; Session, Turn, Publication and Merge ids are minted by the caller so an ambiguous retry addresses the same durable command instead of creating a second one.
Lowercase hex 40-character Git object id naming an exact commit or tree in the source repository.
Model in effect for the next Turn; absent when a runtime-managed agent supplies its own default
The settled foreign agent runtime id, such as claude-code or codex; absent means the native WAMP runtime
Sandbox attachment — unavailable when no lease is held, attached with the lease expiresAt, expired once that lease has lapsed; losing it does not end the Session
object
Whether and at what fidelity this Session can be carried into another Run
object
Whether a new Turn can be admitted for this Session — nothing more. It is NOT the answer to “did my previous work survive”: a fresh Session reports canContinue: true with both fidelities none, so a caller that branches on this field alone starts over believing it resumed. reason is the field that answers the other question, and it is present here whenever prior work will not carry. canContinue is false only while state is unavailable.
live while a sandbox lease is still held, fresh before any Run has been accepted, restorable when a sealed checkpoint can be replayed into a new sandbox, unavailable when neither is possible
Fidelity the conversation would be restored at — live in an attached sandbox, exact from a full checkpoint, result_only when just prior results survive, none when nothing does
object
Fidelity the working tree would be restored at — live, portable_tree from a checkpointed tree, or none
object
The Run whose completion sealed the checkpoint this projection describes; absent when no checkpoint exists
Why a next Turn will NOT carry this Session’s previous work. Present exactly when it will not, and absent exactly when it will — so reason == null is the one check that means “resuming here keeps what happened”. no_prior_work accompanies state: fresh and canContinue: true: the Session accepts a Turn and has nothing to carry. The other four accompany state: unavailable and canContinue: false, and name why a restore is impossible rather than merely empty.
Last execution phase the control plane recorded for this Session — a closed set, safe to switch on exhaustively, and additions arrive with a contract change. It remains advisory presentation state: the Run carries the authoritative status, and phase may lag it between a Run’s terminal transition and reconciliation.
Whether a human user or an App installation created the Session, and that actor’s id; an installation-created Session keeps its App authority even when a human later manages it
object
A UUID identifying one Cloud resource; Session, Turn, Publication and Merge ids are minted by the caller so an ambiguous retry addresses the same durable command instead of creating a second one.
Present exactly while this Session has a Run that is not terminal, awaiting included. It is set at admission, so it is already there while the Run is queued or dispatching and before the Run reaches a sandbox or writes its first event — which is the window in which a Turn is refused with 409 cloud_run_in_progress and the Event log is still empty. The one exception is a Run that has ended and is finalizing (phase: finalizing): a follow-up Turn is admitted and queued behind it, and becomes this field. This is the id to cancel, and the id to read GET /v1/sessions/{sessionId}/runs/{runId} with when you did not mint the Turn yourself.
object
A UUID identifying one Cloud resource; Session, Turn, Publication and Merge ids are minted by the caller so an ambiguous retry addresses the same durable command instead of creating a second one.
When the Session was admitted
Last time durable Session state changed; the Session list is ordered by this value descending
Sequence of the newest Event in this Session’s log, 0 before the first. Page GET /v1/sessions/{sessionId}/events only when your cursor is below it
When the Session was archived. Present only on an archived Session — which is readable but closed: it is hidden from the default catalog page, reports continuation.canContinue false with reason session_archived, and rejects every command
Durable initial Turn and 1:1 Run admitted atomically with the Session. Absent only for an intentionally idle create; created is false on an exact replay.
object
The durably admitted Turn, normally still pending dispatch at this point
object
The caller-owned Turn id; the one Run admitted with it carries this exact same value
Session this Turn belongs to
Session-local admission order starting at 0, and the value Turn paging is keyed on
The immutable admitted input — the message plus whatever model, runtime and reply the caller actually requested
object
object
object
Durable hand-off state to the engine: pending before a worker claims it, attempted once delivery started, confirmed when the engine accepted it, rejected when it definitively did not
The single Run this Turn created; its id equals the Turn id
object
A UUID identifying one Cloud resource; Session, Turn, Publication and Merge ids are minted by the caller so an ambiguous retry addresses the same durable command instead of creating a second one.
object
A UUID identifying one Cloud resource; Session, Turn, Publication and Merge ids are minted by the caller so an ambiguous retry addresses the same durable command instead of creating a second one.
