> ## Documentation Index > Fetch the complete documentation index at: https://docs.decimal.ai/llms.txt > Use this file to discover all available pages before exploring further. # Resolve skills to install into a project > Resolve each reference to a skill version, a rendering and an install name. One result per item, in order: a refused item comes back as `{"ok": false, "error": {"code": ..., "message": ...}}` and never fails the others. Only the request itself is refused as a whole: more than 100 items, or a `formats` list with nothing this registry renders (422 `format_unsupported`, with `supported`). A result lists every file of the rendering with its sha256 and mode; fetch the bytes from `GET /install/bundles/{version_id}` with the same `install_name`, `render.hash`, `render.format` and `render.variant`. A `ref` is looked up as a skill id (a UUID), then your organization's own skills (by name, then url_slug), then skills it Uses (name, then url_slug), then public skills (url_slug, then name), and last as an install name. An install name is matched in either form; the hashed form of a name with no Latin letters or digits at all (`skill-`) is not looked up, so pass such a skill's id, url_slug or name. `latest` is your organization's latest version of its own skill, and the public head of anyone else's. When that head failed its safety scan, the newest version that passed is chosen and `policy_notes` says so. `safety` is the skill's SkillSafety band; a withheld skill is refused here unless your organization owns it or Uses it, and a blocked one is refused to everyone. Resolving is not counted as an install; fetching the bundle is. ## OpenAPI ````yaml /openapi.json post /api/v1/install/resolve openapi: 3.1.0 info: title: DecimalAI Platform description: Agent Dataset Lifecycle Platform — Backend API version: 0.1.0 servers: - url: https://api.decimal.ai description: Production security: - BearerAuth: [] tags: - name: traces description: >- Ingest, search, and inspect agent execution traces. A trace is the atomic unit of the platform — every other feature (evaluation, compatibility scoring, dataset building) operates on traces. Each trace is auto-tagged with the manifest hash of the agent that produced it. - name: eval-scores description: >- Push, fetch, and aggregate per-trace evaluation scores. Scores carry source provenance (built-in, DeepEval, LangSmith, custom) and feed the unified decision engine, which produces a keep / repair / replay / drop verdict per trace. - name: skills description: >- Manage reusable instruction blocks (SKILL.md files) that modify agent behavior. Skills are first-class manifest components — changes to a skill appear in your regression-check impact reports. Use these endpoints to create, version, fork, and sync skills with your local SKILL.md files. - name: manifests description: >- Register and inspect manifest versions. A manifest is a snapshot of your agent's structural identity (tools, prompts, models, skills) at a point in time. The SDK registers manifests automatically; these endpoints expose the underlying records. - name: datasets description: >- Build versioned SFT/DPO training datasets from manifest-classified, eval-scored traces. Datasets are reproducible — each version locks the manifest and filter set used to build it. Export as JSONL, Parquet, or push to HuggingFace Hub. - name: replay description: >- Re-execute historical traces against a new manifest version. Replay is the deferred-future capability for behavioral verification of agent changes. The SDK creates a replay batch, your worker executes each task, then submits results back here for eval scoring. - name: registry description: >- Browse and install published skills from the public skills registry. Each registry skill carries a SkillScore — an evidence-tiered quality composite computed from real-world evals, benchmarks, and ratings across organizations. Installing creates a fork in your org — edits don't affect the public version. - name: agents description: >- List and inspect agents, plus their multi-agent topology (orchestrator → sub-agent edges discovered from traces). Agents are identified by a stable agent_name string set in your SDK init() call. - name: import description: >- Bulk-import historical traces from another observability platform or a JSONL backup. Useful for migrating from LangSmith / Braintrust / Langfuse. Duplicate trace IDs are silently skipped — re-running an import is safe. paths: /api/v1/install/resolve: post: tags: - install summary: Resolve skills to install into a project description: >- Resolve each reference to a skill version, a rendering and an install name. One result per item, in order: a refused item comes back as `{"ok": false, "error": {"code": ..., "message": ...}}` and never fails the others. Only the request itself is refused as a whole: more than 100 items, or a `formats` list with nothing this registry renders (422 `format_unsupported`, with `supported`). A result lists every file of the rendering with its sha256 and mode; fetch the bytes from `GET /install/bundles/{version_id}` with the same `install_name`, `render.hash`, `render.format` and `render.variant`. A `ref` is looked up as a skill id (a UUID), then your organization's own skills (by name, then url_slug), then skills it Uses (name, then url_slug), then public skills (url_slug, then name), and last as an install name. An install name is matched in either form; the hashed form of a name with no Latin letters or digits at all (`skill-`) is not looked up, so pass such a skill's id, url_slug or name. `latest` is your organization's latest version of its own skill, and the public head of anyone else's. When that head failed its safety scan, the newest version that passed is chosen and `policy_notes` says so. `safety` is the skill's SkillSafety band; a withheld skill is refused here unless your organization owns it or Uses it, and a blocked one is refused to everyone. Resolving is not counted as an install; fetching the bundle is. operationId: