reviews:write to create reviews, submit questions, and cancel executions. It needs reviews:read to list and get reviews, stream or poll executions, and read messages.
Retry safely
Both mutation routes requireIdempotency-Key, scoped by organization, API key, and operation. Keys can be up to 256 characters. Keep the same key and exact body when a network retry leaves the outcome unclear. An identical retry returns the original resource with idempotent: true; a different body with that key returns 409 idempotency_key_conflict.
First-release boundaries
Reviews currently supports text questions, public HTTPS streaming, polling, a server-selected model, the existing review-token credit policy, and sources already ingested and indexed in the project. It does not expose the workspace’s browser or WebSocket transport, voice, attachments, model selection, auto-runs, coverage graphs, exports, or document-job webhooks. Review responses only return/api/open/v1/... URLs. They never expose runtime session URLs, cookies, capability tokens, internal stream endpoints, orchestrator paths, model/session details, or internal container job IDs.