> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mirage.strukto.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Create template

> Save a reusable workspace configuration. The server validates it when saved and preserves environment placeholders as written. Returns `409` if the name already exists.

> [accordion] Errors
>
> | Status | Meaning |
> | - | - |
> | `401` | The token is missing or wrong |
> | `422` | Validation Error |
> | `429` | Past a rate limit, or a new session past max\_sessions |
> | `501` | The server requires accounts; saved configs are kept only on a server of one account |
>
> See [error examples and recovery steps](https://docs.mirage.strukto.ai/api/errors.md). The [complete OpenAPI contract](https://github.com/strukto-ai/mirage/blob/main/docs/openapi.yaml) includes every response schema.


## OpenAPI

````yaml /openapi.yaml post /v1/templates
openapi: 3.2.0
info:
  title: Mirage API
  version: '0.1'
servers:
  - url: http://127.0.0.1:8765
    description: A local server on its default port
security:
  - bearerAuth: []
tags:
  - name: Workspace operations
    x-group: Workspaces
  - name: Workspaces
    x-group: Lifecycle
    parent: Workspace operations
  - name: Sessions
  - name: Shell
    parent: Workspace operations
  - name: VFS
    parent: Workspace operations
  - name: Tools
  - name: Documents
    x-group: Agent Instructions
    parent: Workspace operations
  - name: Snapshots
  - name: Templates
    parent: Configuration
  - name: Saved VFS
    x-group: VFS
    parent: Configuration
  - name: Saved CLIs
    x-group: CLI
    parent: Configuration
  - name: Saved runtimes
    x-group: Runtime
    parent: Configuration
  - name: Saved machines
    x-group: Machine
    parent: Configuration
  - name: Configuration
  - name: Policies
    parent: Configuration
  - name: Asks
    parent: Workspace operations
    x-group: Approval requests
  - name: Lines
    parent: Workspace operations
    x-group: Commands
  - name: Jobs
    parent: Workspace operations
  - name: Processes
    parent: Workspace operations
  - name: Machines
    parent: Workspace operations
  - name: Server
  - name: Service
    parent: Server
  - name: Daemon
    parent: Server
  - name: Auth
paths:
  /v1/templates:
    post:
      tags:
        - Templates
      summary: Create template
      description: >-
        Save a reusable workspace configuration. The server validates it when
        saved and preserves environment placeholders as written. Returns `409`
        if the name already exists.
      operationId: create_template_v1_templates_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateTemplateRequest'
            example:
              name: demo
              config:
                mounts:
                  /:
                    vfs: ram
                    mode: write
        required: true
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TemplateResponse'
components:
  schemas:
    CreateTemplateRequest:
      properties:
        name:
          type: string
          title: Name
        description:
          anyOf:
            - type: string
            - type: 'null'
          title: Description
        config:
          $ref: '#/components/schemas/WorkspaceConfig'
      additionalProperties: false
      type: object
      required:
        - name
        - config
      title: CreateTemplateRequest
    TemplateResponse:
      properties:
        name:
          type: string
          title: Name
        description:
          anyOf:
            - type: string
            - type: 'null'
          title: Description
        config:
          additionalProperties: true
          type: object
          title: Config
      type: object
      required:
        - name
        - description
        - config
      title: TemplateResponse
    WorkspaceConfig:
      properties:
        mounts:
          additionalProperties:
            $ref: '#/components/schemas/MountBlock'
          type: object
          title: Mounts
        io:
          $ref: '#/components/schemas/IOConfig'
        command_limits:
          anyOf:
            - additionalProperties:
                $ref: '#/components/schemas/Limit'
              type: object
            - type: 'null'
          title: Command Limits
        max_memory:
          anyOf:
            - type: string
            - type: integer
            - type: 'null'
          title: Max Memory
        max_body_bytes:
          anyOf:
            - type: string
            - type: integer
            - type: 'null'
          title: Max Body Bytes
        max_env:
          anyOf:
            - type: string
            - type: integer
            - type: 'null'
          title: Max Env
        network:
          anyOf:
            - type: boolean
            - additionalProperties:
                anyOf:
                  - items:
                      type: string
                    type: array
                  - additionalProperties:
                      type: string
                    type: object
              type: object
          title: Network
          default: true
        system_time:
          anyOf:
            - type: string
            - type: 'null'
          title: System Time
        clis:
          anyOf:
            - additionalProperties:
                $ref: '#/components/schemas/CLIBlock'
              type: object
            - type: 'null'
          title: Clis
        machines:
          anyOf:
            - additionalProperties:
                additionalProperties: true
                type: object
              type: object
            - type: 'null'
          title: Machines
          description: >-
            The machines the workspace runs programs on, by name, each a
            `provider` and its config.
