SDK: enterprise

The enterprise area has 31 methods on the client. Each takes one object of path, query and body arguments and an optional CallOptions, and returns a promise of the response body. A refused call rejects with OverlaneApiError (see the SDK index).

enterpriseAuditExportsCreate

Export the tamper-evident audit log as CSV with a manifest; the export is itself audited

• Request: POST on /v1/tenants/{tenantId}/enterprise/audit-exports

enterpriseAuditExportsCreate(args: { tenantId: string; body?: Record<string, unknown> }, options?: CallOptions): Promise<AuditExport>

enterpriseBackupsDrill

Snapshot, restore into a scratch target and compare record counts

• Request: POST on /v1/tenants/{tenantId}/enterprise/backups/drill

enterpriseBackupsDrill(args: { tenantId: string; body?: Record<string, unknown> }, options?: CallOptions): Promise<RestoreDrillReport>

enterpriseByokCreate

Add an inference key; the value is write-only (secrets class)

• Request: POST on /v1/tenants/{tenantId}/enterprise/byok/keys
• Needs an approval for agents: class secrets

enterpriseByokCreate(args: { tenantId: string; body: CreateByokKeyRequest }, options?: CallOptions): Promise<Record<string, unknown>>

enterpriseByokList

Inference keys by alias and status; a value is never returned

• Request: GET on /v1/tenants/{tenantId}/enterprise/byok/keys

enterpriseByokList(args: { tenantId: string }, options?: CallOptions): Promise<ByokKeyList>

enterpriseByokRevoke

Revoke a key and delete its stored value (secrets class)

• Request: DELETE on /v1/tenants/{tenantId}/enterprise/byok/keys/{keyId}
• Needs an approval for agents: class secrets

enterpriseByokRevoke(args: { tenantId: string; keyId: string }, options?: CallOptions): Promise<Record<string, unknown>>

enterpriseByokRotate

Replace a key’s value under the same alias (secrets class)

• Request: POST on /v1/tenants/{tenantId}/enterprise/byok/keys/{keyId}/rotate
• Needs an approval for agents: class secrets

enterpriseByokRotate(args: { tenantId: string; keyId: string; body: RotateByokKeyRequest }, options?: CallOptions): Promise<Record<string, unknown>>

enterpriseByokTest

Test a key against its provider

• Request: POST on /v1/tenants/{tenantId}/enterprise/byok/keys/{keyId}/test

enterpriseByokTest(args: { tenantId: string; keyId: string; body?: Record<string, unknown> }, options?: CallOptions): Promise<Record<string, unknown>>

enterpriseDataDelete

Delete the team’s, a project’s or a user’s data from every store (deletion class, every plan)

• Request: POST on /v1/tenants/{tenantId}/enterprise/data/delete
• Needs an approval for agents: class deletion

enterpriseDataDelete(args: { tenantId: string; body: DataRequest }, options?: CallOptions): Promise<DataDeletionReport>

enterpriseDataExport

Export the team’s, a project’s or a user’s data as NDJSON (every plan)

• Request: POST on /v1/tenants/{tenantId}/enterprise/data/export

enterpriseDataExport(args: { tenantId: string; body: DataRequest }, options?: CallOptions): Promise<DataExportReport>

enterpriseEntitlements

Which enterprise features the team’s plan includes

• Request: GET on /v1/tenants/{tenantId}/enterprise/entitlements

enterpriseEntitlements(args: { tenantId: string }, options?: CallOptions): Promise<EnterpriseEntitlements>

enterpriseEvidencePack

The security review evidence pack: chain state, agent action counts and controls

• Request: GET on /v1/tenants/{tenantId}/enterprise/evidence-pack

enterpriseEvidencePack(args: { tenantId: string }, options?: CallOptions): Promise<EvidencePack>

enterpriseIdentityGet

Single sign-on and directory sync status

• Request: GET on /v1/tenants/{tenantId}/enterprise/identity

enterpriseIdentityGet(args: { tenantId: string }, options?: CallOptions): Promise<EnterpriseIdentityStatus>

enterpriseIdentityMappingsGet

Identity provider groups mapped to roles, and the cap

• Request: GET on /v1/tenants/{tenantId}/enterprise/identity/group-mappings

enterpriseIdentityMappingsGet(args: { tenantId: string }, options?: CallOptions): Promise<GroupMappingSet>

enterpriseIdentityMappingsPut

Replace the group to role mappings; a role above the cap is refused (policy class)