object
object
When admission committed the Turn, which is before any compute necessarily existed
The 1:1 Run created with it, normally still queued
object
Run id, always equal to the id of the Turn that created it
Session this Run belongs to
queued, dispatching and running are in flight, awaiting means the agent is blocked on human input, and completed, failed, cancelled and crashed are terminal
How many times a worker has claimed this Run; recovery after a lost worker increments it instead of creating a second Run
Whether cancellation was durably requested; it stays true after the Run terminates, and it never asserts that an external side effect was undone
Coarse machine code for the most recent failure, retained across retries; absent when nothing has failed. This is the whole declared vocabulary: a failure with no code of its own is recorded as dispatch_failed rather than as an undeclared value. Read status first — this field is present on a queued Run that is still retrying, where it names why the last attempt did not place, and the placement and cancellation codes appear there and never on an event. Treat the set as additive and tolerate a value you do not recognize.
object
When admission committed this Run in queued
Last durable Run state change
When a worker actually began executing; absent while the Run is still queued
When the Run reached a terminal status; absent otherwise
False when this request was an exact idempotent replay and the stored Turn was returned unchanged
Example
{ "session": { "id": "9f2b7c14-59d3-4f7a-b8e1-2a6c05d4e731", "sessionUrl": "https://cloud.wamp.dev/sessions/9f2b7c14-59d3-4f7a-b8e1-2a6c05d4e731", "organizationId": "0b9a6f3e-5c21-4d78-9e64-8f1a2b7c3d05", "title": "Rate limit the payments endpoint", "origin": { "tenantKey": "acme", "objectType": "issue", "objectId": "PAY-4821", "endUserId": "9c1f0a7d4b62e35810af2d6c95b7e043", "label": "PAY-4821 Rate limit the payments endpoint", "url": "https://acme.example.com/issues/PAY-4821" }, "source": { "kind": "github", "grantId": "74c5a903-8e6f-4b1d-a052-3c9e18d7f64b", "label": "acme/checkout-service", "private": true, "baseBranch": "main", "baseOid": "5a3e170c93eda8209e3f5592fe1e1d9976fe26ab" }, "model": "claude-opus-5", "runtime": "wamp", "workspace": { "state": "unavailable" }, "continuation": { "canContinue": true, "state": "fresh", "conversation": { "fidelity": "none" }, "workspace": { "fidelity": "none" } }, "phase": "idle", "createdBy": { "kind": "app_installation", "id": "e3f7b219-6c40-4a8e-b591-07d2c48f3a65" }, "createdAt": "2026-08-12T09:20:14Z", "updatedAt": "2026-08-12T09:20:14Z", "lastEventSequence": 11, "environment": null, "parent": null }}Headers
Section titled “Headers”Malformed request
Failure body returned with every non-2xx JSON response; branch on the machine code, never on prose or on the HTTP status alone.
object
Stable machine code
The installation capability the presented credential lacks, returned with insufficient_scope so an integrator knows exactly which capability to request
Advisory seconds to wait before retrying; returned on rate-limit denials, where the Retry-After header carries the same value
Returned with invalid_request: one entry per field of the request body or query that was refused. The WAMP Account API sends the same two keys under the same field name, and no others are sent by either.
object
Field path, outermost segment first. An integer segment is an array index.
Short reason the field was refused. Prose for a human to read; branch on the code and the path, never on this.
Returned with invalid_path_parameter: the name of the path segment that is not a valid id, such as sessionId or artifactId
Returned with unsupported_media_type: the Content-Type you sent, echoed back. Omitted when the request carried a body and no Content-Type at all, which is the same refusal. Request bodies are read only under application/json and RFC 6839 application/*+json; anything else is never parsed, so no field of it was ever seen.
Returned with method_not_allowed: the methods this path does answer, the same list as the Allow header on the response. Read the header if you want one code path for every 405 on the API.
The winning approval decision on 409 cloud_interaction_conflict, when an answer exists; absent for a closed or expired request without an answer
object
Example
{ "error": "invalid_request"}No bearer was presented (bearer_credential_required), or the one presented is expired, revoked or for another audience (invalid_or_expired_credential)
Failure body returned with every non-2xx JSON response; branch on the machine code, never on prose or on the HTTP status alone.
object
Stable machine code
The installation capability the presented credential lacks, returned with insufficient_scope so an integrator knows exactly which capability to request
Advisory seconds to wait before retrying; returned on rate-limit denials, where the Retry-After header carries the same value
Returned with invalid_request: one entry per field of the request body or query that was refused. The WAMP Account API sends the same two keys under the same field name, and no others are sent by either.
object
Field path, outermost segment first. An integer segment is an array index.
Short reason the field was refused. Prose for a human to read; branch on the code and the path, never on this.
