API reference

Henry

The agent runtime: run tasks through Foundry with live activity, approvals, follow-up commands and signed receipts.

Operations: 8
Base path: https://os.one.ml/api/v1/henry
Scopes: henry:read henry:write
API keys: 1 need a signed-in session · 7 not yet tested
SDK: genesis.call('henry_getConfig', …) · helpers under genesis.henry
CLI: genesis henry
MCP: 7 tools; the other 1 through genesis_call

Operations

Operation	Endpoint	API key
Read credential status and the real Foundry model catalog	GET`/config`	—
Validate and encrypt an organization Foundry key in Genesis KMS	PUT`/credential`	Signed-in session
Read the current standalone Henry public receipt verification key	GET`/receipts/verification-keys/current`	—
List runs belonging to the signed organization	GET`/runs`	—
Execute a Henry task through Foundry	POST`/runs`	—
Read live activity, approvals, messages and signed receipts	GET`/runs/{run_id}`	—
Approve or reject a specific public HTTPS read	POST`/runs/{run_id}/approvals/{approval_id}`	—
Pause, resume, cancel or send follow-up input	POST`/runs/{run_id}/command`	—

Config

Read credential status and the real Foundry model catalog

GET/v1/henry/config

henry:readhenry_getConfig

Responses

200Actual Henry result
Response fields
- credential_configuredbooleanrequired
- modelsobject[]required
- models[].[].idstringrequired
400Invalid request
401Verified gateway identity required
403Henry scope required
404Resource does not belong to the signed organization
409State changed, action attempted or proof already bound
502Runtime unavailable
503Storage or custody unavailable
4xx 5xxThe error envelope.

curl "https://os.one.ml/api/v1/henry/config" \
  -H "Authorization: Bearer $GENESIS_API_KEY"

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const result = await genesis.call('henry_getConfig')

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "henry_getConfig",
    "arguments": {}
  }
}

Credential

Validate and encrypt an organization Foundry key in Genesis KMS

PUT/v1/henry/credential

henry:writeSigned-in sessionhenry_putCredential

Request body application/json

api_keystringrequired
max length 4096

Responses

200Actual Henry result
Response fields
- credential_configuredbooleanrequired
- modelsobject[]required
- models[].[].idstringrequired
400Invalid request
401Verified gateway identity required
403Henry scope required
404Resource does not belong to the signed organization
409State changed, action attempted or proof already bound
502Runtime unavailable
503Storage or custody unavailable
4xx 5xxThe error envelope.

curl -X PUT "https://os.one.ml/api/v1/henry/credential" \
  -H "Authorization: Bearer $GENESIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "api_key": "string"
  }'

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const result = await genesis.call('henry_putCredential', {
  body: {
    api_key: 'string',
  },
})

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "henry_putCredential",
    "arguments": {
      "body": {
        "api_key": "string"
      }
    }
  }
}

Receipts

Read the current standalone Henry public receipt verification key

GET/v1/henry/receipts/verification-keys/current

henry:readhenry_getReceiptVerificationKey

Requires the existing verified gateway identity and henry:read or henry:write scope. Returns only the current standalone Henry public signer, with no execution, credential, grant or funding mutation. Obtain through the trusted configured gateway and pin with independent deployment/signer provenance; never replace a trusted anchor from receipt content. Does not identify a separate Fleets signer or establish funding settlement.

Responses

200Current standalone Henry public receipt verification key
Response fields
- keyIdstringrequired
  Current standalone Henry signer identifier. min length 1 · max length 256 · pattern ^[^\u0000-\u001f\u007f]+$
- publicKeyBase64stringrequired
  Canonical standard base64 encoding of the raw 32-byte Ed25519 public key; never a private key or seed. min length 44 · max length 44 · pattern ^[A-Za-z0-9+/]{42}[AEIMQUYcgkosw048]=$
401Verified gateway identity required
403Henry read or write scope required
503Worker verification key unavailable; fixed error without private material
4xx 5xxThe error envelope.

curl "https://os.one.ml/api/v1/henry/receipts/verification-keys/current" \
  -H "Authorization: Bearer $GENESIS_API_KEY"

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const result = await genesis.call('henry_getReceiptVerificationKey')

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "genesis_call",
    "arguments": {
      "operation": "henry_getReceiptVerificationKey",
      "arguments": {}
    }
  }
}

