Account CLI API

Alpha. Deploy the compatible API before installing the coordinated alpha CLI release.

Use account CLI OAuth to manage resources across your current workspace memberships. It is independent of the application SDK, project setup authorization and .env files. The CLI reference provides terminal workflows and exit codes.

Authorization

seamward login --read-onlyseamward workspaces list --jsonseamward workspaces use acmeseamward connections verify int_example --workspace acme --json

The CLI registers a public native client with software_id: seamward-management-cli, uses the OAuth device grant and requests offline_access. Browser consent shows the exact permissions and requires a verified account. The resource audience is https://seamward.com/api/cli. Access tokens last 15 minutes. A refresh requires the same current consent; replacing or revoking consent invalidates the old grant. Account login does not select an environment or grant collector credential operations.

Workspace requests require these headers:

Authorization: Bearer <account CLI access token>X-Seamward-Workspace: acme

Account identity, workspace listing and current-client revocation do not require the workspace header. An active current membership is checked on every workspace request. Viewers can read only; owner/admin writes also require the exact OAuth scope. Scopes use the prefix seamward:cli: followed by integrations:read, integrations:manage, contracts:read, contracts:write, contracts:activate, observations:read, incidents:read, repairs:read, repairs:create, repairs:approve, repairs:export, or replays:read.

The hosted CLI trusts the Seamward console/API origin pair. It does not send an account token to an arbitrary --api-url. Tokens for setup, ingestion, remote MCP, another resource or a revoked client cannot authorize this API. Management tokens cannot issue, rotate, recover, verify secret pairs, or export collector credentials. Use dashboard credential setup for Live and install its pair directly in hosting secrets.

Repair export requires the separate repairs:export scope and current owner/admin membership. Read-only grants and viewers cannot export executable bundles.

Account endpoints

Workspace listing accepts limit from 1 to 100 (default 25) and optional cursor, the last organization ID returned as nextCursor. Unknown query fields are rejected. The response includes active workspaces where the user is an owner, admin or viewer, including when there is no saved workspace selection.

Example identity response:

{  "schemaVersion": 1,  "user": { "id": "usr_example", "name": "Example operator" },  "scopes": ["seamward:cli:integrations:read"]}

Session lists accept the same bounded limit and cursor rules. To retire a lost terminal login, run seamward login on another trusted device, seamward sessions list, then seamward sessions revoke CLIENT_ID. No workspace is required. Revocation is audited in current workspaces.

Logout revokes the current client, not every account session. Operation receipts stay retained but another client cannot claim them. A local-only logout leaves remote authorization valid until revoked or expired.

Evidence endpoints

Every connection path is bound to the selected workspace's exact canonical int_... connection. The response mode is derived from that connection, never from a separate mode selector.

Verification returns:

{  "connectionId": "int_example",  "mode": "sandbox",  "credentialStatus": "active",  "activeContractVersionId": null,  "hasObservations": false,  "latestObservedAt": null}

credentialStatus is active, revoked, or missing. hasObservations and latest time describe stored evidence; no traffic is sent. An active credential does not prove that the application has installed it.

Lists accept limit from 1 to 100 (default 25) and optional opaque cursor. Incident lists also accept status: open | resolved. Cursor ownership includes workspace, exact connection, incident where relevant, and filters. Reusing a cursor in another scope returns 400. Empty pages return an empty array and null cursor.

Dataset metadata contains id, incidentId, connectionId, mode, manifestHash, fixtureCount, redactionPolicyVersion, and ISO createdAt. Proposal list items contain IDs, status, nullable dataset and validation-run IDs, created/updated times and a sanitized error code. Run metadata contains run/dataset/connection IDs, mode, status, adapter version/fingerprint, nullable sanitized error code, and queued/started/finished times.

Observation endpoints also accept CLI OAuth, but require the exact integrationId query parameter. Contract endpoints bind their connection ID in the path. Neither can use an omitted connection to obtain workspace-wide evidence.