        runtimes:
          anyOf:
            - items:
                anyOf:
                  - type: string
                  - additionalProperties: true
                    type: object
              type: array
            - type: 'null'
          title: Runtimes
        route_policy:
          anyOf:
            - $ref: '#/components/schemas/ProfilePolicy'
            - type: 'null'
        profiles:
          anyOf:
            - additionalProperties:
                $ref: '#/components/schemas/SessionProfile'
              type: object
            - type: 'null'
          title: Profiles
        profile:
          anyOf:
            - type: string
            - type: 'null'
          title: Profile
        processes:
          anyOf:
            - $ref: '#/components/schemas/ProcessPermissions'
            - type: 'null'
        mode:
          $ref: '#/components/schemas/MountMode'
          default: write
        read:
          anyOf:
            - $ref: '#/components/schemas/ReadPolicy'
            - type: 'null'
        write:
          anyOf:
            - $ref: '#/components/schemas/WritePolicy'
            - type: 'null'
        default_session_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Default Session Id
        workspace_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Workspace Id
        cache:
          anyOf:
            - oneOf:
                - $ref: '#/components/schemas/RamCacheBlock'
                - $ref: '#/components/schemas/RedisCacheBlock'
              discriminator:
                propertyName: type
                mapping:
                  ram: '#/components/schemas/RamCacheBlock'
                  redis: '#/components/schemas/RedisCacheBlock'
            - type: 'null'
          title: Cache
        index:
          anyOf:
            - oneOf:
                - $ref: '#/components/schemas/RamIndexBlock'
                - $ref: '#/components/schemas/RedisIndexBlock'
              discriminator:
                propertyName: type
                mapping:
                  ram: '#/components/schemas/RamIndexBlock'
                  redis: '#/components/schemas/RedisIndexBlock'
            - type: 'null'
          title: Index
        store:
          anyOf:
            - $ref: '#/components/schemas/StoreBlock'
            - type: 'null'
        env:
          anyOf:
            - additionalProperties:
                anyOf:
                  - type: string
                  - $ref: '#/components/schemas/EnvVar'
              type: object
            - type: 'null'
          title: Env
        secrets:
          anyOf:
            - additionalProperties:
                $ref: '#/components/schemas/SecretSource'
              type: object
            - type: 'null'
          title: Secrets
      additionalProperties: false
      type: object
      required:
        - mounts
      title: WorkspaceConfig
    MountBlock:
      properties:
        vfs:
          type: string
          title: Vfs
        mode:
          anyOf:
            - $ref: '#/components/schemas/MountMode'
            - type: 'null'
        config:
          additionalProperties: true
          type: object
          title: Config
        command_limits:
          additionalProperties:
            $ref: '#/components/schemas/Limit'
          type: object
          title: Command Limits
        backend:
          $ref: '#/components/schemas/MountBackend'
          default: workspace
        mountpoint:
          anyOf:
            - type: string
            - type: 'null'
          title: Mountpoint
        read:
          anyOf:
            - $ref: '#/components/schemas/ReadPolicy'
            - type: 'null'
        ttl:
          anyOf:
            - type: integer
            - type: 'null'
          title: Ttl
        write:
          anyOf:
            - $ref: '#/components/schemas/WritePolicy'
            - type: 'null'
        index:
          anyOf:
            - oneOf:
                - $ref: '#/components/schemas/RamIndexBlock'
                - $ref: '#/components/schemas/RedisIndexBlock'
              discriminator:
                propertyName: type
                mapping:
                  ram: '#/components/schemas/RamIndexBlock'
                  redis: '#/components/schemas/RedisIndexBlock'
            - type: 'null'
          title: Index
      additionalProperties: false
      type: object
      required:
        - vfs
      title: MountBlock
    IOConfig:
      properties:
        buffer_bytes:
          type: integer
          maximum: 9007199254740991
          minimum: 16384
          title: Buffer Bytes
          default: 65536
      additionalProperties: false
      type: object
      title: IOConfig
      description: Buffer limits for input and output while commands run.
