List Capabilities

Return the capabilities in your account — plugins, built-ins, and connectors.

GET https://api.noorle.com/v1/capabilities

Request

curl "https://api.noorle.com/v1/capabilities?limit=20&offset=0" \
  -H "Authorization: Bearer ak-YOUR_KEY"

import requests

resp = requests.get(
    "https://api.noorle.com/v1/capabilities",
    params={"limit": 20, "offset": 0},
    headers={"Authorization": "Bearer ak-YOUR_KEY"},
    timeout=30,
)
capabilities = resp.json()["data"]

const resp = await fetch(
  "https://api.noorle.com/v1/capabilities?limit=20&offset=0",
  { headers: { Authorization: "Bearer ak-YOUR_KEY" } },
);
const { data: capabilities } = await resp.json();

Query parameters

Parameter	Type	Required	Description
`limit`	integer	No	Maximum rows to return. Capped at 100 even if you ask for more. Omit it and every capability in the account comes back — there is no default cap
`offset`	integer	No	Rows to skip

Rows are ordered by created_at descending — newest capability first.

These are the only two parameters this endpoint accepts. There is no type, namespace, or search filter — filter client-side on the returned rows.

Response

The payload is wrapped in a data envelope. There is no total count and no echo of limit / offset.

{
  "data": [
    {
      "id": "0198f0c2-1a3d-7c41-9b2e-8f5a6d3c1e07",
      "account_id": "0198f0c2-0b11-7a2f-8c9d-4e1b2a7f6c35",
      "name": "my-plugin",
      "description": "Does useful things",
      "namespace": "my-plugin",
      "logo_url": null,
      "specifications": {
        "type": "plugin",
        "active_version": 1,
        "versions": [ /* ... */ ]
      },
      "is_active": true,
      "audit_info": {
        "created_at": "2026-08-01T10:30:45Z",
        "created_by": "0198f0c2-0b11-7a2f-8c9d-4e1b2a7f6c35"
      }
    }
  ]
}

Row fields

Field	Type	Description
`id`	UUID	Capability id
`account_id`	UUID	Owning account
`name`	string	Display name
`description`	string	Omitted when unset
`namespace`	string \| null	The tool-name prefix for this capability (see below)
`logo_url`	string \| null	Icon URL
`specifications`	object	Kind-tagged spec — see below
`is_active`	boolean	Whether the capability is enabled
`audit_info`	object	`created_at`/`created_by` always present; `updated_at`/`updated_by` are omitted until the row has actually been updated

The `specifications` object

specifications is a tagged union. Its type field is one of plugin, builtin, or connector, and the remaining fields depend on that tag.

type: plugin

Carries active_version and the list of uploaded versions. A newly registered plugin has active_version: 0, meaning no version has been activated yet — tool dispatch against it fails until one is.

type: builtin

Carries kind, sort_order, and config — not just kind — plus metadata when set. kind is one of Files, WebSearch, HttpClient, KnowledgeRetrieval, CodeRunner, Sandbox, Computer, Browser, PluginBuilder, SkillBuilder, Memory. All eleven are seeded into every account at signup.Sandbox also deserializes from the legacy name VirtualMachine.

type: connector

A REST connector, an MCP registry server, or a custom MCP server.

List does not redact this row. A connector’s auth_config comes back as {"ciphertext": "..."} — the encrypted bytes, not the plaintext. Nothing decrypts on this path, but the ciphertext itself is not withheld.

Namespaces and tool names

namespace is the prefix a capability’s tools carry on the wire. The wire name is {namespace}_{tool} — a single underscore, no double underscore. The namespaces seeded for the eleven built-ins are:

Built-in	Namespace	Example tool name
Files	`file`	`file_read`
Web Search	`web`	`web_search`
HTTP Client	`http`	`http_request`
Knowledge Retrieval	`knowledge`	`knowledge_search`
Code Runner	`run`	`run_python`
Sandbox	`sandbox`	`sandbox_exec`
Computer	`computer`	`computer_run`
Browser	`browser`	`browser_markdown`
Plugin Builder	`plugin`	`plugin_build`
Skill Builder	`skill`	`skill_manage`
Memory	`memory`	`memory_recall`

Namespaces are unique per account. The eleven above are what an account is seeded with at signup; plugin and connector namespaces are assigned per capability. Read namespace off the row rather than assuming it — that is what this endpoint is for.

Status codes

Code	Meaning
200	Success
403	Missing, invalid, or insufficiently privileged credential

See Errors and rate limits for why credential failures return 403 rather than 401 on this surface.

Scope of this endpoint

This is a read-only listing. There is no POST, PATCH, or DELETE on /v1/capabilities, and no GET /v1/capabilities/{id}. Creating, editing, and deleting capabilities happens in the Portal, with one exception: plugin upload registers a new plugin version over the API. That is a statement about this collection, not about the management API as a whole — other parts of the API do accept writes. See API Overview for what the surface covers.

Overview

REST API

MCP Protocol

A2A Protocol

Noorle CLI

List Capabilities

Request

Query parameters

Response

Row fields

The `specifications` object

Namespaces and tool names

Status codes

Scope of this endpoint

​Request

​Query parameters

​Response

​Row fields

​The specifications object

​Namespaces and tool names

​Status codes

​Scope of this endpoint

​Related

Request

Query parameters

Response

Row fields

The `specifications` object

Namespaces and tool names

Status codes

Scope of this endpoint

Related