Skyvern

Overview

Skyvern automates browser workflows with LLMs and computer vision: it fills forms, extracts data, and completes multi-step tasks on websites. Use a Skyvern API key to make authenticated API calls through Alter Vault without exposing the key in code.

Property	Value
Provider ID	skyvern
Category	Developer Tools
Credential Type	API Key

Step 1: Get Credentials

Open Skyvern Settings

Sign in to Skyvern Cloud and open app.skyvern.com/settings.

Copy the key

Reveal the API key with the eye icon, or copy it with the copy icon.

Warning

A Skyvern API key has full access to its organization. Skyvern has no read-only or per-endpoint keys, so use a separate Skyvern organization for each environment.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add Skyvern

Go to Managed Secrets > Add Provider > Skyvern.

Enter credentials

Paste the API key into the credential field.

Save

Click Save. You’ll receive a grant_id to use with the SDK. Alter checks the key with Skyvern when you save, and rejects a key Skyvern does not accept.

Using in Code

response = await alter_app.request(
    HttpMethod.POST,
    "https://api.skyvern.com/v1/run/tasks",
    grant_id="YOUR_GRANT_ID",
    json={"url": "https://example.com", "prompt": "Extract the pricing table"},
)

Tasks run asynchronously. The response carries a run_id; poll GET https://api.skyvern.com/v1/runs/{run_id} for the status and output.

Notes

• The key is injected via the x-api-key header, with no prefix.
• Skyvern deletes agents and credentials with POST .../delete, not the HTTP DELETE method. A rule that blocks only the DELETE method does not stop them; target the delete family instead.
• Skyvern renamed Workflows to Agents. The older /v1/workflows paths still work and are classified as the same operations below.
• Starting a run (a task, agent, script, SDK action, retry, or a schedule that starts runs) is in the write, send, payment and delete families. A run drives a real browser with the organization’s stored credentials, so it can send messages or pay on any website; a send or payment rule covers it.
• Opening, listing, reading, updating or extending a browser session returns its remote-control (CDP) address. Whoever holds that address can drive the browser directly, outside Alter, so these operations are treated like starting a run (the reads also stay in the read family).
• Stored-credential operations are also in the admin family, so an admin rule stops an agent from adding, replacing or deleting the credentials that runs log in with.
• The operations below cover runs, agents, schedules, scripts, browser sessions and profiles, uploaded files, and stored credentials. Folders, tags, custom LLMs and job recipes are not cataloged: once any operation rule applies to the grant, calls to them are denied.

