---
title: "List actions"
method: GET
path: "/api/v1/org-actions"
tags: ["authed"]
---

# List actions

`GET /api/v1/org-actions`

## Request

- Base URL: `https://api.teaflask.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.teaflask.com/api/v1/org-actions`
- Auth: none declared

The catalog's actions — the endpoints of the organization's own API
its agents may call — most recently changed first, archived ones
included (check status), each as a summary without its schemas; read
one in full with get_org_action. A full page means more may exist.

## Query parameters

- `before_updated_at` string, date-time, nullable: With before_id: the last row of the previous page's updated_at, to read the next page.
- `before_id` string, uuid, nullable: With the sort cursor: the last row of the previous page's id.
- `limit` integer: The most actions to return.

## Response `200`

Successful Response

- OrgActionSummaryResponse[]
  - `id` string, uuid, required: The action's id.
  - `slug` string, required: The action's unique short name; an agent's configuration grants actions by it, like "cancel-subscription".
  - `title` string, required: A short human-readable name.
  - `description` string, required: What an agent reads when deciding whether to call the action.
  - `method` 'GET' | 'HEAD' | 'POST' | 'PUT' | 'PATCH' | 'DELETE', required: The catalog's method whitelist: an action can only ever speak these.
  - `path_template` string, required: The endpoint path on the organization's own API, with {placeholder} segments for path parameters, like "/api/pets/{pet_id}/".
  - `policy` 'allow' | 'deny' | 'ask', required
  - `effect` 'read_only' | 'idempotent' | 'destructive', required: What calling the action does to the world — an annotation, never a policy. It feeds the policy default for rows registered without one and the approval gate's prompt tone; an explicit policy always wins, and a mutating method never defaults above ask whatever the annotation claims.
  - `status` 'active' | 'archived', required
  - `source` 'manual' | 'scan' | 'inferred', required
  - `source_ref` OrgActionSourceOrigin, required
    - `origin` 'inference' | 'generated' | 'graphql' | 'uploaded', required: Which kind of evidence a source_ref carries. Spec refs (the scan's extractions) are the origin-less default and never write the key — only non-spec evidence names itself.
  - `graphql` GraphQLOperationIdentity, required: A GraphQL operation's identity without its document: what recorded agent work names the operation by.
    - `operation_name` string, required: The operation's GraphQL name, like "GetSubscription".
    - `operation_type` 'query' | 'mutation', required: The operation kinds an action can carry; a query defaults like a GET, a mutation like any other write. Subscriptions are refused.
  - `last_verified_at` string, date-time, nullable, required: When the action was last confirmed to match its spec, by a scan or by approving a scan's proposed change; null until then.
  - `created_at` string, date-time, required: When the action was registered.
  - `updated_at` string, date-time, required: When the action last changed.

## Other responses

- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not found
- `405`: Method not allowed
- `422`: Validation error
- `500`: Internal server error

---

[API](https://skmtc.dev/teaflask/apis/teaflask-api.md) - [All operations](https://skmtc.dev/teaflask/apis/teaflask-api/llms.txt) - [OpenAPI document](https://skmtc.dev/teaflask/apis/teaflask-api/revisions/d23e9286b847?raw)