    Limit:
      properties:
        max_bytes:
          anyOf:
            - type: integer
              minimum: 0
            - type: 'null'
          title: Max Bytes
        max_lines:
          anyOf:
            - type: integer
              minimum: 0
            - type: 'null'
          title: Max Lines
        timeout_seconds:
          anyOf:
            - type: number
              minimum: 0
            - type: 'null'
          title: Timeout Seconds
        walk_limit:
          anyOf:
            - type: integer
              minimum: -1
            - type: 'null'
          title: Walk Limit
        on_exceed:
          $ref: '#/components/schemas/OnExceed'
          default: truncate
      additionalProperties: false
      type: object
      title: Limit
      description: >-
        Limits for command output, execution time, and directory traversal. Use
        `on_exceed` to truncate results or return an error. A `walk_limit` of
        `-1` allows unlimited entries.
    CLIBlock:
      properties:
        cli:
          anyOf:
            - type: string
            - type: 'null'
          title: Cli
        script:
          anyOf:
            - type: string
            - type: 'null'
          title: Script
        runtime:
          anyOf:
            - type: string
            - type: 'null'
          title: Runtime
        config:
          additionalProperties: true
          type: object
          title: Config
      additionalProperties: false
      type: object
      title: CLIBlock
      description: >-
        Install named commands in the workspace. Set `cli` to a registered CLI
        type or `script` to a program file. Use `config` for settings and
        credentials. For scripts, `runtime` selects the execution environment;
        when omitted, Mirage selects one for the script language.
    ProfilePolicy:
      properties:
        script:
          anyOf:
            - $ref: '#/components/schemas/ScriptSource'
            - type: string
          title: Script
        runtime:
          anyOf:
            - type: string
            - additionalProperties: true
              type: object
          title: Runtime
          default: monty
        env:
          additionalProperties:
            anyOf:
              - type: string
              - $ref: '#/components/schemas/SecretRef'
          type: object
          title: Env
          default: {}
      additionalProperties: false
      type: object
      required:
        - script
      title: ProfilePolicy
      description: >-
        Custom policy programs, grouped by the method they handle. Provide a
        script, its runtime, and optional environment variables. If no runtime
        is specified, Monty is used and must be installed. Policy programs use
        their configured environment and can read session variables through
        `ctx["env"]`.
    SessionProfile:
      properties:
        cwd:
          anyOf:
            - type: string
            - type: 'null'
          title: Cwd
        env:
          anyOf:
            - additionalProperties:
                anyOf:
                  - type: string
                  - $ref: '#/components/schemas/EnvVar'
              type: object
            - type: 'null'
          title: Env
        mounts:
          anyOf:
            - additionalProperties:
                $ref: '#/components/schemas/ProfileMount'
              type: object
            - type: 'null'
          title: Mounts
        paths:
          anyOf:
            - $ref: '#/components/schemas/PathsBlock'
            - type: 'null'
        vars:
          anyOf:
            - $ref: '#/components/schemas/VarsBlock'
            - type: 'null'
        commands:
          anyOf:
            - $ref: '#/components/schemas/CommandsBlock'
            - type: 'null'
        policy:
          anyOf:
            - additionalProperties:
                items:
                  $ref: '#/components/schemas/ProfilePolicy'
                type: array
              propertyNames:
                enum:
                  - pre_execute
                  - pre_command
                  - pre_vfs
                  - pre_network
                  - post_execute
                  - post_command
                  - post_vfs
                  - post_network
              type: object
            - type: 'null'
          title: Policy
        command_limits:
          anyOf:
            - additionalProperties:
                $ref: '#/components/schemas/Limit'
              type: object
            - type: 'null'
          title: Command Limits
        processes:
          anyOf:
            - $ref: '#/components/schemas/ProcessPermissions'
            - type: 'null'
        network:
          anyOf:
            - type: boolean
            - additionalProperties:
                anyOf:
                  - items:
                      type: string
                    type: array
                  - additionalProperties:
                      type: string
                    type: object
              type: object
            - type: 'null'
          title: Network
      additionalProperties: false
      type: object
      title: SessionProfile
      description: >-
        Permissions and initial settings for a session. Unspecified settings add
        no restrictions beyond the workspace configuration.


