When a hire asks before using a tool
The tools the hire has on the connection (at its access level), each with its own rule (default: "always", "sometimes" with the rule saying when, or "never"), whether asking is locked (money moving), and the hire's setting ("ask", "auto" or null). A call that needs approval doesn't run: the approver is asked in the thread, and Roster makes exactly that call once it's approved. 404 when the hire isn't on the connection.
sessionbetter-auth.session_token<token>Set by POST /api/auth/sign-in/email.
ws*stringThe workspace id (from GET /api/me).
id*stringThe id of what the path names: a hire, a connection, a skill, a shared file, a department, a position, a goal or an approval.
connection*stringThe connection's id (from GET /api/workspaces/:ws/connections).
The hire's tools on the connection.
application/jsoncurl -X GET 'https://app.useroster.work/api/workspaces/string/hires/string/tools/string/approvals'{ "tools": [ { "name": "create_event", "label": "create event", "description": "Add an event to a calendar, optionally inviting people.", "mutates": true, "default": "sometimes", "rule": "when it invites someone outside your team", "locked": false, "setting": null } ]}Give a hire a tool PUT
`values` are the connection type's `hireFields`, e.g. GitHub `{ "repos": ["acme/web"] }` or Linear `{ "teams": ["ENG"] }`: an allowlist checked on every tool call (empty: whatever the connection's credential reaches). `access` is `"read"` (only tools that change nothing) or `"write"` (all; the default). `approvals` is optional, as for the change below.
Repositories a GitHub connection can see GET
To suggest for a hire's allowlist. Best effort: an empty list when GitHub won't say.