Run402

Promote a user to project_admin role by email. Admins can manage secrets from the browser. Requires service_key.

Provision a new Postgres database. Returns project credentials on success, or payment details if x402 payment is needed.

Provision an AWS KMS-backed Ethereum signer for signing smart-contract write transactions. Private keys never leave KMS. Cost: $0.04/day rental ($1.20/month) plus $0.000005 per contract call. Requires $1.20 in cash credit at creation (30 days of rent). Non-custodial.

Publish a project as a forkable app. Set visibility and tags for discoverability.

Redrive a failed/cancelled/expired durable function run with an optional retry override and optional wait.

Re-queue a dead-lettered (failed_permanent) webhook delivery so the worker attempts delivery again. Use after fixing the consumer endpoint.

Register a webhook on the project's mailbox. Receives POST notifications for email events (delivery, bounced, complained, reply_received).

Remove a member from an org. Requires an active `owner` membership. Removing the org's only active owner fails with `409 LAST_OWNER`.

Set or clear an organization's display label (PATCH /orgs/v1/:org_id). Owner-only + step-up gated. Pass `display_name: null` (or `""`) to clear. Returns the updated `org_id`, `display_name`, `tier`, `lease_started_at`, and `lease_expires_at`. Params: `org_id`, `display_name`.

Rename a project (PATCH /projects/v1/:id) — fix an auto-generated name. Authorization is org-membership based (admin+ on the owning org, or a project:write grant) and authorize-before-reveal: an unauthorized or guessed id returns the same 403 as a real-but-unauthorized project, never a not-found oracle. Uses the wallet's SIWX auth (not a project service key), so it works even if the project isn't in the local key store. The server validates the name (non-empty, ≤ 200 chars, no control characters).

Extend a contained branch project's TTL.

Request free testnet USDC from the Run402 faucet (Base Sepolia). Rate limit: 1 per IP per 24h. Returns 0.25 USDC — enough for 2 prototype databases.

Send a passwordless login email (magic link) to a project user. Auto-creates the user on first verification. Rate limited per email (5/hr) and per project (by tier).

Query or mutate data via the PostgREST REST API. Supports GET/POST/PATCH/DELETE with query params.

Plan or confirm a project snapshot restore. Omit confirm for the loss statement and confirm token; pass confirm to execute the atomic restore.

Revoke a per-project capability grant by id. Params: `project_id`, `grant_id`. Requires you to be an owner of the project's org.

Generate a fresh HMAC signing secret for the operator's webhook endpoint. Returned EXACTLY once. Previous secret remains valid for 24h. Requires operator_passkey assurance.

Execute SQL (DDL or queries) against a provisioned project. Returns results as a markdown table.

Generate a role-table migration + requireRole gate snippet + first-operator bootstrap for Run402 function role gates. Offline and deterministic (no project or network). Inputs: table, user_col, role_col, roles[], cache_ttl.

Send an email. Two modes: template (project_invite, magic_link, notification) or raw HTML (subject + html). Optional from_name for display name. Single recipient only. Pass mailbox to target a slug/id; otherwise the configured default_outbound_mailbox_id is used. Result echoes mailbox_id and from_address when the gateway provides them.

Send a message to the Run402 developers. Requires an active tier.

Liveness check for the Run402 SERVICE — not your organization. For your organization status (allowance, tier, projects), use `status`. Reads public GET /health with per-dependency check results. No auth required.

Reports on the Run402 SERVICE (availability, capabilities, operator, deployment) — not your organization. For your organization status (allowance, tier, projects), use `status`. Reads public GET /status. No auth, no allowance required.

Register agent contact info (name, email, webhook). New or changed emails start operator email reply verification. Free with allowance auth.

Enable or disable automatic email pack repurchase when credits drop below a threshold. Requires a saved Stripe payment method.

Set the low-balance threshold (in wei) for a KMS signer. Email alerts fire when the signer's native balance drops below this threshold.

