---
title: "Tools API"
description: "The registry of what an agent is allowed to call."
label: "Tools"
generated: "the API catalogue in apps/control-plane/src/routes/developer.ts"
---


A tool carries its own destination allowlist, risk rating and dangerous flag. Nothing is callable because it exists; an agent must be explicitly authorized for each tool.

## Endpoints

| | Endpoint | Permission | Notes |
| --- | --- | --- | --- |
| `GET` | `/v1/developer/code-assist` | _none_ | — |
| `POST` | `/v1/developer/code-assist/rewrite` | `tool:update` | — |
| `GET` | `/v1/tools` | `tool:read` | — |
| `POST` | `/v1/tools` | `tool:create` | accepts `Idempotency-Key` |
| `POST` | `/v1/tools/{toolId}/disable` | `tool:disable` | — |
| `POST` | `/v1/tools/{toolId}/agents` | `tool:update` | — |

## What each endpoint does

### `GET /v1/developer/code-assist`

Whether Veefore-hosted AI code assist is enabled, and which models it offers.

Requires no console permission.

### `POST /v1/developer/code-assist/rewrite`

Propose a guard() change for tools the automatic rewrite could not change.

Requires `tool:update`.

Request body:

```json
{
  "model": "string",
  "language": "typescript | javascript | python",
  "file": "string",
  "source": "string (secrets replaced with placeholders)",
  "tools": "{ key, line, reason }[]"
}
```

### `GET /v1/tools`

List tools.

Requires `tool:read`.

### `POST /v1/tools`

Register a tool.

Requires `tool:create`.

### `POST /v1/tools/{toolId}/disable`

Disable a tool for every agent.

Requires `tool:disable`.

Request body:

```json
{
  "reason": "string"
}
```

### `POST /v1/tools/{toolId}/agents`

Authorize an agent for a tool.

Requires `tool:update`.