script

update script

Changed on

Deploys a new version of the script at path, which must already hold one. The body's path is the destination: the same path leaves the script where it is, a different one moves it there and archives the old path.

post/w/{workspace}/scripts/update/{path}

Request

  • Base URL: /api (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /api/w/{workspace}/scripts/update/{path}
  • Auth: one of:
    • HTTP bearer
    • API key in cookie token

Path parameters

workspacestring required
pathstring required

Request body

pathstring required
parent_hashstring

The hash of the version this one supersedes: deploying with it archives that version and chains the new one onto its history, and a path differing from the superseded version's moves the script there.

auto_parentboolean

When true, the backend resolves the parent to the current deployed head for this path within the transaction (ignoring parent_hash), instead of failing with a "lineage must be linear" error when the supplied parent_hash is stale.

summarystring required
descriptionstring
contentstring required
schemaobject

JSON Schema of the arguments of main, which is what a run form and an MCP tool offer. Omitted (or {}), it is inferred from content for TypeScript, Python, Go, Bash, PowerShell, SQL, GraphQL and Ansible scripts. For other languages, or code that does not parse, a new script gets none. A new version of an existing script also keeps what the previous version's schema says about each argument, or that whole schema when nothing can be inferred. A dbt script always takes its schema from its descriptor, whatever is sent.

is_templateboolean
lockstring
language'python3' | 'deno' | 'go' | 'bash' | 'powershell' | 'postgresql' | 'mysql' | 'bigquery' | 'snowflake' | 'mssql' | 'oracledb' | 'graphql' | 'nativets' | 'bun' | 'php' | 'rust' | 'ansible' | 'csharp' | 'nu' | 'java' | 'ruby' | 'rlang' | 'duckdb' | 'bunnative' | 'dbt' required
kind'script' | 'failure' | 'trigger' | 'command' | 'approval' | 'preprocessor'
tagstring
envsstring[]
concurrent_limitinteger
concurrency_time_window_sinteger
cache_ttlnumber
cache_ignore_s3_pathboolean
dedicated_workerboolean
ws_error_handler_mutedboolean
priorityinteger
restart_unless_cancelledboolean
timeoutinteger
delete_after_secsinteger

If set, delete the job's args, result and logs after this many seconds following job completion

deployment_messagestring
concurrency_keystring
debounce_keystring
debounce_delay_sinteger
debounce_args_to_accumulatestring[]
max_total_debouncing_timeinteger
max_total_debounces_amountinteger
visible_to_runner_onlyboolean
auto_kindstring
codebasestring
has_preprocessorboolean
on_behalf_of_emailstring
on_behalf_ofstring

Authorization identity to run as: u/{username}, g/{group}, or a bare email when the username is itself email-shaped. Supply this or on_behalf_of_email; when only the address is given it is resolved to the account it names, and an address naming nobody is rejected. A pair that disagrees is rejected.

preserve_on_behalf_ofboolean

When true and the caller is a member of the 'wm_deployers' group, preserves the original on_behalf_of_email / on_behalf_of pair instead of overwriting it with the caller's own identity.

modulesobject nullable

Additional script modules keyed by relative file path

labelsstring[]
job_token_scopesstring[] nullable

Scopes the token of every job of this runnable is restricted to (domain:action[:resource], e.g. oidc:write). Jobs it starts, flow steps and AI agent tools inherit the restriction. Unset, the job token carries the full permissions of the identity the job runs as; an empty list leaves it no API access beyond its own job. Omitting the field keeps the deployed value; null clears it.

skip_draft_deletionboolean

When true (set by the CLI / git sync), deploying this script does not delete an existing user draft at the same path.

Response

new script version created

Changes