Skip to main content
RestClientRuntimeCapability (platform.rest.client) exposes RestClientRuntimeApi independently of Analytics. It reuses saved platform OpenAPI toolsets and their authentication; it is not an arbitrary HTTP proxy.

Discover and call

The caller supplies a previously approved operation and validated arguments. scope contains the trusted actor, saved workspace/toolset IDs, signal and absolute deadline. The host requires the current identity and a same-scope toolset with category API and type openapi. Discovery returns enabled operations, descriptions, argument schemas and opaque contract hashes. Calls pin endpoint, method, serialization and schema to that hash. A changed connection or contract requires rediscovery; it is not silently substituted.

Supported operations

Header/cookie parameters and unsupported serializers are rejected. Callers cannot provide headers, URLs, credential snapshots or policy overrides. Redirects are disabled. A read-only POST declaration narrows eligible operations but cannot prove the remote service has no side effects; register only trusted, approved connections.

Authorization and limits

The host checks workspace access and current connection/operation definitions before and after I/O. A revoked grant, disabled operation or changed definition discards the response. Raw HTTP failures, credentials and source content are not copied into public errors. The maximum operation budget is 30 seconds, bounded by the caller’s deadline. Input envelopes/contracts are limited to 64,000 bytes, discovery to 1,000 operations and responses to 2,500,000 bytes. Successful responses are not cached by this capability. Pagination and Dataset projection belong to the consumer. Preserve the same caller identity, signal and absolute deadline across pages. Use Analytics when presenting governed query results as Datasets, or MCP Client for existing MCP connections. Deploy matching host and SDK support before using this capability.