Reviewed repairs

Request, decision-preview and export admission are each capped at 20 new operations per workspace and 5 new operations per actor per UTC minute. New repair generation additionally allows 10 in-progress proposals per workspace and only one in-progress proposal per incident. A 429 includes Retry-After and creates no receipt. Completed request/export retries recover their original result even after the worker or connection becomes unavailable.

Repair request, apply and export require Idempotency-Key: a printable 8 to 128 character string retained for retries. Decision preview does not mutate the proposal. It expires after ten minutes and binds current authorization, candidate, validation, replay, and source-patch fingerprints. Apply rechecks those exact facts and commits the reviewer decision, immutable approval, audit and completion receipt together.

A request queues the existing repair worker and returns HTTP 202. Its frozen replay dataset comes from the incident's observations, and compatible findings must be linked to those observations. An optional datasetId must identify the same exact workspace, incident, connection and frozen observation set. Repair capacity and generation configuration are required. Arbitrary replay adapters, source code and network execution are not accepted.

Decision request:

{  "decision": "approved",  "rationale": "Reviewed candidate and validated replay against intended behavior."}

decision is approved or rejected. rationale is trimmed and must contain 10 to 1000 characters. Only proposals awaiting approval with a valid candidate and passed replay can be decided. Repository-bound proposals also require a source-patch artifact.

Preview fields are schemaVersion: 1, operationId, connectionId, proposalId, status: previewed, approvalFingerprint, expiresAt, and review. The review includes decision/rationale, proposal status/fingerprint, nullable validation, patch fingerprint and repository mapping ID. Validation contains report ID, valid/replay booleans, run ID/status, adapter fingerprint and schema-check fingerprint.

Apply request, using the exact fingerprint returned by preview:

{  "approvalFingerprint": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}

Completed request receipt:

{  "schemaVersion": 1,  "operationId": "cliop_example",  "action": "repair.request",  "targetId": "inc_example",  "connectionId": "int_example",  "status": "completed",  "data": {    "proposalId": "rep_example",    "datasetId": "rds_example",    "status": "queued"  },  "completedAt": "2026-10-01T08:00:00.000Z",  "replayed": false}

A decision receipt changes action to repair.decision, targetId to the proposal and data to {proposalId, status: approved | rejected, approvalRecordId}. An export receipt uses repair.export and returns a seamward-repair-export/1 bundle with filename, fingerprint, and three files: repair.json, REPAIR.md, and repair.ts. Each has media type, SHA-256 and content. Reviewer identity is omitted from CLI exports; the immutable internal approval remains available for audit.

Exports require an approved, fingerprint-matching and validated candidate. Export does not edit the project, create a pull request, or deploy code. Review and test the generated adapter yourself.

Existing management APIs

CLI OAuth also authorizes the safe management routes documented under workspaces and contracts: Integration inventory/detail, connection metadata, modes, contract registration/activation, reconciliation rules, reviewed configuration copy/compensation, and reviewed connection or whole-Integration deletion. Use the exact scope and body from those references with X-Seamward-Workspace. Existing revision and idempotency controls still apply. CLI OAuth is deliberately denied on credential, Integration creation and mode-connection setup surfaces that could issue secrets.

Errors and recovery

Errors contain a stable error code. Responses never include access, refresh or ingest tokens.

On a lost response, read the operation status or repeat the exact request with its original key. Changed payloads with that key conflict. Another user, client or authorization epoch cannot claim the receipt. Deleted connections retain completed receipts. Archive or membership removal withdraws CLI workspace access.

Next: CLI command reference, contract API, or configuration and credential APIs.

Endpoint examples

These examples follow the published machine contracts. Account tokens authorize management only.

Read account CLI identity

GET /v1/cli/me

Authorization: account CLI OAuth. No workspace selection is required.

Path parameters

No path parameters.

Query parameters

No query parameters. Unknown fields return invalid_cli_query.

Request example

Set resource-ID variables to IDs returned by your own preceding requests. Replace the account-token placeholder through your OAuth client; it is not a collector credential.

curl --request GET "https://api.seamward.com/v1/cli/me" \  --header 'Authorization: Bearer <account CLI access token>'

Response: HTTP 200

{  "schemaVersion": 1,  "user": {    "id": "usr_example",    "name": "Example operator"  },  "scopes": ["seamward:cli:integrations:read"]}

Errors and recovery

List current account workspaces

GET /v1/cli/workspaces

Authorization: account CLI OAuth. No workspace selection is required.

