Verify Jira DC webhook signature.

Prefix a bare model name with its canonical provider. Models that already contain a ``/`` provider separator are returned unchanged. Bare nam

Build Slack options list from repositories. Returns up to 100 repositories formatted as Slack options (Slack has a 100 option limit f

Clone a marketplace repository to a temporary directory. Args: marketplace: MarketplaceRegistration with source, ref, and repo_path

Convert Docker container to SandboxInfo.

Create an async context manager that yields the given sandbox service.

Create conversation using the new V1 app conversation system.

Delete a key from LiteLLM by its alias. This is a best-effort operation that logs but does not raise on failure.

Extract owner and repo from repository string. Args: repository: Repository name in format 'project/repo_slug' Returns:

Fetch data with pagination support for Bitbucket data center API. Args: url: The API endpoint URL params: Query param

Check if any user in the provided list matches the base email pattern. Filters users to find duplicates that match the base email pattern,

Get a cached value from Redis. Returns the cached string value, or None if not cached or Redis unavailable. Falls back to DB

Get the status of a process.

Check if the token has expired based on HTTP status code.

Check if access and refresh tokens are expired. Args: access_token_expires_at: Expiration time for access token (seconds since ep

Post the summary back to the Jira issue.

Convert process info to sandbox info.

Resolve a Git organization name to an OpenHands org_id. Uses Redis caching with 1-hour TTL. Caches both positive and negative

Best-effort bot identifiers (username + Jira key) for a picker mention. Returns the ids a [~...] token can carry; _comment_addresses_openhand

Navigate into settings.agent_settings and unwrap SecretStr values.

Send a message to the user informing them they need to create an OpenHands account. This method handles all supported trigger types:

Extract unique providers, sorted with ``openhands`` first, then other verified providers alphabetically, then unverified providers alphabetically.

Track login analytics in background to avoid blocking auth response.

Check if we need to update org version.

Validate that user can update the target workspace.

Add a user to an organization with a specific role.

Update contact_name on the personal org if it still has a username-style value. Called during login to gradually fix existing users whose con

Get a batch of sandboxed conversations given their ids. Return None for any missing. Accepts UUIDs as strings (with or without dashes) and conver

* Build the full URL for V1 runtime-specific endpoints * @param conversationUrl The conversation URL (e.g., "http://localhost:54928/api/conversatio

Build a view from a webhook payload. ``keycloak_user_id`` is the OpenHands user that **installed** the webhook (looked up from the ``

Factory to create properly mocked async session context manager.

Create or update a conversation and return the conversation ID.

Helper to create provider tokens as MappingProxyType.

Create a new user. Identity-preservation contract (load-bearing for ``OrgStore.delete_org_cascade``): both ``Org.id`` and ``User.id``

Create a new verified model. Args: model_name: The model identifier provider: The provider name is_enable

Create a Jira view with repository already selected. This factory method: 1. Creates the view with payload and auth context 2

Delete a user from Keycloak. This method is used to clean up user accounts that were created but should not exist (e.g., duplicate em

Delete organization with complete cleanup of all associated data. This method performs the complete organization deletion workflow:

Union of the member-level and launched-profile-level skill deny-lists. A skill disabled at EITHER level stays off. The member's deny-list rides

Encrypt a plaintext string using JWE. New data is always encrypted with JWE. Use :meth:`decrypt_value` to decrypt, which also handles

* Get the url for the conversation. If

Proxy ``GET /api/git/changes`` on the conversation's runtime.

Get hooks currently configured in the workspace for this conversation. This endpoint loads hooks from the conversation's project directory in the

Get current user's Jira DC integration details.

Return the deployment default LLM base URL.

Return the deployment default LLM model.

Get the first owner in an organization who accepted the Terms of Service. This user is considered the super admin for that org in self-hosted

Get or create a system API key for a user on behalf of an internal service. If a key with the given name already exists for this user/org and

Get a page of repositories for the authenticated user

Get the title and description of a pull request. Args: workspace: Bitbucket workspace slug. repo_slug: Repository slu

Get the project root directory for a conversation. When a repository is selected, the project root is the cloned repo directory at {working_d

Return provider tokens. Args: as_env_vars: When True, return a ``dict[str, str]`` mapping env var names (e.g. ``g

Get a single sandbox spec, returning None if not found.

Given a conversation_id and event_id, retrieve an event if the conversation is shared.

Get user by email address. This method looks up a user by their email address. Note that email addresses may not be unique across all

Get the current user_id. Used for dependency injection - the api key header is used here to signal the requirement in OpenAPI docs

Get the user's proactive conversation setting. Args: user_id: The keycloak user ID Returns: True if proactive conversations

Bulk fetch webhooks for multiple resources. This is more efficient than fetching one at a time in a loop. Args: project_

Handle callback processing errors with appropriate logging and user messages. This centralizes the error handling logic for V1 callback processor

Extract repository names as 'owner/repo' from URLs and direct mentions. Supports cloud and self-hosted Git providers: GitHub / GitHub Enterprise,

Check if a key name indicates a system key.

Check if an invitation token has expired. Args: invitation: The invitation to check Returns: bool: True if e