        Use `commands`, `paths`, and `mounts` to control access, and `policy`
        for custom rules. For command rules without paths, deny takes precedence
        over approval requests and allow rules. More specific path rules take
        precedence over broader rules. See [permissions
        profiles](/home/policy/overview) for rule examples.
    ProcessPermissions:
      properties:
        list:
          type: string
          enum:
            - session
            - workspace
          title: List
          default: session
        kill:
          type: string
          enum:
            - session
            - workspace
          title: Kill
          default: session
        max:
          anyOf:
            - type: integer
              minimum: 1
            - type: 'null'
          title: Max
          default: 128
      additionalProperties: false
      type: object
      title: ProcessPermissions
      description: >-
        Control which processes a session can list or stop, and the maximum
        number it can run. Sessions always have access to their own processes.
        The stop scope cannot exceed the list scope. Profile settings override
        workspace defaults.
    MountMode:
      type: string
      enum:
        - read
        - write
        - exec
      title: MountMode
      description: >-
        Mount access level. `read` allows listing and reading. `write` also
        allows creating, modifying, and deleting files. `exec` additionally
        allows interpreter commands such as `python3` and `js`.


        Interpreter script files must be on an `exec` mount. Inline code and
        module execution require at least one `exec` mount; imports are not
        checked by path. Shell scripts follow the permissions of each command
        they run.
    ReadPolicy:
      type: string
      enum:
        - fresh
        - bounded
        - pinned
      title: ReadPolicy
      description: >-
        Cache validation policy. `fresh` checks the backend before returning
        cached content. `bounded` allows cached content within the configured
        freshness limit. `pinned` is reserved and currently rejected.
    WritePolicy:
      type: string
      enum:
        - unconditional
        - conditional
        - staged
      title: WritePolicy
      description: >-
        Write conflict policy. `unconditional` replaces content without checking
        its version. `conditional` rejects writes when the backend version has
        changed since the last read. Creating a file previously observed as
        missing requires an atomic create in either mode. `staged` is reserved
        and currently rejected.
    RamCacheBlock:
      properties:
        type:
          type: string
          const: ram
          title: Type
          default: ram
        limit:
          anyOf:
            - type: string
            - type: integer
          title: Limit
          default: 32MB
        max_drain_bytes:
          anyOf:
            - type: integer
            - type: 'null'
          title: Max Drain Bytes
      additionalProperties: false
      type: object
      title: RamCacheBlock
    RedisCacheBlock:
      properties:
        type:
          type: string
          const: redis
          title: Type
        limit:
          anyOf:
            - type: string
            - type: integer
          title: Limit
          default: 512MB
        max_drain_bytes:
          anyOf:
            - type: integer
            - type: 'null'
          title: Max Drain Bytes
        url:
          type: string
          title: Url
          default: redis://localhost:6379/0
        key_prefix:
          anyOf:
            - type: string
            - type: 'null'
          title: Key Prefix
      additionalProperties: false
      type: object
      required:
        - type
      title: RedisCacheBlock
    RamIndexBlock:
      properties:
        type:
          type: string
          const: ram
          title: Type
          default: ram
        ttl:
          type: number
          title: Ttl
          default: 600
      additionalProperties: false
      type: object
      title: RamIndexBlock
    RedisIndexBlock:
      properties:
        type:
          type: string
          const: redis
          title: Type
        ttl:
          type: number
          title: Ttl
          default: 600
        url:
          type: string
          title: Url
          default: redis://localhost:6379/0
        key_prefix:
          anyOf:
            - type: string
            - type: 'null'
          title: Key Prefix
      additionalProperties: false
      type: object
      required:
        - type
      title: RedisIndexBlock
    StoreBlock:
      properties:
        type:
          type: string
          enum:
            - ram
            - disk
            - redis
          title: Type
          default: ram
        url:
          type: string
          title: Url
          default: redis://localhost:6379/0
        key_prefix:
          type: string
          title: Key Prefix
          default: 'mirage:'
        root:
          type: string
          title: Root
          default: ~/.mirage/state
        namespace:
          anyOf:
            - oneOf:
                - $ref: '#/components/schemas/RamStoreBlock'
                - $ref: '#/components/schemas/DiskStoreBlock'
                - $ref: '#/components/schemas/RedisStoreBlock'
                - $ref: '#/components/schemas/S3StoreBlock'
              discriminator:
                propertyName: type
                mapping:
                  disk: '#/components/schemas/DiskStoreBlock'
                  ram: '#/components/schemas/RamStoreBlock'
                  redis: '#/components/schemas/RedisStoreBlock'
                  s3: '#/components/schemas/S3StoreBlock'
            - type: 'null'
          title: Namespace
        observer:
          anyOf:
            - oneOf:
                - $ref: '#/components/schemas/RamStoreBlock'
                - $ref: '#/components/schemas/DiskStoreBlock'
                - $ref: '#/components/schemas/RedisStoreBlock'
                - $ref: '#/components/schemas/S3StoreBlock'
              discriminator:
                propertyName: type
                mapping:
                  disk: '#/components/schemas/DiskStoreBlock'
                  ram: '#/components/schemas/RamStoreBlock'
                  redis: '#/components/schemas/RedisStoreBlock'
                  s3: '#/components/schemas/S3StoreBlock'
            - type: 'null'
          title: Observer
        workspace:
          anyOf:
            - oneOf:
                - $ref: '#/components/schemas/RamStoreBlock'
                - $ref: '#/components/schemas/DiskStoreBlock'
                - $ref: '#/components/schemas/RedisStoreBlock'
                - $ref: '#/components/schemas/S3StoreBlock'
              discriminator:
                propertyName: type
                mapping:
                  disk: '#/components/schemas/DiskStoreBlock'
                  ram: '#/components/schemas/RamStoreBlock'
                  redis: '#/components/schemas/RedisStoreBlock'
                  s3: '#/components/schemas/S3StoreBlock'
            - type: 'null'
          title: Workspace
        execution:
          anyOf:
            - oneOf:
                - $ref: '#/components/schemas/RamStoreBlock'
                - $ref: '#/components/schemas/DiskStoreBlock'
                - $ref: '#/components/schemas/RedisStoreBlock'
                - $ref: '#/components/schemas/S3StoreBlock'
              discriminator:
                propertyName: type
                mapping:
                  disk: '#/components/schemas/DiskStoreBlock'
                  ram: '#/components/schemas/RamStoreBlock'
                  redis: '#/components/schemas/RedisStoreBlock'
                  s3: '#/components/schemas/S3StoreBlock'
            - type: 'null'
          title: Execution
      additionalProperties: false
      type: object
      title: StoreBlock
      description: >-
        Storage settings for workspace metadata, sessions, filesystem records,
        logs, and execution records. Top-level settings select the default
        backend; per-group settings override it.


        S3 is supported only for the `workspace` group. Disk storage uses `root`
        and keeps jobs in memory. The `execution` group supports RAM or Redis.
    EnvVar:
      properties:
        value:
          anyOf:
            - type: string
            - type: 'null'
          title: Value
        readonly:
          type: boolean
          title: Readonly
          default: false
        export:
          type: boolean
          title: Export
          default: true
        from:
          anyOf:
            - type: string
            - type: 'null'
          title: From
        ref:
          type: string
          title: Ref
          default: ''
        key:
          anyOf:
            - type: string
            - type: 'null'
          title: Key
        fetch:
          type: string
          enum:
            - lazy
            - eager
          title: Fetch
          default: lazy
      additionalProperties: false
      type: object
      title: EnvVar
      description: >-
        An environment variable with a literal `value` or a secret source
        identified by `from`, never both. Use `ref` and `key` to select a
        secret. `readonly` prevents commands from changing the variable. Managed
        secrets are always exported; literal values use the `export` setting.
    SecretSource:
      properties:
        source:
          title: Source
          type: string
        config:
          additionalProperties: true
          type: object
          title: Config
      additionalProperties: false
      type: object
      required:
        - source
      title: SecretSource
      description: >-
        A named secret source and its configuration. Managed environment
        variables refer to this source by name. Configuration fields can contain
        literal values or bootstrap secret references.