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path	Notes
run_task_v1_run_tasks_post	delete, payment, send, write	POST	/v1/run/tasks	—
login_v1_run_tasks_login_post	delete, payment, send, write	POST	/v1/run/tasks/login	—
download_files_v1_run_tasks_download_files_post	delete, payment, send, write	POST	/v1/run/tasks/download_files	—
run_workflow_v1_run_agents_post	delete, payment, send, write	POST	/v1/run/agents	also served at /v1/run/workflows
retry_workflow_run_v1_workflows_runs__workflow_run_id__retry_post	delete, payment, send, write	POST	/v1/agents/runs/{workflow_run_id}/retry	also served at /v1/workflows/runs/{workflow_run_id}/retry
run_sdk_action_v1_sdk_run_action_post	delete, payment, send, write	POST	/v1/sdk/run_action	—
get_runs_v2_v1_runs_get	read	GET	/v1/runs	—
get_run_v1_runs__run_id__get	read	GET	/v1/runs/{run_id}	—
get_run_timeline_v1_runs__run_id__timeline_get	read	GET	/v1/runs/{run_id}/timeline	—
get_run_artifacts_v1_runs__run_id__artifacts_get	read	GET	/v1/runs/{run_id}/artifacts	—
get_artifact_content_v1_artifacts__artifact_id__content_get	read	GET	/v1/artifacts/{artifact_id}/content	—
cancel_run_v1_runs__run_id__cancel_post	write	POST	/v1/runs/{run_id}/cancel	—
bulk_cancel_runs_v1_runs_cancel_post	write	POST	/v1/runs/cancel	—
retry_run_webhook_v1_runs__run_id__retry_webhook_post	write	POST	/v1/runs/{run_id}/retry_webhook	—
get_workflow_runs_v1_workflows_runs_get	read	GET	/v1/agents/runs	also served at /v1/workflows/runs
get_workflow_runs_by_id_v1_workflows__workflow_id__runs_get	read	GET	/v1/agents/{workflow_id}/runs	also served at /v1/workflows/{workflow_id}/runs
get_workflows_v1_workflows_get	read	GET	/v1/agents	also served at /v1/workflows
get_workflow_v1_workflows__workflow_permanent_id__get	read	GET	/v1/agents/{workflow_permanent_id}	also served at /v1/workflows/{workflow_permanent_id}
get_workflow_versions_v1_workflows__workflow_permanent_id__versions_get	read	GET	/v1/agents/{workflow_permanent_id}/versions	also served at /v1/workflows/{workflow_permanent_id}/versions
create_workflow_v1_agents_post	write	POST	/v1/agents	also served at /v1/workflows
update_workflow_v1_agents__workflow_id__post	write	POST	/v1/agents/{workflow_id}	also served at /v1/workflows/{workflow_id}
delete_workflow_v1_agents__workflow_id__delete_post	delete	POST	/v1/agents/{workflow_id}/delete	also served at /v1/workflows/{workflow_id}/delete
reset_workflow_browser_profile	delete, write	POST	/v1/agents/{workflow_permanent_id}/browser_session/reset_profile	also served at /v1/workflows/{workflow_permanent_id}/browser_session/reset_profile
schedules_list_all	read	GET	/v1/schedules	—
schedules_list	read	GET	/v1/agents/{workflow_permanent_id}/schedules	also served at /v1/workflows/{workflow_permanent_id}/schedules
schedules_get	read	GET	/v1/agents/{workflow_permanent_id}/schedules/{workflow_schedule_id}	also served at /v1/workflows/{workflow_permanent_id}/schedules/{workflow_schedule_id}
schedules_create	delete, payment, send, write	POST	/v1/agents/{workflow_permanent_id}/schedules	also served at /v1/workflows/{workflow_permanent_id}/schedules
schedules_update	delete, payment, send, write	PUT	/v1/agents/{workflow_permanent_id}/schedules/{workflow_schedule_id}	also served at /v1/workflows/{workflow_permanent_id}/schedules/{workflow_schedule_id}
schedules_enable	delete, payment, send, write	POST	/v1/agents/{workflow_permanent_id}/schedules/{workflow_schedule_id}/enable	also served at /v1/workflows/{workflow_permanent_id}/schedules/{workflow_schedule_id}/enable
schedules_disable	write	POST	/v1/agents/{workflow_permanent_id}/schedules/{workflow_schedule_id}/disable	also served at /v1/workflows/{workflow_permanent_id}/schedules/{workflow_schedule_id}/disable
schedules_cancel	write	POST	/v1/agents/{workflow_permanent_id}/schedules/{workflow_schedule_id}/cancel	also served at /v1/workflows/{workflow_permanent_id}/schedules/{workflow_schedule_id}/cancel
schedules_delete	delete	DELETE	/v1/agents/{workflow_permanent_id}/schedules/{workflow_schedule_id}	also served at /v1/workflows/{workflow_permanent_id}/schedules/{workflow_schedule_id}
get_scripts_v1_scripts_get	read	GET	/v1/scripts	—
get_script_v1_scripts__script_id__get	read	GET	/v1/scripts/{script_id}	—
create_script_v1_scripts_post	write	POST	/v1/scripts	—
deploy_script_v1_scripts__script_id__deploy_post	write	POST	/v1/scripts/{script_id}/deploy	—
run_script_v1_scripts__script_id__run_post	delete, payment, send, write	POST	/v1/scripts/{script_id}/run	—
create_browser_session_v1_browser_sessions_post	delete, payment, send, write	POST	/v1/browser_sessions	—
get_browser_sessions_v1_browser_sessions_get	delete, payment, read, send, write	GET	/v1/browser_sessions	—
get_browser_session_v1_browser_sessions__browser_session_id__get	delete, payment, read, send, write	GET	/v1/browser_sessions/{browser_session_id}	—
update_browser_session_v1_browser_sessions__browser_session_id__patch	delete, payment, send, write	PATCH	/v1/browser_sessions/{browser_session_id}	—
extend_browser_session_v1_browser_sessions__browser_session_id__extend_post	delete, payment, send, write	POST	/v1/browser_sessions/{browser_session_id}/extend	—
close_browser_session_v1_browser_sessions__browser_session_id__close_post	delete, write	POST	/v1/browser_sessions/{browser_session_id}/close	—
create_browser_profile_v1_browser_profiles_post	write	POST	/v1/browser_profiles	—
list_browser_profiles_v1_browser_profiles_get	read	GET	/v1/browser_profiles	—
get_browser_profile_v1_browser_profiles__profile_id__get	read	GET	/v1/browser_profiles/{profile_id}	—
get_browser_profile_usage_v1_browser_profiles__profile_id__usage_get	read	GET	/v1/browser_profiles/{profile_id}/usage	—
update_browser_profile_v1_browser_profiles__profile_id__patch	write	PATCH	/v1/browser_profiles/{profile_id}	—
delete_browser_profile_v1_browser_profiles__profile_id__delete	delete	DELETE	/v1/browser_profiles/{profile_id}	—
upload_file_v1_upload_file_post	write	POST	/v1/upload_file	—
delete_file_v1_files__file_id__delete	delete	DELETE	/v1/files/{file_id}	—
create_credential_v1_credentials_post	admin, write	POST	/v1/credentials	—
get_credentials_v1_credentials_get	admin, read	GET	/v1/credentials	—
get_credential_v1_credentials__credential_id__get	admin, read	GET	/v1/credentials/{credential_id}	—
update_credential_v1_credentials__credential_id__update_post	admin, write	POST	/v1/credentials/{credential_id}/update	—
delete_credential_v1_credentials__credential_id__delete_post	admin, delete	POST	/v1/credentials/{credential_id}/delete	—
send_totp_code_v1_credentials_totp_post	write	POST	/v1/credentials/totp	—