resolve_install_api_v1_install_resolve_post parameters: - name: Authorization in: header required: false schema: type: string title: Authorization - name: decimal_session in: cookie required: false schema: anyOf: - type: string - type: 'null' title: Decimal Session requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/ResolveRequest' responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/ResolveResponse' '422': description: >- `too_many_items` (with `max_items`), `format_unsupported` (with `supported`: no format asked for is rendered here), `too_many_formats`, or a malformed body. x-codeSamples: - lang: Bash label: cURL source: |- curl -X POST https://api.decimal.ai/api/v1/install/resolve \ -H "Authorization: Bearer $DECIMAL_API_KEY" -H "Content-Type: application/json" \ -d '{"items": [{"ref": "acme/refund-policy", "version": "latest"}], "taken": {}, "channel": "cli", "purpose": "add"}' components: schemas: ResolveRequest: properties: items: items: {} type: array title: Items description: >- Up to 100 items (20 without an API key), one result each. An item is `{"ref": ..., "version": ...}` or `{"skill_id": ..., "version_id": ...}`. `ref` is a skill id, a registry name or url_slug (your organization's own skills first, then skills it Uses, then public skills) or an install name. `version` is `"latest"` (default) or a number; `version_id` names one exact version. taken: anyOf: - additionalProperties: anyOf: - type: string - type: 'null' type: object - type: 'null' title: Taken description: >- Each install name (folder) the project already uses, mapped to the skill id it holds, or to null for a folder the skills engine does not manage. A skill already in the map keeps its name; otherwise the registry picks around them. Names chosen for earlier items count as taken for later ones. formats: anyOf: - items: type: integer type: array - type: 'null' title: Formats description: >- Up to 8 SKILL.md formats the client reads (default `[1]`). The highest one this registry renders is used; when it renders none of them, the whole request is refused with `format_unsupported`. channel: anyOf: - type: string - type: 'null' title: Channel description: Who is resolving (`cli`, `sdk`, ...). purpose: anyOf: - type: string - type: 'null' title: Purpose description: Why (`add`, `update`, ...). type: object required: - items title: ResolveRequest ResolveResponse: properties: items: items: $ref: '#/components/schemas/ResolveResult' type: array title: Items type: object required: - items title: ResolveResponse ResolveResult: properties: ref: anyOf: - type: string - type: 'null' title: Ref ok: type: boolean title: Ok error: anyOf: - $ref: '#/components/schemas/ItemError' - type: 'null' skill_id: anyOf: - type: string - type: 'null' title: Skill Id org_id: anyOf: - type: string - type: 'null' title: Org Id description: >- The organization this resolve was made as (null without an API key); the SDK records it in the lock. registry_name: anyOf: - type: string - type: 'null' title: Registry Name url_slug: anyOf: - type: string - type: 'null' title: Url Slug install_name: anyOf: - type: string - type: 'null' title: Install Name install_name_base: anyOf: - type: string - type: 'null' title: Install Name Base install_name_disambiguated: anyOf: - type: string - type: 'null' title: Install Name Disambiguated version_id: anyOf: - type: string - type: 'null' title: Version Id version: anyOf: - type: integer - type: 'null' title: Version latest: anyOf: - $ref: '#/components/schemas/VersionPointer' - type: 'null' render: anyOf: - $ref: '#/components/schemas/RenderKey' - type: 'null' body_sha256: anyOf: - type: string - type: 'null' title: Body Sha256 description_sha256: anyOf: - type: string - type: 'null' title: Description Sha256 invocation: anyOf: - type: string - type: 'null' title: Invocation relationship: anyOf: - type: string - type: 'null' title: Relationship description: '`owned`, `used` or `public`.' files: anyOf: - items: $ref: '#/components/schemas/FileHash' type: array - type: 'null' title: Files unavailable: anyOf: - items: $ref: '#/components/schemas/Unavailable' type: array - type: 'null' title: Unavailable policy_notes: anyOf: - items: type: string type: array - type: 'null' title: Policy Notes safety: anyOf: - $ref: '#/components/schemas/Safety' - type: 'null' type: object required: - ok title: ResolveResult ItemError: properties: code: type: string title: Code description: >- `not_found`, `ambiguous` (with `near`), `bad_ref`, `withheld`, `blocked`, `version_unsafe`, `install_name_collision` (with `install_name`) or `render_invalid`. message: type: string title: Message additionalProperties: true type: object required: - code - message title: ItemError VersionPointer: properties: version_id: type: string title: Version Id version: type: integer title: Version type: object required: - version_id - version title: VersionPointer RenderKey: properties: format: type: integer title: Format hash: type: string title: Hash description: >- The render snapshot: the file-visible fields of the version, as rendered. A frozen fetch names it. variant: type: string title: Variant description: >- `authored` for your organization's own original skill, `foreign` otherwise. type: object required: - format - hash - variant title: RenderKey FileHash: properties: path: type: string title: Path sha256: type: string title: Sha256 mode: type: string title: Mode description: '`0644`, or `0755` for an executable script.' type: object required: - path - sha256 - mode title: FileHash Unavailable: properties: path: type: string title: Path reason: type: string title: Reason type: object required: - path - reason title: Unavailable Safety: properties: band: type: string title: Band description: '`clean`, `caution`, `unreviewed` or `blocked`.' withheld: type: boolean title: Withheld type: object required: - band - withheld title: Safety securitySchemes: BearerAuth: type: http scheme: bearer description: Enter your API key (e.g. dai_sk_test_key_001) ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.