Set default_outbound_mailbox_id and/or auth_sender_mailbox_id for a project. Use list_mailboxes first to choose an explicit mailbox id; sending without a mailbox uses the configured outbound default instead of guessing.

Update operator notification preferences. Cross-wallet effects require email_verified assurance; webhook URL changes require operator_passkey assurance.

Change a member's role (owner > admin > developer > billing > viewer). Requires an active `owner` membership. Demoting the org's only active owner fails with `409 LAST_OWNER`.

Set or clear an organization's default payout wallet for tenant priced routes (PATCH /orgs/v1/:org_id/payout-wallet). Admin/owner-only + step-up gated. `wallet_address` must already be an active wallet linked to the org; pass null to clear the explicit default. Response includes recovery.status, active_wallet_count, and next_actions for PAYOUT_WALLET_REQUIRED / PAYOUT_WALLET_AMBIGUOUS.

Set or clear the optional recovery address used for auto-drain on day-90 deletion of a KMS signer.

Set a project secret (e.g. STRIPE_SECRET_KEY). Values are write-only and injected as process.env variables in functions. Setting an existing key overwrites it. Use this before deploy, then declare the key with secrets.require.

Subscribe, renew, or upgrade tier. Auto-detects action based on allowance state. Returns success or payment details if x402 payment is needed.

Change, reset, or set a user's password. Change: provide current_password + new_password. Reset (via magic link login): just new_password. Set (passwordless user): requires allow_password_set=true on project.

Email a short-lived Run402 operator passkey enrollment link to the verified contact email. Requires email_verified.

Full organization snapshot — allowance, billing balance, tier subscription, projects, and active project. Single-call overview.

Trigger a real test notification (audit row marked is_test=true). Rate-limited per wallet at 1/min. Verifies the full pipeline end-to-end.

Check current tier subscription — tier name, status, expiry, usage, and function authoring caps when returned (max timeout, memory, scheduled functions, min cron interval). Requires allowance auth.

Update a function's timeout or memory without re-deploying code. Legacy schedule mutation remains for old simple-function surfaces; new schedule/email background triggers should be declared through ReleaseSpec `triggers[]`.

Update per-mailbox settings. Currently supports footer_policy: run402_transparency or none. Prototype projects are locked to run402_transparency; attempting none surfaces the gateway's FOOTER_POLICY_TIER_REQUIRED typed error.

Update a webhook's URL and/or events. At least one field required. Events is a full replacement, not a merge.

Update metadata (description, tags, visibility, fork_allowed) of a published app version.

Validate an auth/expose manifest without applying it. This checks the authorization manifest used by manifest.json, database.expose, and apply_expose; it is not deploy-manifest validation. Optional migration_sql is reference context only and is not executed. Use deploy planning/dry-run surfaces for deploy manifest questions.

Start or resend the operator email reply challenge for the active agent contact email. Does not expose the challenge secret.

Exchange a magic link token for access_token + refresh_token. Creates the user if they don't exist. Token is single-use and expires in 15 minutes.

Verify a local run402-project-archive.v1 directory or .r402ar tar offline. Checks integrity and compatibility only; archives remain untrusted input.

Polls the CDN until a MUTABLE blob URL serves the expected SHA-256, or the timeout elapses. **For mutable URLs only** — for immutable URLs (the `immutableUrl` returned by `assets_put`), no waiting is needed; they're bound to a SHA at upload time and never previously cached. Use this after a re-upload to an existing public mutable key when an end-user-visible URL must reflect the new content before continuing. The probe is single-vantage (us-east-1). On timeout, the tool returns isError=true so an agent can branch into a fallback — typically: switch to the immutableUrl.

Resolve the caller's control-plane principal and its org memberships (GET /agent/v1/whoami). A wallet authenticates; ownership is the org. Returns the principal (id/type/displayName/createdAt), authenticator_id, and every org membership (org_id, display_name, role, status). This is the REMOTE identity — for the local wallet/profile state use `status`.