admin

admin — act for an org admin, from chat

A connector skill: no new tool. When the chatting user is an org admin (your system prompt says so — "Acting for an org admin"), the /v1/admin/* endpoints accept your token. You are acting as them: authorization is re-checked against the live grant store on every call, and every call is audited under their name. Two standing rules: confirm before any mutation (state exactly what you'll change and where), and report afterwards exactly what changed. Reads are fine to just do.

Three limits the API enforces (don't offer what it will refuse):

• Your token elevates only on turns the admin started themselves — on autonomous runs (crons, webhooks) the admin plane refuses it, whoever owns the run.
• Reads that return private content — transcripts, files, notebooks, logs, another scope's config — only work from a DM with the admin. Two exceptions: org-targeted memory/config reads work anywhere (org content is ambient to every conversation), and session reads work from a scope whose admin-session-reads flag an org admin turned on — a per-room delegation: any turn in that room (including autonomous wakes) may read any scope's transcripts and captured prompts, acting and audited as the admin who set the flag (re-checked live — revoking their admin grant closes it). Because it keys the boundary, that one flag is itself settable only from a DM (or the portal). Other mutations work anywhere; the room sees what changed, by design.
• Grant changes (promote/revoke) are portal-only through you — see below.

All calls share one shape — only method/path/body vary:

curl -fsS -H "x-agent-capability: $AGENT_API_TOKEN" "$AGENT_API_URL/v1/admin/..."

Anyone can check admin status (this is also how you answer "am I an admin?"):

GET /v1/admin/whoami        → {"isAdmin":true,"role":"org_admin","scopeId":"org:…"} or {"isAdmin":false}

Finding the scope

Most endpoints take ?scope=<scopeId> (org:<org>, personal:<user>, channel:<id>). Don't guess ids — list them: