Validate that a secret name is allowed. Args: name: The secret name to validate Raises: ValueError: If the name is blocked (

Verify that a key is valid in LiteLLM by making a lightweight API call. Args: key: The key to verify user_id: The use

Verify all conditions are met for webhook installation. Raises BreakLoopException if any condition fails or rate limited. Args:

Add a user to a team in LiteLLM. Args: client: The HTTP client to use. keycloak_user_id: The user's Keycloak ID.

Build a minimal FastAPI app with the real user and sandbox routers. The ``depends_user_context`` dependency is overridden with a mock, but the

Incorporate plugin parameters into the initial message if specified. Plugin parameters are formatted and appended to the initial message so t

Create a user in LiteLLM. Returns True if the user was created or already exists and is verified, False if creation failed and user d

Get a base environment dict with essential system vars preserved.

Check if user should be redirected to onboarding after TOS acceptance. Backend always redirects applicable users to /onboarding. Returns True

Get a batch of sandboxes, returning None for any which were not found.

Build the list of global org/user skill-repo configs for the agent-server. Skills are loaded for every conversation regardless of repository sele

Check if BYOR export is enabled for an organization. Args: user_id: User ID (used only as fallback to look up the user's

Mark onboarding as completed for the current user and fire analytics. Persists ``user.onboarding_completed = True`` and emits the ``onboardin

Create a new API key for a user. Args: user_id: The ID of the user to create the key for name: Optional name for the

Process device verification for authenticated users (called by frontend).

Appends a followup link, in the PR body, to the OpenHands conversation that opened the PR

Construct proxy for litellm model based on user settings if not set explicitly.

Returns a singleton instance of KeycloakAdmin based on the 'external' flag.

Returns a singleton instance of KeycloakOpenID based on the 'external' flag.

Get organization credits from LiteLLM team. Args: user_id: User ID org_id: Organization ID Returns:

Get organization info for the current user. Lazily loads and caches organization data including: - org_id: Current organization ID

Get all members of an organization with pagination and optional email filter. This endpoint retrieves a paginated list of organization members. A

Map ProviderType value to the environment variable name in the runtime

Get Jira user by Keycloak user ID.

Get all projects and groups where the current user has admin access (maintainer or owner). Returns: tuple[list[dict], li

Retrieve workspace by ID.

Handle general HTTP errors.

Identify a user and their org memberships in PostHog. Consolidates the duplicated ``set_person_properties`` + ``group_identify`` patt

Load secrets.

Create or update an agent profile under ``name`` (path name is authoritative). Server-managed id/revision: overwrite keeps the namesake's id and

Start a new sandbox.

Update conversation statistics from stats event data. Args: conversation_id: The ID of the conversation to update sta

Update organization app settings. Only updates fields that are explicitly provided in update_data. Uses flush() - commit happens at r

Navigate into settings.agent_settings using a dot-separated key.

Check if requester can change target's role to new_role. Permission rules: - Owners can modify anyone (including other owners), can s

Create a new team in LiteLLM. Args: client: The HTTP client to use. team_alias: The alias for the team. t

Determine where to redirect user after authentication completes. Called after offline token is stored to determine final redirect destination.

Create a mock SandboxInfo for testing.

Create a mock PendingMessageService for testing.

Build a mock ProviderHandler. Args: logins: Mapping of ProviderType -> account login. orgs: Optional mapping of Provi

Create a mock service that passes the isinstance check and returns the desired values.

Build a Settings instance carrying one named LLM profile.

Patch get_jwt_service so verify_jws_token returns a controlled payload.

Resolve an agent profile into an ``agent_settings`` dump. Resolves ``override_agent_profile_id`` when given (a one-off, non-persisted

Create a shared org so seeded users satisfy the non-null FK.

Insert a User row with the given super ``role_id`` and return its id.

Validate that user can update the target workspace.

Check if an existing key exists for the user/org in LiteLLM. Verifies the provided key_value matches a key registered in LiteLLM for

Create an async session maker for testing.

Check if a user with the same base email already exists. This method checks for duplicate signups using email + modifier. It checks i

Download and convert Slack file attachments attached to a message.

Create a new organization, optionally with the specified user as owner. This method orchestrates the complete organization creation

Creates a PR using user credentials Args: repo_name: The full name of the repository (owner/repo) source_branch: The

Helper function to create SandboxInfo objects for testing.

Create an async context manager that yields the given sandbox service.

Decrypt a ciphertext string, trying JWE first then legacy Fernet. During the migration from Fernet to JWE, persisted data may be encr

Like deep_merge, but specified keys are replaced wholesale (not merged). Useful for keys like 'mcp_config' where the dict represents a set of ite

Delete organization and all associated data in cascade, including external LiteLLM cleanup. Users that belong to the org being deleted are ha

Poll for a token until the user authorizes or the code expires.

Ensure sandbox exists, is running, and has a session API key.

Execute an HTTP request using the provided client.

Download a conversation trajectory as a zip file. Args: conversation_id: The UUID of the conversation to download. This

Get the authorization type for the given email and provider. Checks matching authorization rules and returns the effective authorization

Generate a regex pattern to match emails with the same base. For base_email "joe@example.com", the pattern will match: - joe@example.com

Get all skills associated with the conversation. This endpoint returns all skills that are loaded for the v1 conversation. Skills are loaded

Get deployment mode. Honors an explicit OH_DEPLOYMENT_MODE ('cloud' | 'self_hosted'); otherwise infers from OH_WEB_HOST/WEB_HOST (managed dom