> ## Documentation Index > Fetch the complete documentation index at: https://openworklabs.com/docs/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > For agents: install the OpenWork desktop app with `brew install --cask openwork` (macOS) or from https://openworklabs.com/download. Do not run `npx openwork`; the npm package named `openwork` is a different project. > Connect an agent to OpenWork with the MCP Gateway: `claude mcp add --transport http openwork https://api.openworklabs.com/mcp/agent`. Teams sign up at https://app.openworklabs.com?mode=sign-up. > Step-by-step agent guide: https://openworklabs.com/docs/start-here/use-openwork-from-an-ai-agent.md > OpenWork in Slack is private alpha for approved organizations. Setup guide: https://openworklabs.com/docs/slack/overview.md. Agent skill: https://openworklabs.com/.well-known/agent-skills/set-up-openwork-slack/SKILL.md. # Run the diagnostics checks the caller may run > Starts, in the background, every live check the caller's sections allow: provider model listings with organization-held credentials (never a model request or a member's credential), the Slack assistant token, the caller's own Google API check, and installation services for installation administrators. Shares the rate limits of background checks (one per organization, or per member for connectors, every 30 seconds). Answers with the current diagnostics; poll GET /v1/org/diagnostics until `checking` is false. ## OpenAPI ````yaml /openapi.json post /v1/org/diagnostics/check openapi: 3.1.0 info: title: Den API description: >- OpenAPI spec for the Den control plane API. Authentication: - API keys (they start with `den_`) go in the `x-api-key` header as the raw value. Do not send them as `Authorization: Bearer`; that header only accepts Den session tokens, so an API key there returns 401. Example: `curl https://api.openworklabs.com/v1/me -H "x-api-key: den_..."`. API keys resolve to the issuing user and the organization member they were scoped to when created, so they can call ordinary user and organization routes without a separate signed-in session. - Use `Authorization: Bearer ` for user-authenticated routes that require a Den session. - Session-only flows still require a signed-in user session, including organization creation, invitation acceptance, active-organization switching, and MCP token minting. - Public routes like health and documentation do not require authentication. Swagger tip: use the security schemes in the Authorize dialog to set `denApiKey` (your API key) or `bearerAuth` (a session token) before trying protected endpoints. version: 0.18.46 contact: name: OpenWork url: https://openworklabs.com email: team@openworklabs.com license: name: OpenWork Enterprise Edition License url: https://github.com/different-ai/openwork/blob/dev/ee/LICENSE servers: - url: https://api.openworklabs.com security: - denApiKey: [] - bearerAuth: [] tags: - name: System description: >- Service health, readiness, API documentation, and desktop version metadata. - name: Authentication description: >- Sign-in discovery, administrator bootstrap, OAuth provider connections, and MCP token minting. - name: OAuth description: >- OAuth 2.0 / OpenID Connect authorization-server and protected-resource metadata and dynamic client registration (RFC 8414, RFC 9728, RFC 7591), used by MCP clients. - name: SCIM description: >- SCIM 2.0 provisioning endpoints for identity providers (RFC 7644) and the organization SCIM connector management routes. - name: SSO description: Organization single sign-on connector management routes. - name: Bootstrap description: Agent-first provisional workspace setup routes. - name: Users description: Current user and membership routes. - name: Organizations description: Organization creation, context, brand assets, and install links. - name: Invitations description: Invitation preview, acceptance, creation, and cancellation routes. - name: Members description: Organization member management routes. - name: Teams description: Organization team management routes. - name: Permissions description: >- Organization permissions: the permission catalog, Member, Admin and team permission sets, their history, and each member's effective permissions. - name: API Keys description: Organization API key management routes. - name: Desktop Policies description: Desktop app policies applied to the organization, members, or teams. - name: Agent Permissions description: What agents may do on members' computers, set for everyone and per team. - name: LLM Providers description: Organization LLM provider catalog, configuration, and access routes. - name: Inference description: Organization inference settings. - name: Inference Providers description: >- Organization inference Gateway providers, model groups, credential sets, access grants, member connections, and usage. - name: Gateway Usage Limits description: >- Estimated-cost policies, independent member