Path parameters

No path parameters.

Query parameters

• limit: 1 to 100, default 25.
• cursor: unchanged nextCursor from the preceding scoped page.

Request example

Set resource-ID variables to IDs returned by your own preceding requests. Replace the account-token placeholder through your OAuth client; it is not a collector credential.

curl --request GET "https://api.seamward.com/v1/cli/workspaces" \  --header 'Authorization: Bearer <account CLI access token>'

Response: HTTP 200

{  "items": [    {      "id": "org_example",      "slug": "acme",      "name": "Acme",      "role": "owner"    }  ],  "nextCursor": null}

Errors and recovery

List owned CLI authorizations

GET /v1/cli/sessions

Authorization: account CLI OAuth. No workspace selection is required.

Path parameters

No path parameters.

Query parameters

• limit: 1 to 100, default 25.
• cursor: unchanged nextCursor from the preceding scoped page.

Request example

Set resource-ID variables to IDs returned by your own preceding requests. Replace the account-token placeholder through your OAuth client; it is not a collector credential.

curl --request GET "https://api.seamward.com/v1/cli/sessions" \  --header 'Authorization: Bearer <account CLI access token>'

Response: HTTP 200

{  "items": [],  "nextCursor": null}

Errors and recovery

Revoke an owned CLI authorization

DELETE /v1/cli/sessions/{clientId}

Authorization: account CLI OAuth. No workspace selection is required.

Path parameters

• clientId: exact owned CLI client ID. Copy it from the preceding list or operation response.

Query parameters

No query parameters. Unknown fields return invalid_cli_query.

Request example

Set resource-ID variables to IDs returned by your own preceding requests. Replace the account-token placeholder through your OAuth client; it is not a collector credential.

curl --request DELETE "https://api.seamward.com/v1/cli/sessions/${CLIENT_ID}" \  --header 'Authorization: Bearer <account CLI access token>'

Response: HTTP 200

{  "revoked": true}

Errors and recovery

Revoke this CLI client

DELETE /v1/cli/session

Authorization: account CLI OAuth. No workspace selection is required.

Path parameters

No path parameters.

Query parameters

No query parameters. Unknown fields return invalid_cli_query.

Request example

Set resource-ID variables to IDs returned by your own preceding requests. Replace the account-token placeholder through your OAuth client; it is not a collector credential.

curl --request DELETE "https://api.seamward.com/v1/cli/session" \  --header 'Authorization: Bearer <account CLI access token>'

Response: HTTP 200

{  "revoked": true}

Errors and recovery

Verify exact connection evidence

GET /v1/cli/connections/{connectionId}/verify

Authorization: account CLI OAuth, requiring seamward:cli:observations:read. Current workspace membership and the workspace header are required.

Path parameters

• connectionId: exact connection ID. Copy it from the preceding list or operation response.

Query parameters

No query parameters. Unknown fields return invalid_cli_query.

Request example

Set resource-ID variables to IDs returned by your own preceding requests. Replace the account-token placeholder through your OAuth client; it is not a collector credential.

curl --request GET "https://api.seamward.com/v1/cli/connections/${CONNECTION_ID}/verify" \  --header 'Authorization: Bearer <account CLI access token>' \  --header 'X-Seamward-Workspace: acme'

Response: HTTP 200

{  "connectionId": "int_example",  "mode": "sandbox",  "credentialStatus": "active",  "activeContractVersionId": null,  "hasObservations": false,  "latestObservedAt": null}

Errors and recovery

List exact connection incidents

GET /v1/cli/connections/{connectionId}/incidents

Authorization: account CLI OAuth, requiring seamward:cli:incidents:read. Current workspace membership and the workspace header are required.

Path parameters

• connectionId: exact connection ID. Copy it from the preceding list or operation response.

Query parameters

• limit: 1 to 100, default 25.
• cursor: unchanged nextCursor from the preceding scoped page.
• status: open or resolved.

