> ## Documentation Index
> Fetch the complete documentation index at: https://docs.atollhq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List authorized heartbeat management targets

> Existing human management rules or an explicit heartbeat.manage_self/heartbeat.manage_others grant. Other excludes self. Real enabled agent identities only; integrations/setup keys are excluded. Resource visibility is the current caller/target intersection. Project destinations separately require webhook.dispatch and both principals project access; organization destinations require webhook.organization_manage. Private/no-store responses. PUT is full replacement, preview persists nothing, test queues an empty labeled payload under the actual tester. Authority is rechecked before queue/retry; in-flight requests cannot be recalled. Authorization precedes counts and pagination.



## OpenAPI

````yaml /openapi.json get /api/orgs/{id}/heartbeat-targets
openapi: 3.1.0
info:
  title: Atoll API
  version: 1.0.0
  description: >-
    REST API for Atoll project management, agent collaboration, strategy
    tracking, and integrations.
servers:
  - url: https://atollhq.com
    description: Production
security:
  - bearerAuth: []
tags:
  - name: Authentication
  - name: Organizations
  - name: Projects
  - name: Project access
  - name: Issues
  - name: Issue details
  - name: Milestones
  - name: Artifacts
  - name: Strategy
  - name: Members and agents
  - name: Planning
  - name: Setup
  - name: Integrations and billing
  - name: Notifications and public
  - name: Private inbox
  - name: Agent executions
  - name: Human attention
  - name: Products
paths:
  /api/orgs/{id}/heartbeat-targets:
    get:
      tags:
        - Agents
      summary: List authorized heartbeat management targets
      description: >-
        Existing human management rules or an explicit
        heartbeat.manage_self/heartbeat.manage_others grant. Other excludes
        self. Real enabled agent identities only; integrations/setup keys are
        excluded. Resource visibility is the current caller/target intersection.
        Project destinations separately require webhook.dispatch and both
        principals project access; organization destinations require
        webhook.organization_manage. Private/no-store responses. PUT is full
        replacement, preview persists nothing, test queues an empty labeled
        payload under the actual tester. Authority is rechecked before
        queue/retry; in-flight requests cannot be recalled. Authorization
        precedes counts and pagination.
      operationId: list_heartbeat_management_targets
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
            format: uuid
        - name: limit
          in: query
          schema:
            type: integer
            minimum: 1
            maximum: 100
            default: 25
        - name: offset
          in: query
          schema:
            type: integer
            minimum: 0
            default: 0
      responses:
        '200':
          description: Bounded authorized target identities
          content:
            application/json:
              schema:
                type: object
                required:
                  - targets
                  - total
                  - limit
                  - offset
                properties:
                  targets:
                    type: array
                    maxItems: 100
                    items:
                      type: object
                      required:
                        - id
                        - display_name
                        - lifecycle_state
                      properties:
                        id:
                          type: string
                          format: uuid
                        display_name:
                          type:
                            - string
                            - 'null'
                        lifecycle_state:
                          type: string
                          enum:
                            - enabled
                            - disabled
                            - revoked
                      additionalProperties: false
                  total:
                    type: integer
                  limit:
                    type: integer
                  offset:
                    type: integer
                additionalProperties: false
        '403':
          $ref: '#/components/responses/Forbidden'
      security:
        - humanSessionAuth: []
        - bearerAuth: []
components:
  responses:
    Forbidden:
      description: Authenticated but not allowed
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  schemas:
    Error:
      type: object
      description: >-
        Common error responses contain error. Shared missing-auth and
        unknown-API responses also contain a stable code.
      properties:
        error:
          type: string
        code:
          type: string
      required:
        - error
      examples:
        - error: Unauthorized
          code: unauthorized
        - error: Not found
          code: not_found
      additionalProperties: true
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: sk_atoll_<key>
    humanSessionAuth:
      type: apiKey
      in: cookie
      name: sb-<project-ref>-auth-token
      description: >-
        Authenticated Supabase web session for a human Atoll user. The cookie
        name includes the deployment's Supabase project reference and may be
        chunked.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.