    MountBackend:
      type: string
      enum:
        - workspace
        - fuse
        - fskit
        - nfs
      title: MountBackend
      description: >-
        How the mount is exposed. `workspace` is available only through Mirage.
        `fuse` and `fskit` expose operating-system mountpoints. `nfs` uses the
        system NFS client on Linux or macOS; Linux requires root.


        FSKit requires macOS 15.4 or later. FSKit and NFS require known file
        sizes for correct reads. NFS is read-only. The macFUSE FSKit adapter
        supports appends and metadata changes, but new-file and
        truncate-then-write operations can write zero-filled data instead of
        content. Select the backend explicitly.
    OnExceed:
      type: string
      enum:
        - error
        - truncate
      title: OnExceed
    ScriptSource:
      properties:
        source:
          title: Source
          type: string
        language:
          type: string
          enum:
            - python
            - js
          title: Language
          default: python
        module:
          type: boolean
          title: Module
          default: false
      additionalProperties: false
      type: object
      required:
        - source
      title: ScriptSource
      description: >-
        Embedded program source with a language and optional JavaScript module
        mode. Configuration files can reference `.py`, `.js`, or `.mjs` files;
        the loader embeds their contents. `.mjs` files use module mode for
        imports and top-level `await`.
    SecretRef:
      properties:
        from:
          type: string
          title: From
        ref:
          type: string
          title: Ref
          default: ''
        key:
          type: string
          title: Key
      additionalProperties: false
      type: object
      required:
        - from
        - key
      title: SecretRef
      description: >-
        Read a configuration value from a secret source using `from`, `ref`, and
        `key`. The available sources depend on where this reference is used.
        Secret-source configuration allows only bootstrap sources such as
        environment variables or dotenv files.
    ProfileMount:
      properties:
        mode:
          anyOf:
            - $ref: '#/components/schemas/MountMode'
            - type: 'null'
        commands:
          anyOf:
            - $ref: '#/components/schemas/MountCommandsBlock'
            - type: 'null'
        paths:
          anyOf:
            - $ref: '#/components/schemas/PathsBlock'
            - type: 'null'
      additionalProperties: false
      type: object
      title: ProfileMount
      description: >-
        Optional permissions for a specific mount. A profile can reduce mount
        permissions but cannot increase them. Omitted mounts retain their
        configured permissions. Use path hiding to prevent access to a mount.
    PathsBlock:
      properties:
        hide:
          items:
            type: string
          type: array
          title: Hide
          default: []
        show:
          items:
            $ref: '#/components/schemas/ShowEntry'
          type: array
          title: Show
          default: []
        reasons:
          items:
            $ref: '#/components/schemas/HideReason'
          type: array
          title: Reasons
          default: []
      additionalProperties: false
      type: object
      title: PathsBlock
      description: >-
        Control which paths a session can access. `hide` makes matching paths
        appear not to exist. `show` exposes more specific paths inside hidden
        regions, optionally with reduced permissions. Exact paths include their
        descendants; patterns support `*`, `?`, and character classes.
    VarsBlock:
      properties:
        hide:
          items:
            type: string
          type: array
          title: Hide
          default: []
      additionalProperties: false
      type: object
      title: VarsBlock
      description: >-
        Environment variable names or glob patterns to hide from the session.
        Hidden variables appear unset.
    CommandsBlock:
      properties:
        allow:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Allow
        ask:
          items:
            $ref: '#/components/schemas/CommandRule'
          type: array
          title: Ask
          default: []
        deny:
          items:
            $ref: '#/components/schemas/CommandRule'
          type: array
          title: Deny
          default: []
      additionalProperties: false
      type: object
      title: CommandsBlock
      description: >-
        Command access rules. `allow` restricts available commands to matching
        patterns. `ask` requires approval, and `deny` blocks matching commands
        with a reason. If `allow` is omitted, it adds no restriction.