calendar buckets, assignments, and audited usage-extension requests. - name: Cloud description: Organization Cloud instance lifecycle and browser gateway resolution. - name: Workers description: >- List and delete the organization's workers, including OpenWork Web instances. - name: Worker Activity description: Worker heartbeat and activity reporting routes. - name: Managed deployments description: >- OpenWork installations in an organization's own cloud account: launch approval, installer milestones and health reports. - name: Automations description: Scheduled Automations, their runs, and desktop runner presence. - name: Documents description: >- Connected Drive documents, inline editing and file-bound temporary Office sessions. - name: Workbot description: The signed-in member's single Workbot conversation. - name: Workflows description: Saved Workflows (Code Mode scripts), their versions, snapshots, and views. - name: Workflow Runs description: Durable Workflow run history. - name: Codemode Runs description: Generated Artifact views produced by Code Mode runs. - name: Apps description: >- Saved reusable apps built from Workflows and Artifact views, and their sharing. - name: Config Objects description: >- Versioned configuration objects (skills, workflows, and other plugin content). - name: Plugins description: Plugin packages, access grants, and imports. - name: Marketplaces description: Marketplaces that distribute plugins to members and teams. - name: Resources description: >- Aggregated snapshot of the resources and marketplace capabilities available to the caller. - name: Capability Sources description: >- Native provider capabilities (Google Workspace, Microsoft 365) and external MCP connections executed as the calling member. - name: Direct uploads description: Multipart uploads that stream workspace files straight to a provider. - name: Connectors description: >- Connector accounts and instances (GitHub and other sources) and their sync state. - name: GitHub description: >- GitHub App installation, repository discovery, and plugin import from GitHub. - name: Diagnostics description: Controlled egress diagnostics for self-hosted deployments. - name: Telemetry description: Telemetry event ingestion and adoption analytics. - name: Webhooks description: Signed inbound webhooks from third-party providers. - name: Admin description: Platform administration routes for allowlisted OpenWork administrators. - name: Deprecated description: Removed features that answer with 410 or an empty result for old clients. paths: /v1/org/diagnostics/check: post: tags: - Diagnostics summary: Run the diagnostics checks the caller may run description: >- Starts, in the background, every live check the caller's sections allow: provider model listings with organization-held credentials (never a model request or a member's credential), the Slack assistant token, the caller's own Google API check, and installation services for installation administrators. Shares the rate limits of background checks (one per organization, or per member for connectors, every 30 seconds). Answers with the current diagnostics; poll GET /v1/org/diagnostics until `checking` is false. operationId: postV1OrgDiagnosticsCheck responses: '202': description: Checks started, already running, or nothing to check. content: application/json: schema: $ref: '#/components/schemas/OrgDiagnostics' '401': description: The caller must be signed in. content: application/json: schema: $ref: '#/components/schemas/UnauthorizedError' '404': description: No active organization. content: application/json: schema: $ref: '#/components/schemas/NotFoundError' '429': description: >- Every requested check ran recently; Retry-After says when another may start. Same body. content: application/json: schema: $ref: '#/components/schemas/OrgDiagnostics' security: - denApiKey: [] - bearerAuth: [] components: schemas: OrgDiagnostics: type: object properties: version: type: number const: 1 generatedAt: type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ deployment: type: string enum: - cloud - self_hosted checking: type: boolean attention: maxItems: 200 type: array items: type: object properties: section: type: string enum: - desktop - providers - connectors - installation - network targetId: type: string minLength: 1 maxLength: 160 severity: type: string enum: - warning - error code: type: string enum: - provider_key_rejected - provider_unreachable - provider_model_missing - provider_misconfigured - desktop_startup_failures - connector_slack_token_rejected - connector_slack_not_installed - connector_google_api_disabled - service_misconfigured - service_unreachable subject: type: string minLength: 1 maxLength: 255 count: anyOf: - type: integer minimum: 0 maximum: 9007199254740991 - type: 'null' detail: anyOf: - type: string maxLength: 255 - type: 'null' required: - section - targetId - severity - code - subject - count - detail