Request example

Set resource-ID variables to IDs returned by your own preceding requests. Replace the account-token placeholder through your OAuth client; it is not a collector credential.

curl --request GET "https://api.seamward.com/v1/cli/connections/${CONNECTION_ID}/incidents" \  --header 'Authorization: Bearer <account CLI access token>' \  --header 'X-Seamward-Workspace: acme'

Response: HTTP 200

{  "mode": "sandbox",  "items": [    {      "id": "inc_example",      "connectionId": "int_example",      "mode": "sandbox",      "environmentId": "env_sandbox",      "kind": "schema-drift",      "status": "open",      "summary": "The observed response schema changed.",      "affectedRecords": 1,      "resolutionState": "active",      "firstObservedAt": "2026-09-29T06:00:00.000Z",      "lastObservedAt": "2026-09-29T06:00:00.000Z",      "createdAt": "2026-09-29T06:00:00.000Z",      "updatedAt": "2026-09-29T06:00:00.000Z",      "resolvedAt": null    }  ],  "nextCursor": null}

Errors and recovery

Read exact connection incident

GET /v1/cli/connections/{connectionId}/incidents/{id}

Authorization: account CLI OAuth, requiring seamward:cli:incidents:read. Current workspace membership and the workspace header are required.

Path parameters

• connectionId: exact connection ID. Copy it from the preceding list or operation response.
• id: exact resource ID. Copy it from the preceding list or operation response.

Query parameters

No query parameters. Unknown fields return invalid_cli_query.

Request example

Set resource-ID variables to IDs returned by your own preceding requests. Replace the account-token placeholder through your OAuth client; it is not a collector credential.

curl --request GET "https://api.seamward.com/v1/cli/connections/${CONNECTION_ID}/incidents/${ID}" \  --header 'Authorization: Bearer <account CLI access token>' \  --header 'X-Seamward-Workspace: acme'

Response: HTTP 200

{  "incident": {    "id": "inc_example",    "connectionId": "int_example",    "mode": "sandbox",    "environmentId": "env_sandbox",    "kind": "schema-drift",    "status": "open",    "summary": "The observed response schema changed.",    "affectedRecords": 1,    "resolutionState": "active",    "firstObservedAt": "2026-09-29T06:00:00.000Z",    "lastObservedAt": "2026-09-29T06:00:00.000Z",    "createdAt": "2026-09-29T06:00:00.000Z",    "updatedAt": "2026-09-29T06:00:00.000Z",    "resolvedAt": null,    "findings": [],    "observationIds": [],    "evidenceTruncated": false  }}

Errors and recovery

Read exact connection repair proposal

GET /v1/cli/connections/{connectionId}/repair-proposals/{id}

Authorization: account CLI OAuth, requiring seamward:cli:repairs:read. Current workspace membership and the workspace header are required.

Path parameters

• connectionId: exact connection ID. Copy it from the preceding list or operation response.
• id: exact resource ID. Copy it from the preceding list or operation response.

Query parameters

No query parameters. Unknown fields return invalid_cli_query.

Request example

Set resource-ID variables to IDs returned by your own preceding requests. Replace the account-token placeholder through your OAuth client; it is not a collector credential.

curl --request GET "https://api.seamward.com/v1/cli/connections/${CONNECTION_ID}/repair-proposals/${ID}" \  --header 'Authorization: Bearer <account CLI access token>' \  --header 'X-Seamward-Workspace: acme'

Response: HTTP 200

{  "proposal": {    "id": "rep_example",    "incidentId": "inc_example",    "connectionId": "int_example",    "mode": "sandbox",    "environmentId": "env_sandbox",    "status": "queued",    "createdAt": "2026-09-29T06:00:00.000Z",    "updatedAt": "2026-09-29T06:00:00.000Z",    "errorCode": null,    "validation": null,    "decision": null  }}

Errors and recovery

List incident repair proposals

GET /v1/cli/connections/{connectionId}/incidents/{incidentId}/repair-proposals

Authorization: account CLI OAuth, requiring seamward:cli:repairs:read. Current workspace membership and the workspace header are required.