    RamStoreBlock:
      properties:
        type:
          type: string
          const: ram
          title: Type
          default: ram
      additionalProperties: false
      type: object
      title: RamStoreBlock
    DiskStoreBlock:
      properties:
        type:
          type: string
          const: disk
          title: Type
        root:
          type: string
          title: Root
          default: ~/.mirage/state
      additionalProperties: false
      type: object
      required:
        - type
      title: DiskStoreBlock
    RedisStoreBlock:
      properties:
        type:
          type: string
          const: redis
          title: Type
        url:
          type: string
          title: Url
          default: redis://localhost:6379/0
        key_prefix:
          type: string
          title: Key Prefix
          default: 'mirage:'
      additionalProperties: false
      type: object
      required:
        - type
      title: RedisStoreBlock
    S3StoreBlock:
      properties:
        timeout:
          type: number
          exclusiveMinimum: 0
          title: Timeout
          default: 30
        region:
          anyOf:
            - type: string
            - type: 'null'
          title: Region
        aws_access_key_id:
          anyOf:
            - type: string
              format: password
              writeOnly: true
            - type: 'null'
          title: Aws Access Key Id
        aws_secret_access_key:
          anyOf:
            - type: string
              format: password
              writeOnly: true
            - type: 'null'
          title: Aws Secret Access Key
        aws_session_token:
          anyOf:
            - type: string
              format: password
              writeOnly: true
            - type: 'null'
          title: Aws Session Token
        aws_profile:
          anyOf:
            - type: string
            - type: 'null'
          title: Aws Profile
        bucket:
          type: string
          title: Bucket
        endpoint_url:
          anyOf:
            - type: string
            - type: 'null'
          title: Endpoint Url
        path_style:
          type: boolean
          title: Path Style
          default: false
        proxy:
          anyOf:
            - type: string
              format: password
              writeOnly: true
            - type: 'null'
          title: Proxy
        key_prefix:
          anyOf:
            - type: string
            - type: 'null'
          title: Key Prefix
          default: mirage/
        default_content_type:
          anyOf:
            - type: string
            - type: 'null'
          title: Default Content Type
        type:
          type: string
          const: s3
          title: Type
      additionalProperties: false
      type: object
      required:
        - bucket
        - type
      title: S3StoreBlock
      description: >-
        S3 storage settings. Uses the same configuration fields as the S3
        backend.
    MountCommandsBlock:
      properties:
        ask:
          items:
            $ref: '#/components/schemas/CommandRule'
          type: array
          title: Ask
          default: []
        deny:
          items:
            $ref: '#/components/schemas/CommandRule'
          type: array
          title: Deny
          default: []
      additionalProperties: false
      type: object
      title: MountCommandsBlock
      description: >-
        Approval and deny rules for commands working within this mount. Use
        session-level command rules for an allow list.
    ShowEntry:
      properties:
        path:
          title: Path
          type: string
        mode:
          anyOf:
            - $ref: '#/components/schemas/MountMode'
            - type: 'null'
      additionalProperties: false
      type: object
      required:
        - path
      title: ShowEntry
      description: >-
        An absolute path or anchored path pattern to expose within a hidden
        region. Optional `mode` reduces permissions for that path. If omitted,
        mount permissions apply.
    HideReason:
      properties:
        patterns:
          items:
            type: string
          type: array
          title: Patterns
        reason:
          type: string
          title: Reason
      additionalProperties: false
      type: object
      required:
        - patterns
        - reason
      title: HideReason
      description: >-
        An optional explanation for hidden paths. The explanation is available
        to operators, not to agents accessing the workspace. Hidden paths appear
        not to exist.
    CommandRule:
      properties:
        reason:
          type: string
          title: Reason
        commands:
          items:
            type: string
          type: array
          title: Commands
          default: []
        paths:
          items:
            type: string
          type: array
          title: Paths
          default: []
        mount:
          type: string
          title: Mount
          default: ''
      additionalProperties: false
      type: object
      required:
        - reason
      title: CommandRule
      description: >-
        Require approval or deny commands matching the specified patterns. A
        pattern such as `git push` matches that command and its arguments.
        Optional paths restrict the rule to matching files or directories. Rules
        under a mount apply only within that mount.
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: >-
        The server's token (MIRAGE_AUTH_TOKEN) or a JWT. A daemon in the default
        local mode with no token accepts requests without one.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.