Skip to content
SupaCloud Docs
Select themeSelect language

`PATCH /api/organization/runners/{id}` — rename and/or re-scope an org-owned runner. Owner/admin only. A rename reuses `runners.name`; a re-scope adjusts only `allowed_workspace_ids` (clamped) + `allowed_labels` (class change forbidden). Returns the refreshed enriched runner.

PATCH
/api/organization/runners/{id}
curl --request PATCH \
  --url https://example.com/api/organization/runners/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0 \
  --header 'Content-Type: application/json' \
  --data '{ "allowed_labels": [ "example" ], "allowed_workspace_ids": [ "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0" ], "name": "example" }'

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
id
required
string format: uuid

Runner ID

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json

A tenant runner update — a rename AND/OR a re-scope. A name renames the runner; allowed_workspace_ids + allowed_labels re-scope its grant (clamped ⊆ the org’s workspaces). Class/tier/isolation are NOT settable here (class change is forbidden). An all-None body is a no-op (BadRequest).

object
allowed_labels

Re-scope the runner’s labels (defaults to [] on a scope edit).

Array<string> | null
allowed_workspace_ids

Re-scope the runner’s workspaces (clamped ⊆ the org’s own workspaces; any id outside the org is rejected). Some([]) fail-closes an edge runner (serves nothing). Provided together with allowed_labels as the re-scope unit.

Array<string> | null
name

New display name (reuses runners.name). Trimmed + length-bounded by the service.

string | null
Examplegenerated
{
  "allowed_labels": [
    "example"
  ],
  "allowed_workspace_ids": [
    "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"
  ],
  "name": "example"
}

Responses

Section titled “Responses”

200

Section titled “200”

The updated runner

Media typeapplication/json

A runner OWNED BY one org, enriched for the tenant view (#626). The registry surface (RunnerInfo, no token material) plus the grant scope/provenance the org sees and the live dispatch signals (in-flight load, cap, staleness) — the same observability the operator console shows, scoped to the org’s own fleet.

object
capabilities
required

Free-form advertised capabilities (images/labels/max_parallel/weight/…). Typed as an open string-keyed map in the spec (not Object, which strips every key) so the FE binds the advertised capability map it reads (#541).

object
key
additional properties
created_at
required
string format: date-time
drain_state
required

ADR 0046 RUNG 2 — graceful drain: active | cordoned | draining. cordoned/draining runners receive no new work but keep heartbeating and finish in-flight assignments. Always populated from the row (this type is serialize-only), so no serde default is needed.

string
id
required
string format: uuid
last_heartbeat_at
string | null format: date-time
name
required
string
registered_at
required
string format: date-time
status
required
string
allowed_labels
required
Array<string>
allowed_workspace_ids

The grant’s workspace scope (None = trusted wildcard).

Array<string> | null
class
required

The grant’s trust class (trusted | edge). Display-only for the tenant — it can NEVER be changed via the org routes (class change is forbidden).

string
in_flight
required

Open (‘assigned’/‘claimed’/‘running’) assignments this runner holds.

integer format: int64
max_parallel

The advertised concurrency cap (RUNG 3), if any.

integer | null format: int64
source
required

The grant’s provenance (admin | owner | marketplace). A marketplace runner is a rented third-party host; the FE badges it.

string
stale
required

True when the last heartbeat predates the liveness stale window.

boolean
Examplegenerated
{
  "capabilities": {
    "additionalProperty": "example"
  },
  "created_at": "2026-04-15T12:00:00Z",
  "drain_state": "example",
  "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "last_heartbeat_at": "2026-04-15T12:00:00Z",
  "name": "example",
  "registered_at": "2026-04-15T12:00:00Z",
  "status": "example",
  "allowed_labels": [
    "example"
  ],
  "allowed_workspace_ids": [
    "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"
  ],
  "class": "example",
  "in_flight": 1,
  "max_parallel": 1,
  "source": "example",
  "stale": true
}

400

Section titled “400”

Empty update or invalid name

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}

401

Section titled “401”

Authentication required

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}

403

Section titled “403”

Permission denied / not your org’s runner / workspace outside the org

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}

404

Section titled “404”

Unknown runner

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}

500

Section titled “500”

Structured server error

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}