---
title: "Create Draft Route"
method: POST
path: "/api/v1/nova/discovery/onboarding-plans/{agent_id}/drafts"
tags: ["nova"]
---

# Create Draft Route

`POST /api/v1/nova/discovery/onboarding-plans/{agent_id}/drafts`

## Request

- Base URL: `https://cp.xenovia.io` (the document declares no server; this is the origin it was published from)
- URL: `https://cp.xenovia.io/api/v1/nova/discovery/onboarding-plans/{agent_id}/drafts`
- Auth: none declared

The whole plan as it should be; the diff against the current one is
stored as a draft. Nothing changes until a person accepts it.

## Path parameters

- `agent_id` string, uuid, required

## Headers

- `Authorization` string, nullable
- `X-Request-ID` string, nullable

## Request body

- AppNovaDiscoverySchemasDraftCreate
  - `plan` AgentOnboardingPlan, required: The whole plan, as the model records it.
    - `summary` string, required
    - `intent` string, required
    - `tools_observed` ObservedTool[]
      - `name` string, required
      - `source` string, required: The evidence line or finding id this comes from.
      - `risk` 'none' | 'elevated' | 'dangerous'
    - `scope_instructions` string, required: The governed agent's purpose: what it is for, its permitted activities and boundaries.
    - `capabilities` PlannedCapability[]
      - `name` string, required: A short task label, e.g. "Check order status".
      - `description` string, nullable
      - `examples` string[]: Realistic user requests the agent should accept; the judge's anchors.
      - `sub_agent` string, nullable
      - `reason` string, nullable
      - `finding_ids` string[]
      - `evidence` string[]
    - `policies` PlannedPolicy[]
      - `template` string, required: Policy template id.
      - `parameter_values` object
      - `reason` string, required
      - `finding_ids` string[]
      - `evidence` string[]
    - `guardrails` PlannedGuardrails
      - `daily_token_budget` integer, nullable
      - `per_request_cost_cap_usd` number, nullable
      - `output_token_cap` integer, nullable
    - `agent` PlannedAgent, required: The governed agent the plan reuses or creates.
      - `action` 'reuse' | 'create', required
      - `agent_id` string, uuid, nullable
      - `name` string, nullable
      - `provider_id` string, uuid, nullable
    - `coverage` PlannedCoverage, required
      - `scan_truncated` boolean
      - `confidence` 'low' | 'medium' | 'high', required
      - `open_questions` string[]
    - `rollout` 'monitor' | 'enforce'
    - `provider_id` string, uuid, nullable
    - `custom_policies` PlannedCustomPolicy[]
      - `name` string, required
      - `summary` string, required
      - `stage` 'request' | 'response' | 'model_request' | 'model_response' | 'tool_call' | 'tool_result', required
      - `category` string
      - `rego` string, required
      - `tests` PolicyTestInput[]
        - `name` string, required
        - `input` object, required
        - `expect` 'allow' | 'block' | 'redact' | 'escalate', required
      - `reason` string, nullable
      - `finding_ids` string[]
      - `evidence` string[]
    - `checks` PlannedCheck[]
      - `name` string, required
      - `kind` 'scope' | 'custom' | 'memory_write' | 'context_summary' | 'doing_more_than_asked' | 'off_purpose' | 'customer_reply' | 'wrong_instruction' | 'unfair_decision' | 'deception', required
      - `prompt` string, nullable
      - `stages` string[], required
      - `action` 'allow' | 'block' | 'redact' | 'escalate'
      - `reason` string, nullable
      - `finding_ids` string[]
      - `evidence` string[]
    - `alert_rules` PlannedAlertRule[]
      - `name` string, required
      - `trigger` 'policy_block' | 'policy_redact' | 'policy_escalate' | 'guardrail_escalate' | 'guardrail_block' | 'high_latency' | 'high_intent_score' | 'run_error' | 'fallback_served' | 'fallbacks_exhausted' | 'turn_blocked' | 'turn_escalated' | 'turn_error' | 'compliance_check_failing', required
      - `severity` 'info' | 'warning' | 'critical'
      - `channels` string[]
      - `threshold` number, nullable
      - `reason` string, nullable
      - `finding_ids` string[]
    - `open_questions` string[]
    - `code_changes` PlannedCodeChange[]
      - `file` string, required
      - `description` string, required
    - `hosted_tools` PlannedHostedTools: The provider-hosted tools the agent may use; its mode follows the plan's rollout.
      - `families` string[]
      - `mcp_servers` PlannedMcpServer[]
        - `label` string, required
        - `url` string, required
        - `tools` string[]
        - `reason` string, nullable
        - `evidence` string[]
      - `reason` string, nullable
      - `evidence` string[]
    - `linked_agents` PlannedLinkedAgent[]
      - `name` string, required
      - `discovered_agent_id` string, uuid, nullable
      - `agent_id` string, uuid, nullable
      - `reason` string, nullable
      - `evidence` string[]
    - `fallbacks` PlannedFallback[]
      - `provider_id` string, uuid, required
      - `reason` string, nullable
    - `neon_protections` PlannedNeonProtection[]
      - `target` string, required
      - `action` 'enforce' | 'monitor' | 'off', required
      - `reason` string, nullable
    - `compliance` PlannedCompliance: The agent's risk tier and the data it handles.
      - `risk_tier` 'minimal' | 'limited' | 'high', nullable
      - `data_classes` string[]
      - `reason` string, nullable
  - `summary` string

## Response `201`

Successful Response

- AppNovaDiscoverySchemasDraftRead
  - `id` string, uuid, required
  - `agent_id` string, uuid, required
  - `base_revision` string, required
  - `summary` string, required
  - `status` 'open' | 'accepted' | 'partially_accepted' | 'discarded' | 'superseded', required
  - `diff` DraftChange[], required
    - `path` string, required
    - `op` 'add' | 'remove' | 'change', required
    - `before` unknown
    - `after` unknown
    - `label` string, required
  - `created_by` DraftAuthor, required
    - `type` 'nova' | 'user', required
    - `id` string, nullable, required
    - `name` string, nullable, required
  - `created_at` string, date-time, required
  - `decided_at` string, date-time, nullable
  - `accepted_paths` string[], nullable

## Other responses

- `422`: Validation Error

## Changes

- **2026-10-26** `3e25bef24f8f`: 1 warning, 14 info
  - removed the request property `plan/capabilities/items/agent_role`
  - added the new optional request property `plan/alert_rules/items/finding_ids`
  - added the new optional request property `plan/alert_rules/items/reason`
  - added the new optional request property `plan/capabilities/items/finding_ids`
  - …11 more
- **2026-10-08** `1882866431ad`: 1 info
  - added the new optional request property `plan/capabilities`
- **2026-10-04** `b475b750a0b7`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/xenovia/apis/controlplane/changes/api/v1/nova/discovery/onboarding-plans/:agent_id/drafts/post.md)

---

[API](https://skmtc.dev/xenovia/apis/controlplane.md) - [All operations](https://skmtc.dev/xenovia/apis/controlplane/llms.txt) - [OpenAPI document](https://skmtc.dev/xenovia/apis/controlplane/revisions/3e25bef24f8f?raw)