Runs

List runs belonging to the signed organization

GET/v1/henry/runs

henry:readhenry_listRuns

Parameters

page_tokenquery · string

Responses

200Actual Henry result
Response fields
- runsobject[]required
- runs[].[].idstringrequired
- runs[].[].taskstringrequired
- runs[].[].modelstringrequired
- runs[].[].status"ready" | "running" | "acting" | "paused" | "awaiting_approval" | "completed" | "cancelled" | "failed" | "waiting_input"required
- runs[].[].created_atstringrequired
- runs[].[].updated_atstringrequired
- runs[].[].activityobject[]required
- runs[].[].activity[].[].idstringrequired
- runs[].[].activity[].[].atstringrequired
- runs[].[].activity[].[].typestringrequired
- runs[].[].activity[].[].detailstringrequired
- runs[].[].approvalsobject[]required
- runs[].[].approvals[].[].idstringrequired
- runs[].[].approvals[].[].actionstringrequired
- runs[].[].approvals[].[].urlstringrequired
- runs[].[].approvals[].[].statusstringrequired
- runs[].[].approvals[].[].requested_atstringrequired
- runs[].[].phasesobject[]required
- runs[].[].phases[].[].idstring
- runs[].[].phases[].[].codeinteger
- runs[].[].phases[].[].receiptobject
- runs[].[].phases[].[].usageobject | null
- runs[].[].messagesobject[]required
- runs[].[].messages[].[].rolestringrequired
- runs[].[].messages[].[].contentstring | null
- next_page_tokenstring | null
400Invalid request
401Verified gateway identity required
403Henry scope required
404Resource does not belong to the signed organization
409State changed, action attempted or proof already bound
502Runtime unavailable
503Storage or custody unavailable
4xx 5xxThe error envelope.

curl "https://os.one.ml/api/v1/henry/runs" \
  -H "Authorization: Bearer $GENESIS_API_KEY"

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const result = await genesis.call('henry_listRuns')

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "henry_listRuns",
    "arguments": {}
  }
}

Execute a Henry task through Foundry

POST/v1/henry/runs

henry:writehenry_createRun

The HTTP request stays active while the real worker executes. Poll the run_id or list runs concurrently for activity. At most six model phases per run. No background execution depends on Cloud Run idle CPU.

Request body application/json

taskstringrequired
max length 16000
modelstringrequired
max length 200
run_idstring (uuid)
Optional caller-generated UUIDv4 for polling while this request executes.

Responses

200Actual Henry result
Response fields
- idstringrequired
- taskstringrequired
- modelstringrequired
- status"ready" | "running" | "acting" | "paused" | "awaiting_approval" | "completed" | "cancelled" | "failed" | "waiting_input"required
- created_atstringrequired
- updated_atstringrequired
- activityobject[]required
- activity[].[].idstringrequired
- activity[].[].atstringrequired
- activity[].[].typestringrequired
- activity[].[].detailstringrequired
- approvalsobject[]required
- approvals[].[].idstringrequired
- approvals[].[].actionstringrequired
- approvals[].[].urlstringrequired
- approvals[].[].statusstringrequired
- approvals[].[].requested_atstringrequired
- phasesobject[]required
- phases[].[].idstring
- phases[].[].codeinteger
- phases[].[].receiptobject
- phases[].[].usageobject | null
- messagesobject[]required
- messages[].[].rolestringrequired
- messages[].[].contentstring | null
400Invalid request
401Verified gateway identity required
403Henry scope required
404Resource does not belong to the signed organization
409State changed, action attempted or proof already bound
502Runtime unavailable
503Storage or custody unavailable
4xx 5xxThe error envelope.

curl -X POST "https://os.one.ml/api/v1/henry/runs" \
  -H "Authorization: Bearer $GENESIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "task": "string",
    "model": "string"
  }'

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const result = await genesis.call('henry_createRun', {
  body: {
    task: 'string',
    model: 'string',
  },
})

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "henry_createRun",
    "arguments": {
      "body": {
        "task": "string",
        "model": "string"
      }
    }
  }
}

Read live activity, approvals, messages and signed receipts

GET/v1/henry/runs/{run_id}

henry:readhenry_getRun

Parameters

run_idpath · stringrequired

Responses

200Actual Henry result
Response fields
- idstringrequired
- taskstringrequired
- modelstringrequired
- status"ready" | "running" | "acting" | "paused" | "awaiting_approval" | "completed" | "cancelled" | "failed" | "waiting_input"required
- created_atstringrequired
- updated_atstringrequired
- activityobject[]required
- activity[].[].idstringrequired
- activity[].[].atstringrequired
- activity[].[].typestringrequired
- activity[].[].detailstringrequired
- approvalsobject[]required
- approvals[].[].idstringrequired
- approvals[].[].actionstringrequired
- approvals[].[].urlstringrequired
- approvals[].[].statusstringrequired
- approvals[].[].requested_atstringrequired
- phasesobject[]required
- phases[].[].idstring
- phases[].[].codeinteger
- phases[].[].receiptobject
- phases[].[].usageobject | null
- messagesobject[]required
- messages[].[].rolestringrequired
- messages[].[].contentstring | null
400Invalid request
401Verified gateway identity required
403Henry scope required
404Resource does not belong to the signed organization
409State changed, action attempted or proof already bound
502Runtime unavailable
503Storage or custody unavailable
4xx 5xxThe error envelope.