Returned with invalid_path_parameter: the name of the path segment that is not a valid id, such as sessionId or artifactId
Returned with unsupported_media_type: the Content-Type you sent, echoed back. Omitted when the request carried a body and no Content-Type at all, which is the same refusal. Request bodies are read only under application/json and RFC 6839 application/*+json; anything else is never parsed, so no field of it was ever seen.
Returned with method_not_allowed: the methods this path does answer, the same list as the Allow header on the response. Read the header if you want one code path for every 405 on the API.
The winning approval decision on 409 cloud_interaction_conflict, when an answer exists; absent for a closed or expired request without an answer
object
Example
{ "error": "bearer_credential_required"}Live installation, scope or organization policy denies the operation
Failure body returned with every non-2xx JSON response; branch on the machine code, never on prose or on the HTTP status alone.
object
Stable machine code
The installation capability the presented credential lacks, returned with insufficient_scope so an integrator knows exactly which capability to request
Advisory seconds to wait before retrying; returned on rate-limit denials, where the Retry-After header carries the same value
Returned with invalid_request: one entry per field of the request body or query that was refused. The WAMP Account API sends the same two keys under the same field name, and no others are sent by either.
object
Field path, outermost segment first. An integer segment is an array index.
Short reason the field was refused. Prose for a human to read; branch on the code and the path, never on this.
Returned with invalid_path_parameter: the name of the path segment that is not a valid id, such as sessionId or artifactId
Returned with unsupported_media_type: the Content-Type you sent, echoed back. Omitted when the request carried a body and no Content-Type at all, which is the same refusal. Request bodies are read only under application/json and RFC 6839 application/*+json; anything else is never parsed, so no field of it was ever seen.
Returned with method_not_allowed: the methods this path does answer, the same list as the Allow header on the response. Read the header if you want one code path for every 405 on the API.
The winning approval decision on 409 cloud_interaction_conflict, when an answer exists; absent for a closed or expired request without an answer
object
Example
{ "error": "insufficient_scope", "requiredScope": "wamp.cloud.sessions:create"}Idempotency, lifecycle, revision or single-flight conflict
Failure body returned with every non-2xx JSON response; branch on the machine code, never on prose or on the HTTP status alone.
object
Stable machine code
The installation capability the presented credential lacks, returned with insufficient_scope so an integrator knows exactly which capability to request
Advisory seconds to wait before retrying; returned on rate-limit denials, where the Retry-After header carries the same value
Returned with invalid_request: one entry per field of the request body or query that was refused. The WAMP Account API sends the same two keys under the same field name, and no others are sent by either.
object
Field path, outermost segment first. An integer segment is an array index.
Short reason the field was refused. Prose for a human to read; branch on the code and the path, never on this.
Returned with invalid_path_parameter: the name of the path segment that is not a valid id, such as sessionId or artifactId
Returned with unsupported_media_type: the Content-Type you sent, echoed back. Omitted when the request carried a body and no Content-Type at all, which is the same refusal. Request bodies are read only under application/json and RFC 6839 application/*+json; anything else is never parsed, so no field of it was ever seen.
Returned with method_not_allowed: the methods this path does answer, the same list as the Allow header on the response. Read the header if you want one code path for every 405 on the API.
The winning approval decision on 409 cloud_interaction_conflict, when an answer exists; absent for a closed or expired request without an answer
object
Example
{ "error": "cloud_session_conflict"}The request body was never read. Either the Content-Type is not a JSON media type — bodies are parsed only under application/json and RFC 6839 application/*+json — or its content encoding or charset was refused. unsupported_media_type echoes the type you sent in mediaType. Malformed JSON under an accepted media type is a different answer: 400 malformed_request_body.
Failure body returned with every non-2xx JSON response; branch on the machine code, never on prose or on the HTTP status alone.
object
Stable machine code
The installation capability the presented credential lacks, returned with insufficient_scope so an integrator knows exactly which capability to request
Advisory seconds to wait before retrying; returned on rate-limit denials, where the Retry-After header carries the same value
Returned with invalid_request: one entry per field of the request body or query that was refused. The WAMP Account API sends the same two keys under the same field name, and no others are sent by either.
object
Field path, outermost segment first. An integer segment is an array index.
Short reason the field was refused. Prose for a human to read; branch on the code and the path, never on this.
Returned with invalid_path_parameter: the name of the path segment that is not a valid id, such as sessionId or artifactId
Returned with unsupported_media_type: the Content-Type you sent, echoed back. Omitted when the request carried a body and no Content-Type at all, which is the same refusal. Request bodies are read only under application/json and RFC 6839 application/*+json; anything else is never parsed, so no field of it was ever seen.
Returned with method_not_allowed: the methods this path does answer, the same list as the Allow header on the response. Read the header if you want one code path for every 405 on the API.
