List toolboxes visible to the caller
Lists the toolboxes the caller owns plus every toolbox shared with them, each with the caller's access_level, plus two kinds of automatic toolbox (global:{user_id}, and one connection:{connection_id} per active connection the caller can use) appended to the last page only (the one whose next_cursor is null), always with access_level: "owner". So the order across the whole listing is stored toolboxes first, automatic ones after. No organization permission, not even toolbox:view or toolbox:manage, widens this beyond what the caller owns or was granted, and a private toolbox never appears for anyone but its owner and its grantees. ?q= matches the name as a substring. ?type=stored drops the automatic rows, which suits a toolbox picker. ?connector_slug= narrows to the toolboxes holding a tool from any of the named connectors; take the slugs worth passing from GET /toolbox/connector, not from the whole catalog. The three filters combine by AND. Cursor-paginated.
Request
- Base URL: https://api.elaichi.ai
- URL: https://api.elaichi.ai/toolbox
- Auth: HTTP bearer
Query parameters
Page size. Defaults to 50. Values above 200 are silently clamped to 200 rather than rejected; a value below 1, or a non-integer, is a 400. Ignored by the endpoints documented as unpaginated.
Opaque cursor — pass the next_cursor from a previous response. Ignored by unpaginated endpoints.
Substring match (case-insensitive) on the toolbox name. LIKE wildcards are matched literally. Max 200 characters.
stored restricts the listing to real, shareable toolboxes, omitting the automatic global:…/connection:… rows; automatic is the mirror, paging the automatic rows alone. Unset returns both, stored first. Any other value is a 400.
Filter to the toolboxes holding at least one tool from ANY of these connectors — a union, never an intersection. Repeat the parameter or send one comma-separated value; both are the same filter, spelled exactly as GET /connection?connector_slug= is. At most 25 distinct values per request; more is a 400, never a silent truncation. A dynamic row is matched on the connectors it really spans: a connection:{id} row on its own connector, the global:{user_id} row when any of the caller's active usable connections matches. GET /toolbox/connector is where the values come from.
Headers
Target organization (org_…). Required for cookie/session auth on org-scoped routes; optional for API tokens, which carry their organization, and rejected when it names a different one.
Response
OK
Changes
No recorded changes to this operation across all 1 revision of this API.