additionalProperties: false desktop: oneOf: - type: object properties: access: type: string const: granted windowHours: type: number const: 24 startups: type: integer minimum: 0 maximum: 9007199254740991 connected: type: integer minimum: 0 maximum: 9007199254740991 failed: type: integer minimum: 0 maximum: 9007199254740991 people: type: integer minimum: 0 maximum: 9007199254740991 typicalMs: anyOf: - type: integer minimum: 0 maximum: 9007199254740991 - type: 'null' slowestMs: anyOf: - type: integer minimum: 0 maximum: 9007199254740991 - type: 'null' steps: maxItems: 4 type: array items: type: object properties: step: type: string enum: - window - engine - signed_in - org_tools typicalMs: anyOf: - type: integer minimum: 0 maximum: 9007199254740991 - type: 'null' required: - step - typicalMs additionalProperties: false failures: maxItems: 20 type: array items: type: object properties: step: type: string enum: - window - engine - signed_in - org_tools reason: type: string enum: - certificate - dns - offline - timeout - connection_refused - server_error - signed_out - session_expired - engine_failed - org_unavailable - unknown count: type: integer exclusiveMinimum: 0 maximum: 9007199254740991 people: type: integer exclusiveMinimum: 0 maximum: 9007199254740991 lastSeenAt: type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ required: - step - reason - count - people - lastSeenAt additionalProperties: false versions: maxItems: 10 type: array items: type: object properties: version: type: string maxLength: 64 startups: type: integer exclusiveMinimum: 0 maximum: 9007199254740991 required: - version - startups additionalProperties: false required: - access - windowHours - startups - connected - failed - people - typicalMs - slowestMs - steps - failures - versions additionalProperties: false - type: object properties: access: type: string const: locked permission: type: string minLength: 1 maxLength: 64 required: - access - permission additionalProperties: false providers: oneOf: - type: object properties: access: type: string const: granted checkedAt: anyOf: - type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ - type: 'null' checking: type: boolean items: maxItems: 100 type: array items: type: object properties: id: type: string minLength: 1 maxLength: 160 source: type: string enum: - gateway - legacy - openwork providerId: type: string minLength: 1 maxLength: 128 name: type: string minLength: 1 maxLength: 255 credentialName: anyOf: - type: string maxLength: 255 - type: 'null' state: type: string enum: - ready - key_rejected - unreachable - model_missing - misconfigured - member_credentials - managed - not_checked reason: type: string enum: - models_listed - key_accepted - no_live_check - member_sign_in - endpoint_not_found - network_error - timeout - configuration_error - credential_missing - sync_error - managed_by_openwork - not_checked_yet - credential_rejected - credential_expired - unexpected_response httpStatus: anyOf: - type: integer minimum: 100 maximum: 599 - type: 'null' durationMs: anyOf: - type: integer minimum: 0 maximum: 9007199254740991 - type: 'null' checkedAt: anyOf: - type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ - type: 'null' lastSuccessAt: anyOf: - type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ - type: 'null' models: type: object properties: configured: type: integer minimum: 0 maximum: 9007199254740991 served: anyOf: - type: integer minimum: 0 maximum: 9007199254740991 - type: 'null' missing: maxItems: 20 type: array items: type: string maxLength: 255 required: - configured - served - missing additionalProperties: false members: anyOf: - type: object properties: connected: type: integer minimum: 0 maximum: 9007199254740991 needsAttention: type: integer minimum: 0 maximum: 9007199254740991 required: - connected - needsAttention additionalProperties: false - type: 'null' required: - id - source - providerId - name - credentialName - state - reason - httpStatus - durationMs - checkedAt - lastSuccessAt - models - members additionalProperties: false required: - access - checkedAt - checking - items additionalProperties: false - type: object properties: access: type: string const: locked permission: type: string minLength: 1 maxLength: 64 required: - access - permission additionalProperties: false connectors: oneOf: - type: object properties: access: type: string const: granted checkedAt: anyOf: - type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ - type: 'null' items: maxItems: 100 type: array items: type: object properties: id: type: string minLength: 1 maxLength: 160 kind: type: string enum: - slack_assistant - google_workspace name: type: string minLength: 1 maxLength: 255 state: type: string enum: - ready - attention - 'off' - not_checked reason: type: string enum: - slack_token_accepted - slack_token_rejected - slack_not_installed - slack_assistant_off - slack_runner_missing - google_apis_enabled - google_api_disabled - google_sign_in_required - not_checked_yet checkedAt: anyOf: - type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ - type: 'null' lastEventAt: anyOf: - type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ - type: 'null' completed24h: anyOf: - type: integer minimum: 0 maximum: 9007199254740991 - type: 'null' apis: maxItems: 12 type: array items: type: object properties: id: type: string maxLength: 64 name: type: string maxLength: 128 status: type: string enum: - enabled - disabled - unknown required: - id - name - status additionalProperties: false required: - id - kind - name - state - reason - checkedAt - lastEventAt - completed24h - apis additionalProperties: false required: - access - checkedAt - items additionalProperties: false - type: object properties: access: type: string const: locked permission: type: string minLength: 1 maxLength: 64 required: - access - permission additionalProperties: false installation: oneOf: - type: object properties: access: type: string const: operator server: $ref: '#/components/schemas/DenServerFacts' services: $ref: '#/components/schemas/DeploymentServiceReadiness' required: - access - server - services additionalProperties: false - type: object properties: access: type: string const: managed required: - access additionalProperties: false - type: object properties: access: type: string const: locked reason: type: string const: installation_admin_required required: - access - reason additionalProperties: false network: oneOf: - type: object properties: access: type: string const: granted canRun: type: boolean required: - access - canRun additionalProperties: false - type: object properties: access: type: string const: locked permission: type: string minLength: 1 maxLength: 64 required: - access - permission additionalProperties: false required: - version - generatedAt - deployment - checking - attention - desktop - providers - connectors - installation - network additionalProperties: false UnauthorizedError: type: object properties: error: type: string const: unauthorized required: - error NotFoundError: type: object properties: error: type: string message: type: string required: - error DenServerFacts: type: object properties: version: type: string minLength: 1 maxLength: 64 startedAt: type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ startupMs: anyOf: - type: integer minimum: 0 maximum: 9007199254740991 - type: 'null' required: - version - startedAt - startupMs additionalProperties: false DeploymentServiceReadiness: type: object properties: version: type: number const: 2 checkedAt: anyOf: - type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ - type: 'null' checking: type: boolean server: anyOf: - $ref: '#/components/schemas/DenServerFacts' - type: 'null' services: maxItems: 5 type: array items: $ref: '#/components/schemas/DeploymentServiceStatus' required: - version - checkedAt - checking - server - services additionalProperties: false DeploymentServiceStatus: type: object properties: id: type: string enum: - database - gateway - headlessRunner - workbot - email required: type: boolean configured: type: boolean state: type: string enum: - ready - not_configured - misconfigured - unreachable - unknown reason: type: string enum: - not_checked - not_configured - missing_configuration - invalid_configuration - health_verified - database_verified - authentication_failed - unexpected_response - request_failed - timeout - dependency_unavailable - configuration_only - incompatible_service - email_verified - email_key_verified - email_sender_unverified - resume_misconfigured missingSettings: maxItems: 16 type: array items: type: string pattern: ^[A-Z][A-Z0-9_]{0,95}$ dependencies: maxItems: 4 type: array items: type: string enum: - database - gateway - headlessRunner - workbot - email notes: maxItems: 4 type: array items: type: string enum: - resume_ready - resume_not_configured - resume_misconfigured - email_smtp - email_resend durationMs: anyOf: - type: integer minimum: 0 maximum: 9007199254740991 - type: 'null' checkedAt: anyOf: - type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ - type: 'null' lastSuccessAt: anyOf: - type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ - type: 'null' stale: type: boolean required: - id - required - configured - state - reason - missingSettings - dependencies - notes - durationMs - checkedAt - lastSuccessAt - stale additionalProperties: false securitySchemes: denApiKey: type: apiKey in: header name: x-api-key description: >- Organization API key passed as the `x-api-key` header. The raw key is the header value; do not prefix it with `Bearer`. bearerAuth: type: http scheme: bearer bearerFormat: session-token description: >- Den session token passed as `Authorization: Bearer ` for user-authenticated Den routes. Not for API keys: send `den_` keys in the `x-api-key` header instead. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.