Share a runbook with a team

Say an engineer has a script that unlocks a customer’s account after too many sign-in attempts, and the support team needs it several times a day. Today they ask in a channel and wait while the customer waits too. Here’s how to give Support a form instead, without giving anyone your app’s admin key.

1. Save the key as a secret

A workspace owner or admin saves it once. It can only ever be sent to your app’s admin API, here api.yourapp.com:

printf %s "$ADMIN_KEY" | reminix secrets set ADMIN_KEY --hosts api.yourapp.com

2. Write the script

{
  "slug": "unlock-account",
  "name": "Unlock an account",
  "description": "Lets a customer sign in again after too many attempts.",
  "command": "python unlock.py {email}",
  "hosts": ["api.yourapp.com"],
  "secrets": {
    "ADMIN_KEY": {
      "host": "api.yourapp.com",
      "header": "Authorization",
      "value": "Bearer {secret}"
    }
  },
  "inputSchema": {
    "type": "object",
    "required": ["email"],
    "properties": {
      "email": {
        "type": "string",
        "title": "Customer email",
        "examples": ["jane@example.com"]
      }
    }
  }
}

unlock.py

import json, sys, urllib.error, urllib.request

email = sys.argv[1]
print(f"unlocking {email}", file=sys.stderr)
request = urllib.request.Request(
    "https://api.yourapp.com/admin/unlock",
    data=json.dumps({"email": email}).encode(),
    headers={"Content-Type": "application/json"},
)
try:
    with urllib.request.urlopen(request) as res:
        result = json.load(res)
except urllib.error.HTTPError as error:
    sys.exit(json.load(error)["error"]["message"])
print(json.dumps({"unlocked": email, "status": result["status"]}))

The input schema becomes the form: one text field for the customer’s email. The code holds no key: Reminix adds it to the request to your API. When your API refuses, sys.exit writes its message to standard error and exits with code 1, so the run fails with that message and Support sees why.

3. Publish it

reminix publish ./unlock-account

4. Share it with Support only

On the script’s page, under Settings → Who can use it, choose Only these teams and pick Support. Or from your code or the CLI:

TypeScript

import { createClient } from "@reminix/sdk";

const reminix = createClient();

await reminix.scripts.update("unlock-account", {
  access: "teams",
  teamIds: ["<support team id>"],
});

Python

from reminix import Reminix

reminix = Reminix()

reminix.scripts.update(
    "unlock-account", access="teams", team_ids=["<support team id>"]
)

CLI

reminix scripts update unlock-account --access teams \
  --team-ids '["<support team id>"]'

curl

curl -X PATCH https://api.reminix.com/v1/scripts/unlock-account \
  -H "Authorization: Bearer $REMINIX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "access": "teams", "teamIds": ["<support team id>"] }'

Support now sees Unlock an account under Scripts, fills in the form, and clicks Run. The workspace’s other members don’t see it at all.

5. If agents should use it too

Set Which runs need approval to Agents need approval. An agent can then start an unlock, but it waits until an owner or admin approves it. See Let your agents run scripts, with approval.

Every unlock is on record, with who ran it, the inputs and your API’s answer, on the script’s page.

Related: Scripts, Secrets, Governance.