Path parameters

• connectionId: exact connection ID. Copy it from the preceding list or operation response.
• incidentId: exact resource ID. Copy it from the preceding list or operation response.

Query parameters

• limit: 1 to 100, default 25.
• cursor: unchanged nextCursor from the preceding scoped page.

Request example

Set resource-ID variables to IDs returned by your own preceding requests. Replace the account-token placeholder through your OAuth client; it is not a collector credential.

curl --request GET "https://api.seamward.com/v1/cli/connections/${CONNECTION_ID}/incidents/${INCIDENT_ID}/repair-proposals" \  --header 'Authorization: Bearer <account CLI access token>' \  --header 'X-Seamward-Workspace: acme'

Response: HTTP 200

{  "items": [],  "nextCursor": null}

Errors and recovery

List incident replay datasets

GET /v1/cli/connections/{connectionId}/incidents/{incidentId}/replay-datasets

Authorization: account CLI OAuth, requiring seamward:cli:replays:read. Current workspace membership and the workspace header are required.

Path parameters

• connectionId: exact connection ID. Copy it from the preceding list or operation response.
• incidentId: exact resource ID. Copy it from the preceding list or operation response.

Query parameters

• limit: 1 to 100, default 25.
• cursor: unchanged nextCursor from the preceding scoped page.

Request example

Set resource-ID variables to IDs returned by your own preceding requests. Replace the account-token placeholder through your OAuth client; it is not a collector credential.

curl --request GET "https://api.seamward.com/v1/cli/connections/${CONNECTION_ID}/incidents/${INCIDENT_ID}/replay-datasets" \  --header 'Authorization: Bearer <account CLI access token>' \  --header 'X-Seamward-Workspace: acme'

Response: HTTP 200

{  "items": [    {      "id": "rds_example",      "incidentId": "inc_example",      "connectionId": "int_example",      "mode": "sandbox",      "manifestHash": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",      "fixtureCount": 1,      "redactionPolicyVersion": "1",      "createdAt": "2026-10-01T08:00:00.000Z"    }  ],  "nextCursor": null}

Errors and recovery

Read replay dataset metadata

GET /v1/cli/connections/{connectionId}/replay-datasets/{datasetId}

Authorization: account CLI OAuth, requiring seamward:cli:replays:read. Current workspace membership and the workspace header are required.

Path parameters

• connectionId: exact connection ID. Copy it from the preceding list or operation response.
• datasetId: exact resource ID. Copy it from the preceding list or operation response.

Query parameters

No query parameters. Unknown fields return invalid_cli_query.

Request example

Set resource-ID variables to IDs returned by your own preceding requests. Replace the account-token placeholder through your OAuth client; it is not a collector credential.

curl --request GET "https://api.seamward.com/v1/cli/connections/${CONNECTION_ID}/replay-datasets/${DATASET_ID}" \  --header 'Authorization: Bearer <account CLI access token>' \  --header 'X-Seamward-Workspace: acme'

Response: HTTP 200

{  "dataset": {    "id": "rds_example",    "incidentId": "inc_example",    "connectionId": "int_example",    "mode": "sandbox",    "manifestHash": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",    "fixtureCount": 1,    "redactionPolicyVersion": "1",    "createdAt": "2026-10-01T08:00:00.000Z"  }}

Errors and recovery

Read replay run metadata

GET /v1/cli/connections/{connectionId}/replay-runs/{runId}

Authorization: account CLI OAuth, requiring seamward:cli:replays:read. Current workspace membership and the workspace header are required.

Path parameters

• connectionId: exact connection ID. Copy it from the preceding list or operation response.
• runId: exact resource ID. Copy it from the preceding list or operation response.

Query parameters

No query parameters. Unknown fields return invalid_cli_query.

