Take a tool away
sessionbetter-auth.session_token<token>Set by POST /api/auth/sign-in/email.
ws*stringThe workspace id (from GET /api/me).
id*stringThe id of what the path names: a hire, a connection, a skill, a shared file, a department, a position, a goal or an approval.
connection*stringThe connection's id (from GET /api/workspaces/:ws/connections).
The hire.
application/jsoncurl -X DELETE 'https://app.useroster.work/api/workspaces/string/hires/string/tools/string'{ "id": "3f0c2a7e-6b1d-4c55-9a51-2f4d8e9b7a10", "displayName": "Builder", "slug": "builder", "role": "Software engineer", "instructions": "You own the web app's build and its CI.", "status": "active", "autonomy": "ask", "timezone": "Europe/Berlin", "workingHours": { "days": [ 1, 2, 3, 4, 5 ], "start": "09:00", "end": "18:00" }, "home": null, "voice": "", "reactions": { "onPickup": false, "wakeOn": [ "❓", "❌" ] }, "browser": false, "desktop": false, "listen": { "mentions": true, "threads": true, "directMessages": true, "channels": false, "chattiness": "normal" }, "allow": { "humans": "anyone", "agents": [], "maxAgentTurns": 4 }, "chat": [], "tools": [], "onShift": false, "onboardedAt": null, "createdAt": "2026-11-03T09:00:00.000Z"}Change a hire's access to a tool PATCH
Only what's given changes: `access`, the allowlist in `values`, or `approvals`: per tool, by its name, `"ask"` (the hire asks a person before every use) or `"auto"` (it never asks), replacing the hire's earlier choices; a tool left out follows its own rule. 400 for a tool the hire doesn't have, or `"auto"` on a tool that always asks (money moving).
Give a hire a tool PUT
`values` are the connection type's `hireFields`, e.g. GitHub `{ "repos": ["acme/web"] }` or Linear `{ "teams": ["ENG"] }`: an allowlist checked on every tool call (empty: whatever the connection's credential reaches). `access` is `"read"` (only tools that change nothing) or `"write"` (all; the default). `approvals` is optional, as for the change below.