The winning approval decision on 409 cloud_interaction_conflict, when an answer exists; absent for a closed or expired request without an answer
object
Example
{ "error": "unsupported_media_type", "mediaType": "application/x-www-form-urlencoded"}The pre-authentication edge budget or durable human-membership/App-installation budget is exhausted
Failure body returned with every non-2xx JSON response; branch on the machine code, never on prose or on the HTTP status alone.
object
Stable machine code
The installation capability the presented credential lacks, returned with insufficient_scope so an integrator knows exactly which capability to request
Advisory seconds to wait before retrying; returned on rate-limit denials, where the Retry-After header carries the same value
Returned with invalid_request: one entry per field of the request body or query that was refused. The WAMP Account API sends the same two keys under the same field name, and no others are sent by either.
object
Field path, outermost segment first. An integer segment is an array index.
Short reason the field was refused. Prose for a human to read; branch on the code and the path, never on this.
Returned with invalid_path_parameter: the name of the path segment that is not a valid id, such as sessionId or artifactId
Returned with unsupported_media_type: the Content-Type you sent, echoed back. Omitted when the request carried a body and no Content-Type at all, which is the same refusal. Request bodies are read only under application/json and RFC 6839 application/*+json; anything else is never parsed, so no field of it was ever seen.
Returned with method_not_allowed: the methods this path does answer, the same list as the Allow header on the response. Read the header if you want one code path for every 405 on the API.
The winning approval decision on 409 cloud_interaction_conflict, when an answer exists; absent for a closed or expired request without an answer
object
Example
{ "error": "cloud_rate_limit_exceeded", "retryAfterSeconds": 3}Headers
Section titled “Headers”IETF HTTPAPI structured quota policy
IETF HTTPAPI structured current service limit
The request was accepted and something on our side failed while answering it. Nothing about the request needs to change; the same call may succeed on retry. Retry cautiously, with backoff — a non-idempotent command may have taken effect before the fault.
Failure body returned with every non-2xx JSON response; branch on the machine code, never on prose or on the HTTP status alone.
object
Stable machine code
The installation capability the presented credential lacks, returned with insufficient_scope so an integrator knows exactly which capability to request
Advisory seconds to wait before retrying; returned on rate-limit denials, where the Retry-After header carries the same value
Returned with invalid_request: one entry per field of the request body or query that was refused. The WAMP Account API sends the same two keys under the same field name, and no others are sent by either.
object
Field path, outermost segment first. An integer segment is an array index.
Short reason the field was refused. Prose for a human to read; branch on the code and the path, never on this.
Returned with invalid_path_parameter: the name of the path segment that is not a valid id, such as sessionId or artifactId
Returned with unsupported_media_type: the Content-Type you sent, echoed back. Omitted when the request carried a body and no Content-Type at all, which is the same refusal. Request bodies are read only under application/json and RFC 6839 application/*+json; anything else is never parsed, so no field of it was ever seen.
Returned with method_not_allowed: the methods this path does answer, the same list as the Allow header on the response. Read the header if you want one code path for every 405 on the API.
The winning approval decision on 409 cloud_interaction_conflict, when an answer exists; absent for a closed or expired request without an answer
object
Example
{ "error": "internal_error"}A retryable condition: a workspace, runtime or provider that is not available yet, or service_unavailable while the service restarts for a release or its database cannot serve the request in time. Retry after the Retry-After this response carries.
Failure body returned with every non-2xx JSON response; branch on the machine code, never on prose or on the HTTP status alone.
object
Stable machine code
The installation capability the presented credential lacks, returned with insufficient_scope so an integrator knows exactly which capability to request
Advisory seconds to wait before retrying; returned on rate-limit denials, where the Retry-After header carries the same value
Returned with invalid_request: one entry per field of the request body or query that was refused. The WAMP Account API sends the same two keys under the same field name, and no others are sent by either.
object
Field path, outermost segment first. An integer segment is an array index.
Short reason the field was refused. Prose for a human to read; branch on the code and the path, never on this.
Returned with invalid_path_parameter: the name of the path segment that is not a valid id, such as sessionId or artifactId
Returned with unsupported_media_type: the Content-Type you sent, echoed back. Omitted when the request carried a body and no Content-Type at all, which is the same refusal. Request bodies are read only under application/json and RFC 6839 application/*+json; anything else is never parsed, so no field of it was ever seen.
Returned with method_not_allowed: the methods this path does answer, the same list as the Allow header on the response. Read the header if you want one code path for every 405 on the API.
The winning approval decision on 409 cloud_interaction_conflict, when an answer exists; absent for a closed or expired request without an answer
object
Example
{ "error": "cloud_workspace_unavailable"}