Request example

Set resource-ID variables to IDs returned by your own preceding requests. Replace the account-token placeholder through your OAuth client; it is not a collector credential.

curl --request GET "https://api.seamward.com/v1/cli/connections/${CONNECTION_ID}/replay-runs/${RUN_ID}" \  --header 'Authorization: Bearer <account CLI access token>' \  --header 'X-Seamward-Workspace: acme'

Response: HTTP 200

{  "run": {    "id": "rrun_example",    "datasetId": "rds_example",    "connectionId": "int_example",    "mode": "sandbox",    "status": "passed",    "adapterFingerprint": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",    "adapterVersion": "repair:rep_example",    "errorCode": null,    "queuedAt": "2026-10-01T08:00:00.000Z",    "startedAt": "2026-10-01T08:00:00.000Z",    "finishedAt": "2026-10-01T08:00:00.000Z"  }}

Errors and recovery

Request an evidence-bound repair

POST /v1/cli/connections/{connectionId}/incidents/{incidentId}/repair-proposals

Authorization: account CLI OAuth, requiring seamward:cli:repairs:create. Current workspace membership and the workspace header are required.

Path parameters

• connectionId: exact connection ID. Copy it from the preceding list or operation response.
• incidentId: exact resource ID. Copy it from the preceding list or operation response.

Query parameters

No query parameters. Unknown fields return invalid_cli_query.

Request example

Set resource-ID variables to IDs returned by your own preceding requests. Replace the account-token placeholder through your OAuth client; it is not a collector credential.

curl --request POST "https://api.seamward.com/v1/cli/connections/${CONNECTION_ID}/incidents/${INCIDENT_ID}/repair-proposals" \  --header 'Authorization: Bearer <account CLI access token>' \  --header 'X-Seamward-Workspace: acme' \  --header 'Idempotency-Key: <original idempotency key>' \  --header 'Content-Type: application/json' \  --data '{}'

Request body:

{}

Response: HTTP 202

{  "schemaVersion": 1,  "operationId": "cliop_example",  "action": "repair.request",  "targetId": "inc_example",  "connectionId": "int_example",  "status": "completed",  "data": {    "proposalId": "rep_example",    "datasetId": "rds_example",    "status": "queued"  },  "completedAt": "2026-10-01T08:00:00.000Z",  "replayed": false}

Errors and recovery

Preview a repair decision

POST /v1/cli/connections/{connectionId}/repair-proposals/{proposalId}/decision-preview

Authorization: account CLI OAuth, requiring seamward:cli:repairs:approve. Current workspace membership and the workspace header are required.

Path parameters

• connectionId: exact connection ID. Copy it from the preceding list or operation response.
• proposalId: exact resource ID. Copy it from the preceding list or operation response.

Query parameters

No query parameters. Unknown fields return invalid_cli_query.

Request example

Set resource-ID variables to IDs returned by your own preceding requests. Replace the account-token placeholder through your OAuth client; it is not a collector credential.

curl --request POST "https://api.seamward.com/v1/cli/connections/${CONNECTION_ID}/repair-proposals/${PROPOSAL_ID}/decision-preview" \  --header 'Authorization: Bearer <account CLI access token>' \  --header 'X-Seamward-Workspace: acme' \  --header 'Content-Type: application/json' \  --data '{"decision":"approved","rationale":"Reviewed candidate and validated replay against intended behavior."}'

Request body:

{  "decision": "approved",  "rationale": "Reviewed candidate and validated replay against intended behavior."}

Response: HTTP 201

{  "schemaVersion": 1,  "operationId": "cliop_review",  "connectionId": "int_example",  "proposalId": "rep_example",  "status": "previewed",  "approvalFingerprint": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",  "expiresAt": "2026-10-01T08:10:00.000Z",  "review": {    "proposalId": "rep_example",    "connectionId": "int_example",    "status": "awaiting_approval",    "proposalFingerprint": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",    "validation": {      "id": "val_example",      "valid": true,      "replayPassed": true,      "replayRunId": "rrun_example",      "replayStatus": "passed",      "adapterFingerprint": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",      "schemaChecksFingerprint": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"    },    "patchArtifactFingerprint": null,    "repositoryMappingId": null,    "decision": "approved",    "rationale": "Reviewed candidate and validated replay against intended behavior."  }}

Errors and recovery

Apply the reviewed repair decision

POST /v1/cli/operations/{operationId}/apply

Authorization: account CLI OAuth, requiring seamward:cli:repairs:approve. Current workspace membership and the workspace header are required.

