> ## Documentation Index > Fetch the complete documentation index at: https://docs.kombify.io/llms.txt > Use this file to discover all available pages before exploring further. # techstack api workers > Generated reference for the techstack api workers commands Generated from the Techstack v0.39.0 release (source `49677b729cb9`). For an installed version, `techstack api --help` is authoritative. ## techstack api workers approve Approve pending worker. ```bash theme={null} techstack api workers approve [flags] ``` | | | | - | - | | HTTP | `POST /api/v1/workers/{id}/approve` | | Changes state | Yes | | MCP tool | `approve_worker` | | Argument | Type | Description | | - | - | - | | `` | string | **Required.** Resource ID. | ## techstack api workers identity upgrade approve Approve the key a legacy server proposed. Binds the pending key named by `key_thumbprint`, which makes the worker key-bound (bearer-only requests are denied afterwards). Requires the owner and a fresh multi-factor sign-in (at most 300 seconds old). The approving subject and time are recorded with the identity and logged. 409 `identity_upgrade_not_pending` when no unexpired pending key has that fingerprint. ```bash theme={null} techstack api workers identity upgrade approve [flags] ``` Requires confirmation: This operation decides which key may command the server; approve only a key whose fingerprint the Guard logs on the server. Pass `--yes` or answer the prompt; a non-interactive run without `--yes` stops before any request with exit code 9. | | | | - | - | | HTTP | `POST /api/v1/workers/{id}/identity/upgrade/approve` | | Changes state | Yes | | MCP tool | `approve_worker_identity_upgrade` | | Argument | Type | Description | | - | - | - | | `` | string | **Required.** Resource ID. | | `--key-thumbprint` | string | **Required.** | | `--body` | json | JSON request body (`application/json`) as a literal, `@path` or `-` for stdin. | ## techstack api workers identity upgrade reject Discard the key a legacy server proposed. The owner's reset when the pending key is not the server's own: the proposal is discarded and must be made again. Rotating the server credential ends the holder's access to the bind endpoint. ```bash theme={null} techstack api workers identity upgrade reject [flags] ``` | | | | - | - | | HTTP | `POST /api/v1/workers/{id}/identity/upgrade/reject` | | Changes state | Yes | | MCP tool | None | | Argument | Type | Description | | - | - | - | | `` | string | **Required.** Resource ID. | ## techstack api workers identity upgrade-status Show whether a server still needs its identity key approved. For the owner of the worker. `identity_binding=legacy_bearer` with `code=guard_identity_upgrade_required` means the server authenticates with its bearer credential alone and is observe-only; `pending` carries the fingerprint of the key the server proposed, which the owner compares with the fingerprint the Guard logs on the server. A worker of another tenant or owner is 404. ```bash theme={null} techstack api workers identity upgrade-status [flags] ``` | | | | - | - | | HTTP | `GET /api/v1/workers/{id}/identity/upgrade` | | Changes state | No | | MCP tool | `get_worker_identity_upgrade` | | Argument | Type | Description | | - | - | - | | `` | string | **Required.** Resource ID. | ## techstack api workers identity upgrades List the owner's servers that wait for an identity key approval. For the owner. Each entry is a server of theirs that proposed a key and is observe-only until that exact key is approved with `approveWorkerIdentityUpgrade` (fresh multi-factor sign-in required). Entries carry the hostname and the key fingerprint to compare with the one the Guard logs on the server. Listing grants nothing. ```bash theme={null} techstack api workers identity upgrades [flags] ``` | | | | - | - | | HTTP | `GET /api/v1/workers/identity-upgrades` | | Changes state | No | | MCP tool | `list_worker_identity_upgrades` | ## techstack api workers list List registered workers (filtered by owner). ```bash theme={null} techstack api workers list [flags] ``` | | | | - | - | | HTTP | `GET /api/v1/workers` | | Changes state | No | | MCP tool | `list_workers` | | Argument | Type | Description | | - | - | - | | `--page` | integer | Page number (default 1). | | `--per-page` | integer | Items per page (default 20, max 100). | ## techstack api workers outcomes list List the unresolved operation outcomes of one kombify Guard. Lists the operations of an owned worker whose outcome is unknown: the kombify Guard recorded that the effect may or may not have happened and no observation settled it. Each one fences further changes on the server. `state` is `reconciling` while the Guard still tries to settle it and `needs_operator` once it stayed unresolved past the configured time (`TECHSTACK_GUARD_OUTCOME_NEEDS_OPERATOR_AFTER`, default 30 minutes). The time only changes how the outcome is shown; it never releases the fence. Another tenant's or owner's worker is 404. ```bash theme={null} techstack api workers outcomes list [flags] ``` | | | | - | - | | HTTP | `GET /api/v1/workers/{id}/outcomes` | | Changes state | No | | MCP tool | `list_guard_unresolved_outcomes` | | Argument | Type | Description | | - | - | - | | `` | string | **Required.** Resource ID. | ## techstack api workers outcomes resolve Release an unresolved kombify Guard operation outcome. Commits an append-only operator resolution revision for an operation whose outcome is unknown and releases the worker's fence. `disposition` is `verified_applied` (the effect is in place), `verified_not_applied` (nothing happened) or `accept_unknown` (release without a verified outcome); `note` records what was verified. The actor is the authenticated subject and is recorded with the revision; a Guard cannot commit these dispositions. A fresh multi-factor sign-in (at most 300 seconds old) is required. `expected_revision` must be the revision the list returned, otherwise 409 `outcome_revision_stale`. The body is decoded strictly: exact keys, no unknown fields. ```bash theme={null} techstack api workers outcomes resolve [flags] ``` Requires confirmation: This operation releases the fence of an operation whose outcome was never settled, so conflicting changes may run against the server. Pass `--yes` or answer the prompt; a non-interactive run without `--yes` stops before any request with exit code 9. | | | | - | - | | HTTP | `POST /api/v1/workers/{id}/outcomes/{command_id}/resolve` | | Changes state | Yes | | MCP tool | None | | Argument | Type | Description | | - | - | - | | `` | string | **Required.** Resource ID. | | `` | string | **Required.** | | `--disposition` | string | **Required.** One of `verified_applied`, `verified_not_applied`, `accept_unknown`. | | `--expected-revision` | integer | **Required.** | | `--note` | string | **Required.** | | `--body` | json | JSON request body (`application/json`) as a literal, `@path` or `-` for stdin. | ## techstack api workers prechecks list Get pre-check results for worker. ```bash theme={null} techstack api workers prechecks list [flags] ``` | | | | - | - | | HTTP | `GET /api/v1/workers/{id}/prechecks` | | Changes state | No | | MCP tool | None | | Argument | Type | Description | | - | - | - | | `` | string | **Required.** Resource ID. | | `--page` | integer | Page number (default 1). | | `--per-page` | integer | Items per page (default 20, max 100). | ## techstack api workers prechecks run Run pre-checks on worker. ```bash theme={null} techstack api workers prechecks run [flags] ``` | | | | - | - | | HTTP | `POST /api/v1/workers/{id}/prechecks` | | Changes state | Yes | | MCP tool | None | | Argument | Type | Description | | - | - | - | | `` | string | **Required.** Resource ID. | | `--checks` | object\[] | **Required.** | | `--stack-id` | string | — | | `--timeout-seconds` | integer | Default `30`. | | `--worker-id` | string | — | | `--body` | json | JSON request body (`application/json`) as a literal, `@path` or `-` for stdin. | This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.