curl "https://os.one.ml/api/v1/henry/runs/$RUN_ID" \
  -H "Authorization: Bearer $GENESIS_API_KEY"

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const result = await genesis.call('henry_getRun', {
  run_id: '<run_id>',
})

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "henry_getRun",
    "arguments": {
      "run_id": "<run_id>"
    }
  }
}

Approvals

Approve or reject a specific public HTTPS read

POST/v1/henry/runs/{run_id}/approvals/{approval_id}

henry:writehenry_decideApproval

Parameters

run_idpath · stringrequired
approval_idpath · stringrequired

Request body application/json

decision"approve" | "reject"required

Responses

200Actual Henry result
Response fields
- idstringrequired
- taskstringrequired
- modelstringrequired
- status"ready" | "running" | "acting" | "paused" | "awaiting_approval" | "completed" | "cancelled" | "failed" | "waiting_input"required
- created_atstringrequired
- updated_atstringrequired
- activityobject[]required
- activity[].[].idstringrequired
- activity[].[].atstringrequired
- activity[].[].typestringrequired
- activity[].[].detailstringrequired
- approvalsobject[]required
- approvals[].[].idstringrequired
- approvals[].[].actionstringrequired
- approvals[].[].urlstringrequired
- approvals[].[].statusstringrequired
- approvals[].[].requested_atstringrequired
- phasesobject[]required
- phases[].[].idstring
- phases[].[].codeinteger
- phases[].[].receiptobject
- phases[].[].usageobject | null
- messagesobject[]required
- messages[].[].rolestringrequired
- messages[].[].contentstring | null
400Invalid request
401Verified gateway identity required
403Henry scope required
404Resource does not belong to the signed organization
409State changed, action attempted or proof already bound
502Runtime unavailable
503Storage or custody unavailable
4xx 5xxThe error envelope.

curl -X POST "https://os.one.ml/api/v1/henry/runs/$RUN_ID/approvals/$APPROVAL_ID" \
  -H "Authorization: Bearer $GENESIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "decision": "approve"
  }'

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const result = await genesis.call('henry_decideApproval', {
  run_id: '<run_id>',
  approval_id: '<approval_id>',
  body: {
    decision: 'approve',
  },
})

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "henry_decideApproval",
    "arguments": {
      "run_id": "<run_id>",
      "approval_id": "<approval_id>",
      "body": {
        "decision": "approve"
      }
    }
  }
}

Command

Pause, resume, cancel or send follow-up input

POST/v1/henry/runs/{run_id}/command

henry:writehenry_commandRun

Parameters

run_idpath · stringrequired

Request body application/json

action"pause" | "resume" | "cancel" | "input"required
textstring
max length 16000

Responses

200Actual Henry result
Response fields
- idstringrequired
- taskstringrequired
- modelstringrequired
- status"ready" | "running" | "acting" | "paused" | "awaiting_approval" | "completed" | "cancelled" | "failed" | "waiting_input"required
- created_atstringrequired
- updated_atstringrequired
- activityobject[]required
- activity[].[].idstringrequired
- activity[].[].atstringrequired
- activity[].[].typestringrequired
- activity[].[].detailstringrequired
- approvalsobject[]required
- approvals[].[].idstringrequired
- approvals[].[].actionstringrequired
- approvals[].[].urlstringrequired
- approvals[].[].statusstringrequired
- approvals[].[].requested_atstringrequired
- phasesobject[]required
- phases[].[].idstring
- phases[].[].codeinteger
- phases[].[].receiptobject
- phases[].[].usageobject | null
- messagesobject[]required
- messages[].[].rolestringrequired
- messages[].[].contentstring | null
400Invalid request
401Verified gateway identity required
403Henry scope required
404Resource does not belong to the signed organization
409State changed, action attempted or proof already bound
502Runtime unavailable
503Storage or custody unavailable
4xx 5xxThe error envelope.

curl -X POST "https://os.one.ml/api/v1/henry/runs/$RUN_ID/command" \
  -H "Authorization: Bearer $GENESIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "action": "pause"
  }'

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const result = await genesis.call('henry_commandRun', {
  run_id: '<run_id>',
  body: {
    action: 'pause',
  },
})

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "henry_commandRun",
    "arguments": {
      "run_id": "<run_id>",
      "body": {
        "action": "pause"
      }
    }
  }
}

One Superintelligence, Inc. · Built from Genesis 0.1.12 and the live gateway on 2026-10-20. Support