Skip to content
KataraKatara documentation
This is the staging documentation, where Katara rehearses releases. Live and Test both settle on Avalanche Fuji in test USDC here.

Read the executors declared for an agent identity

GET
/katara/v1/orgs/{org_id}/environments/{environment_id}/agent-identities/{id}/executors
curl --request GET \
  --url https://api.staging.katara.com/katara/v1/orgs/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/environments/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/agent-identities/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/executors \
  --header 'Authorization: Bearer <token>'

Requires grant read access to the agent. Returns every declaration for the agent, revoked ones included, with the capability digest an executor presents when it claims a run.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
org_id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
environment_id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000

Header Parameters

Section titled “Header Parameters”
X-Katara-Account-ID
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/

Optional for reads after sign-in. Use the UUID of the account that loaded the application. A different current cookie account returns account_changed before the handler runs. Session bearer and API key clients do not require this header.

Responses

Section titled “Responses”

200

Section titled “200”

Successful request

Media typeapplication/json
object
data
required
Array<object>
<= 100 items

An executor allowed to run the agent’s work: the workload identity its certificate carries, what it declared it can do, and the agent identity epoch it was declared against. A declaration made before the agent identity last changed no longer admits claims.

object
id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
agent_id
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
spiffe_id
required
string
>= 12 characters <= 2048 characters /^spiffe://[a-z0-9.-]{1,255}/[!-~]{1,255}$/
capabilities
required

What the executor advertises, as the customer declares it. At most 8192 bytes.

object
>= 1 properties <= 64 properties
capability_digest
required
string
/^sha256:[a-f0-9]{64}$/
subject_epoch
required
integer
>= 1 <= 9007199254740991
declared_by
required
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
created_at
required
string format: date-time
revoked_at
string format: date-time
Examplegenerated
{
  "data": [
    {
      "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
      "agent_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
      "spiffe_id": "example",
      "capabilities": {},
      "capability_digest": "example",
      "subject_epoch": 1,
      "declared_by": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
      "created_at": "2026-04-15T12:00:00Z",
      "revoked_at": "2026-04-15T12:00:00Z"
    }
  ]
}

409

Section titled “409”

Account_changed: reload and review with the signed-in account.

default

Section titled “default”

Request error

Media typeapplication/json
object
error
required
object
message
required
string
>= 1 characters <= 500 characters
type
required
string
>= 1 characters <= 100 characters
code
required

Stable; branch on it. Any operation can answer invalid_request, with param naming the refused field when there is one; human_session_required, when an API key, service account or workload calls an operation only a signed-in person may perform; reauthentication_required, when a person’s sign-in is too old for the operation; permission_denied; route_not_found and method_not_allowed, when no operation matches the path or method; and feature_unavailable, when the operation’s service is not enabled on this deployment.

string
>= 1 characters <= 100 characters
param
required

The request field a refusal is about, such as the agent_id or run_id query parameter; null when the refusal is not about one field.

string | null
request_id
required
string
>= 1 characters <= 100 characters
upstream_status
required
integer | null
action
Allowed values: sign_in reauthenticate request_access review fund retry reconcile refresh support
operation_id
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
snapshot_ref
string format: uuid
/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
Allowed value: 00000000-0000-0000-0000-000000000000
Example
{
  "error": {
    "action": "sign_in"
  }
}