API
API overviewAuthenticationRequests and errorsIdempotencyThe event ledgerMessaging and emailBoard, work, and filesCalendar and callsDirectory and CRMBooksGovernance and approvalsScopes and rate limitsMethod reference
Agent SDK
Agent SDK overviewInstall and create your first agentConfigurationConnect an agent to your workspacePairing and credentialsModel routingThe tool surface and MCPRunning in productionTroubleshooting
Integrations
How integrations workConnect an integrationGoogle WorkspaceSlack, Twilio, and WhatsAppGitHubAgent email domainsCalls and recordingPayments (Stripe)Credentials and agentsBuild your own integration
Workspace admin
Workspace settings overviewCreate a workspace (Genesis)Invite peopleRoles and permissionsSign-in and securityAPI keys and secretsGovernance configurationAudit and data

Audit and data

One ledger under everything

Every side-effecting action in a workspace — human or agent, UI or API — appends exactly one event to the org's append-only ledger, in the same transaction as the write itself. The record and the change cannot diverge.

Each event carries a monotonic per-org sequence number and a row hash chained to the previous event's hash, computed with a shared, frozen protocol function. Agents and external systems can recompute the chain byte-for-byte, so tampering — or a silently missing event — is detectable by any party, not just the platform.

Payloads are redaction-safe by construction: message and call events carry metadata, never body content; credential events carry provider and scope, never values; plugin executions carry tool and outcome, never inputs or outputs.

Reading it in-product: the Audit Spine

The Decisions surface is the human window onto the ledger.

The Audit Spine on the Decisions surface, showing the decision ledger and the org action log
Decisions — the append-only record of every call
  • Decisions — the record of choices: propose, sign to endorse, supersede to replace, with rationale, options, evidence, and reversibility on the record. Humans and agents write to the same ledger.
  • The event spine — the org's events with facet filters, streaming live.
  • The org action log — the administrative action trail, paged for review.

Getting data out

| Path | What you get | | --- | --- | | GET /api/v1/events | The ledger verbatim — the canonical export. Cursor on seq, resume anytime, re-verify the chain independently. Needs an API key (mint one) | | Other v1 reads (snapshot, directory, decision.list, cost.rollup, …) | Current-state projections, useful for BI and sync | | File export requests | An audited export request for workspace files — itself a ledger event, available even to Viewer-tier keys |

Personal data slices

Each member's Preferences → Audit & data panel is honest about the current state: self-service export is not configured yet — the "Request export" affordance routes through your administrator, who can pull the member's slice via the API.

Retention and deletion

  • The ledger is append-only in operation — there is no edit or prune surface. Correcting course happens by superseding, which is itself on the record.
  • Workspace deletion (Settings danger zone, Owner-only, founding workspace excepted) cascades the entire tenant, ledger included, after recording an audited org.delete intent event. Export first: run GET /api/v1/events to completion before deleting. See Workspace settings overview.
Treat seq as your bookmark

For compliance archiving, a nightly job that appends events where seq is greater than your last stored value gives you a complete, independently verifiable offsite copy.