Path parameters

• operationId: exact operation ID. Copy it from the preceding list or operation response.

Query parameters

No query parameters. Unknown fields return invalid_cli_query.

Request example

Set resource-ID variables to IDs returned by your own preceding requests. Replace the account-token placeholder through your OAuth client; it is not a collector credential.

curl --request POST "https://api.seamward.com/v1/cli/operations/${OPERATION_ID}/apply" \  --header 'Authorization: Bearer <account CLI access token>' \  --header 'X-Seamward-Workspace: acme' \  --header 'Idempotency-Key: <original idempotency key>' \  --header 'Content-Type: application/json' \  --data '{"approvalFingerprint":"sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}'

Request body:

{  "approvalFingerprint": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}

Response: HTTP 200

{  "schemaVersion": 1,  "operationId": "cliop_example",  "action": "repair.decision",  "targetId": "rep_example",  "connectionId": "int_example",  "status": "completed",  "data": {    "proposalId": "rep_example",    "status": "approved",    "approvalRecordId": "apr_example"  },  "completedAt": "2026-10-01T08:00:00.000Z",  "replayed": false}

Errors and recovery

Read this client's operation status

GET /v1/cli/operations/{operationId}

Authorization: account CLI OAuth. Current workspace membership and the workspace header are required.

Path parameters

• operationId: exact operation ID. Copy it from the preceding list or operation response.

Query parameters

No query parameters. Unknown fields return invalid_cli_query.

Request example

Set resource-ID variables to IDs returned by your own preceding requests. Replace the account-token placeholder through your OAuth client; it is not a collector credential.

curl --request GET "https://api.seamward.com/v1/cli/operations/${OPERATION_ID}" \  --header 'Authorization: Bearer <account CLI access token>' \  --header 'X-Seamward-Workspace: acme'

Response: HTTP 200

{  "schemaVersion": 1,  "operationId": "cliop_example",  "action": "repair.request",  "targetId": "inc_example",  "connectionId": "int_example",  "status": "completed",  "data": {    "proposalId": "rep_example",    "datasetId": "rds_example",    "status": "queued"  },  "completedAt": "2026-10-01T08:00:00.000Z",  "replayed": false}

Errors and recovery

Export an approved repair

POST /v1/cli/connections/{connectionId}/repair-proposals/{proposalId}/export

Authorization: account CLI OAuth, requiring seamward:cli:repairs:export. Current workspace membership and the workspace header are required.

Path parameters

• connectionId: exact connection ID. Copy it from the preceding list or operation response.
• proposalId: exact resource ID. Copy it from the preceding list or operation response.

Query parameters

No query parameters. Unknown fields return invalid_cli_query.

Request example

Set resource-ID variables to IDs returned by your own preceding requests. Replace the account-token placeholder through your OAuth client; it is not a collector credential.

curl --request POST "https://api.seamward.com/v1/cli/connections/${CONNECTION_ID}/repair-proposals/${PROPOSAL_ID}/export" \  --header 'Authorization: Bearer <account CLI access token>' \  --header 'X-Seamward-Workspace: acme' \  --header 'Idempotency-Key: <original idempotency key>' \  --header 'Content-Type: application/json' \  --data '{}'

Request body:

{}

Response: HTTP 200

{  "schemaVersion": 1,  "operationId": "cliop_example",  "action": "repair.export",  "targetId": "rep_example",  "connectionId": "int_example",  "status": "completed",  "data": {    "schemaVersion": "seamward-repair-export/1",    "filename": "seamward-repair-rep_example.json",    "fingerprint": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",    "files": [      {        "path": "repair.json",        "mediaType": "application/json",        "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",        "content": "{}\n"      },      {        "path": "REPAIR.md",        "mediaType": "text/markdown",        "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",        "content": "# Reviewed repair\n"      },      {        "path": "repair.ts",        "mediaType": "text/typescript",        "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",        "content": "export {};\n"      }    ]  },  "completedAt": "2026-10-01T08:00:00.000Z",  "replayed": false}

Errors and recovery