curl --request POST \
--url https://api.reasonmachines.com/v3/organizations/{orgId}/onboarding/import/summary \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"env_file_count": 5000,
"project_count": 5000,
"detected_secrets": [
{
"name": "<string>",
"description": "<string>"
}
],
"imported_secret_count": 5000
}
'import requests
url = "https://api.reasonmachines.com/v3/organizations/{orgId}/onboarding/import/summary"
payload = {
"env_file_count": 5000,
"project_count": 5000,
"detected_secrets": [
{
"name": "<string>",
"description": "<string>"
}
],
"imported_secret_count": 5000
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
env_file_count: 5000,
project_count: 5000,
detected_secrets: [{name: '<string>', description: '<string>'}],
imported_secret_count: 5000
})
};
fetch('https://api.reasonmachines.com/v3/organizations/{orgId}/onboarding/import/summary', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.reasonmachines.com/v3/organizations/{orgId}/onboarding/import/summary",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'env_file_count' => 5000,
'project_count' => 5000,
'detected_secrets' => [
[
'name' => '<string>',
'description' => '<string>'
]
],
'imported_secret_count' => 5000
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.reasonmachines.com/v3/organizations/{orgId}/onboarding/import/summary"
payload := strings.NewReader("{\n \"env_file_count\": 5000,\n \"project_count\": 5000,\n \"detected_secrets\": [\n {\n \"name\": \"<string>\",\n \"description\": \"<string>\"\n }\n ],\n \"imported_secret_count\": 5000\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.reasonmachines.com/v3/organizations/{orgId}/onboarding/import/summary")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"env_file_count\": 5000,\n \"project_count\": 5000,\n \"detected_secrets\": [\n {\n \"name\": \"<string>\",\n \"description\": \"<string>\"\n }\n ],\n \"imported_secret_count\": 5000\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.reasonmachines.com/v3/organizations/{orgId}/onboarding/import/summary")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"env_file_count\": 5000,\n \"project_count\": 5000,\n \"detected_secrets\": [\n {\n \"name\": \"<string>\",\n \"description\": \"<string>\"\n }\n ],\n \"imported_secret_count\": 5000\n}"
response = http.request(request)
puts response.read_body{
"handoff": "<string>"
}{
"error": "prompt_required"
}{
"error": "missing_bearer",
"message": "Authorization required"
}{
"error": "missing_scope",
"required_scope": "sessions:read"
}{
"error": {
"type": "rate_limited",
"message": "This API key exceeded its request-rate limit"
}
}Create a local onboarding import handoff
Creates a short-lived browser handoff containing secret names and coarse source descriptions. Secret values and local paths are never accepted.
Scope:org:writecurl --request POST \
--url https://api.reasonmachines.com/v3/organizations/{orgId}/onboarding/import/summary \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"env_file_count": 5000,
"project_count": 5000,
"detected_secrets": [
{
"name": "<string>",
"description": "<string>"
}
],
"imported_secret_count": 5000
}
'import requests
url = "https://api.reasonmachines.com/v3/organizations/{orgId}/onboarding/import/summary"
payload = {
"env_file_count": 5000,
"project_count": 5000,
"detected_secrets": [
{
"name": "<string>",
"description": "<string>"
}
],
"imported_secret_count": 5000
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
env_file_count: 5000,
project_count: 5000,
detected_secrets: [{name: '<string>', description: '<string>'}],
imported_secret_count: 5000
})
};
fetch('https://api.reasonmachines.com/v3/organizations/{orgId}/onboarding/import/summary', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.reasonmachines.com/v3/organizations/{orgId}/onboarding/import/summary",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'env_file_count' => 5000,
'project_count' => 5000,
'detected_secrets' => [
[
'name' => '<string>',
'description' => '<string>'
]
],
'imported_secret_count' => 5000
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.reasonmachines.com/v3/organizations/{orgId}/onboarding/import/summary"
payload := strings.NewReader("{\n \"env_file_count\": 5000,\n \"project_count\": 5000,\n \"detected_secrets\": [\n {\n \"name\": \"<string>\",\n \"description\": \"<string>\"\n }\n ],\n \"imported_secret_count\": 5000\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.reasonmachines.com/v3/organizations/{orgId}/onboarding/import/summary")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"env_file_count\": 5000,\n \"project_count\": 5000,\n \"detected_secrets\": [\n {\n \"name\": \"<string>\",\n \"description\": \"<string>\"\n }\n ],\n \"imported_secret_count\": 5000\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.reasonmachines.com/v3/organizations/{orgId}/onboarding/import/summary")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"env_file_count\": 5000,\n \"project_count\": 5000,\n \"detected_secrets\": [\n {\n \"name\": \"<string>\",\n \"description\": \"<string>\"\n }\n ],\n \"imported_secret_count\": 5000\n}"
response = http.request(request)
puts response.read_body{
"handoff": "<string>"
}{
"error": "prompt_required"
}{
"error": "missing_bearer",
"message": "Authorization required"
}{
"error": "missing_scope",
"required_scope": "sessions:read"
}{
"error": {
"type": "rate_limited",
"message": "This API key exceeded its request-rate limit"
}
}Authorizations
Your Reason API key from Settings › API keys. New keys use reason_; legacy ara_ keys remain accepted. Keys are capability-scoped: run, mcp:read, mcp:write, secrets:read, secrets:write, sessions:read, sessions:debug, knowledge:read, memory:read, memory:write, skills:read, skills:write, repos:read, repos:write, reviews:read, reviews:write, deployment:read, analytics:read, org:read, org:write, attachments:read, attachments:write, guardrails:read, guardrails:write, network:read, network:write, automations:read, automations:write, agent_auth:read. network:read and network:write are opt-in, excluded from default keys. network:read reads the saved workspace network policy; network:write replaces custom allowed hosts and requires a current organization owner/admin. Legacy project PATCH requests containing network_allowed_hosts also require network:write plus their existing run scope and project management permission; saved project hosts do not affect current session egress. Only owners/admins can mint or manage keys with network:write; keys cannot grant themselves more authority. See /docs/network-policies for replacement semantics and runtime applicability. mcp:write manages MCP server configuration only; it does not authorize remote MCP-tool execution. sessions:read reads sessions, including the assistant, reasoning and tool activity in their events. sessions:debug is privileged: only for organization owners/admins, it expands session events to the full diagnostic projection (diagnostic event kinds, status text and raw event metadata).
Path Parameters
Organization id or slug. Resolve it with GET /v3/self.
Body
Number of environment files the local scan read; shown as context to the person approving the import.
0 <= x <= 10000Number of projects the local scan covered; shown as context to the person approving the import.
0 <= x <= 10000The secrets the scan found, by name and source, for the person to approve in the browser before any value leaves the CLI. Omitted means none were found.
500Show child attributes
Show child attributes
Sent only by older CLIs: secrets they imported before approval existed. Current clients omit it and send detected_secrets.
0 <= x <= 10000Response
A short-lived opaque browser handoff.
Opaque, short-lived token for this handoff; pass it as handoff to getOnboardingImportDecision and completeOnboardingImport.