• Request: PUT on /v1/tenants/{tenantId}/enterprise/identity/group-mappings
• Needs an approval for agents: class policy_change

enterpriseIdentityMappingsPut(args: { tenantId: string; body: PutGroupMappingsRequest }, options?: CallOptions): Promise<GroupMappingSet>

enterpriseIdentityPortalLink

A short-lived link to the identity provider’s hosted setup portal

• Request: POST on /v1/tenants/{tenantId}/enterprise/identity/portal-link

enterpriseIdentityPortalLink(args: { tenantId: string; body: PortalLinkRequest }, options?: CallOptions): Promise<PortalLink>

enterpriseIdentitySync

Sync the directory now: apply group roles and deprovision removed people

• Request: POST on /v1/tenants/{tenantId}/enterprise/identity/sync

enterpriseIdentitySync(args: { tenantId: string; body?: Record<string, unknown> }, options?: CallOptions): Promise<DirectorySyncReport>

enterpriseIdentityTest

Test the single sign-on or directory connection

• Request: POST on /v1/tenants/{tenantId}/enterprise/identity/test

enterpriseIdentityTest(args: { tenantId: string; body: PortalLinkRequest }, options?: CallOptions): Promise<TestConnectionResult>

enterpriseMcpAllowlistGet

The MCP server allowlist for the team’s agents

• Request: GET on /v1/tenants/{tenantId}/enterprise/mcp-allowlist

enterpriseMcpAllowlistGet(args: { tenantId: string }, options?: CallOptions): Promise<McpAllowlist>

enterpriseMcpAllowlistPut

Set the MCP server allowlist (policy class)

• Request: PUT on /v1/tenants/{tenantId}/enterprise/mcp-allowlist
• Needs an approval for agents: class policy_change

enterpriseMcpAllowlistPut(args: { tenantId: string; body: PutMcpAllowlistRequest }, options?: CallOptions): Promise<McpAllowlist>

enterpriseResidencyGet

The pinned data region and the supported regions

• Request: GET on /v1/tenants/{tenantId}/enterprise/residency

enterpriseResidencyGet(args: { tenantId: string }, options?: CallOptions): Promise<ResidencyPolicy>

enterpriseResidencyMigrate

Move a pinned team to another region as an audited migration (policy class)

• Request: POST on /v1/tenants/{tenantId}/enterprise/residency/migrations
• Needs an approval for agents: class policy_change

enterpriseResidencyMigrate(args: { tenantId: string; body: RegionMigrationRequest }, options?: CallOptions): Promise<ResidencyPolicy>

enterpriseResidencyPut

Pin the team to a region; a region the stores cannot hold is refused with the supported list

• Request: PUT on /v1/tenants/{tenantId}/enterprise/residency

enterpriseResidencyPut(args: { tenantId: string; body: PinRegionRequest }, options?: CallOptions): Promise<ResidencyPolicy>

enterpriseResidencyStores

Where each store holds the team’s data

• Request: GET on /v1/tenants/{tenantId}/enterprise/residency/stores

enterpriseResidencyStores(args: { tenantId: string }, options?: CallOptions): Promise<StoreLocationReport>

enterpriseRetentionGet

Retention rules per data class

• Request: GET on /v1/tenants/{tenantId}/enterprise/retention

enterpriseRetentionGet(args: { tenantId: string }, options?: CallOptions): Promise<EnterpriseRetentionPolicy>

enterpriseRetentionPurge

Run the retention purge now and return the report (deletion class)

• Request: POST on /v1/tenants/{tenantId}/enterprise/retention/purge
• Needs an approval for agents: class deletion

enterpriseRetentionPurge(args: { tenantId: string; body?: Record<string, unknown> }, options?: CallOptions): Promise<PurgeReport>

enterpriseRetentionPut

Replace the retention rules (policy class)

• Request: PUT on /v1/tenants/{tenantId}/enterprise/retention
• Needs an approval for agents: class policy_change

enterpriseRetentionPut(args: { tenantId: string; body: PutRetentionPolicyRequest }, options?: CallOptions): Promise<EnterpriseRetentionPolicy>

enterpriseRetentionReports

Purge reports, newest first

• Request: GET on /v1/tenants/{tenantId}/enterprise/retention/reports

enterpriseRetentionReports(args: { tenantId: string }, options?: CallOptions): Promise<PurgeReportList>

enterpriseStreamsCreate

Add a SIEM stream target; the signing secret is write-only (secrets class)

• Request: POST on /v1/tenants/{tenantId}/enterprise/audit-streams
• Needs an approval for agents: class secrets

enterpriseStreamsCreate(args: { tenantId: string; body: CreateAuditStreamTargetRequest }, options?: CallOptions): Promise<Record<string, unknown>>

enterpriseStreamsDelete

Remove a SIEM stream target

• Request: DELETE on /v1/tenants/{tenantId}/enterprise/audit-streams/{auditStreamId}

enterpriseStreamsDelete(args: { tenantId: string; auditStreamId: string }, options?: CallOptions): Promise<Record<string, unknown>>

enterpriseStreamsList

SIEM stream targets

• Request: GET on /v1/tenants/{tenantId}/enterprise/audit-streams

enterpriseStreamsList(args: { tenantId: string }, options?: CallOptions): Promise<AuditStreamTargetList>

enterpriseStreamsRun

Send the rows after the target’s cursor now

• Request: POST on /v1/tenants/{tenantId}/enterprise/audit-streams/{auditStreamId}/run

enterpriseStreamsRun(args: { tenantId: string; auditStreamId: string; body?: Record<string, unknown> }, options?: CallOptions): Promise<StreamRunReport>