> ## Documentation Index > Fetch the complete documentation index at: https://docs.outerlayer.ai/llms.txt > Use this file to discover all available pages before exploring further. # Save or replace a build variable of the factory > Stores the value in Supabase Vault under the name, in place of any value the factory saved under it, and deletes the old secret. A name that is not a variable name, or that the runner sets itself (`OUTERLAYER_API_KEY`, the model credential and the commit identity, for some), is refused with `invalid_managed_build_setting` (422) and nothing is saved. So is a value with fewer than 3 characters other than spaces at either end, which the runner could not remove from logs and transcripts. A factory holds at most 100 variables. Answers the name, who saved it and when, never the value. The body can also name a `service`. A managed build then holds a stand-in for the variable, and the runner sets the value in the service's header on each request the build sends to the service's own host. The runner matches on the host and the start of the path of the address, so the build needs no tool variables and no change to a repository's registry settings. A service that breaks a rule (an address that is not HTTPS, holds a login or names a private host, a header with no `${VALUE}`, or the same host and path as another variable) is refused with `invalid_managed_build_setting` (422) and nothing is saved. A factory sends at most 16 variables to a service. A save with a service and no value changes only the service of a variable that exists, and only while the service keeps its host. A save that sends the stored value to another host, or removes the service, needs the value in the body, so a caller who cannot read the value cannot redirect it. Answers 404 unless the `managed_runners` flag is on for the organization. ## OpenAPI ````yaml /openapi.yaml put /v1/apps/{appId}/build-variables/{name} openapi: 3.0.3 info: contact: email: hello@outerlayer.ai url: https://www.outerlayer.ai description: >- The OuterLayer Gateway API lets you ingest coding-agent sessions and record evidence of work programmatically. Most teams reach it through the `outerlayer` CLI, which calls it for them. Call it directly to build your own integration or to automate what the dashboard does. Versioning: every endpoint is prefixed with `/v1/`. Breaking changes ship under a new version prefix (`/v2/`, etc.) with a 90-day-minimum deprecation window; anything additive lands on the current prefix. Vocabulary: the dashboard calls this API's `app` a **factory** — the unit that owns a set of repositories, the agent sessions worked on them, and the evidence they produce. They are the same entity. The API keeps `app` in its paths, headers, and field names because those are a published contract; only the product surface was renamed. title: OuterLayer Gateway API version: '1.0' servers: - description: Production (OuterLayer Cloud) url: https://api.outerlayer.ai - description: Local dev server (self-hosted gateway) url: http://localhost:9418 security: - AppId: [] BearerAuth: [] tags: - description: >- What a CLI login token can read about its owner without naming a factory, such as the factories they can use. name: Account - description: >- The route a fleet machine asks for its next managed build on. A fleet machine is a machine OuterLayer operates. name: Fleet - description: >- The CLI version a gateway names to its runners, set with the gateway's runner version key. name: Runner version - description: >- Coding-agent session ingest (outerlayer sync) and content-addressed session images. name: Agents - description: >- Evidence artifacts (screenshots, recordings, reports, logs) emitted as proof of a change and anchored to pull requests. name: Artifacts - description: >- Pass/fail outcomes of checks run in your own CI or compute, anchored to pull requests with the run URL as proof. name: Emitted Results - description: >- The acceptance criteria of a work item, recorded as one list. The Criteria tab, its count and the item status read that list. name: Criteria - description: >- What any agent found wrong about a change under review or about a rule it ran on, recorded on a work item. name: Findings - description: >- Find, file and edit the issue a spec lives in, through OuterLayer, with no tracker credential on the caller's side. name: Specs - description: >- Add or remove a source's statement that it is working on an issue or pull request, and read what is currently live. name: Work Items - description: >- What the factory's GitHub App installation lets builds do on each connected repository, and whether each default branch requires a pull request. name: Repositories - description: >- The runs of a schedule automation: a runner claims a run, asks for its read token and ends it, and the run's agent reports each issue it found or that it found nothing. name: Schedule runs - description: >- A runner host's heartbeat — its CLI version, slots and last request for work — and the factory's list of hosts with a derived status. name: Hosts - description: Query server feature availability. name: Capabilities - description: Per-model LLM pricing data. Public, unauthenticated. name: Pricing - description: >- Create, list, and revoke factory API keys. Plaintext returned exactly once at creation. name: API Keys - description: >- Factory CRUD — a factory is owned by an organization and is the unit every other resource hangs off. Lets a headless agent provision one without the dashboard. name: Apps - description: >- Agent-coding session list and full transcript reads, with actor-privacy controls for machine keys. name: Sessions - description: >- Per-model token spend and fleet-wide agent behavior tiles, including two-window comparisons. name: Metrics - description: Synced-commit history of the app's `.outerlayer/` context tree. name: Context - description: >- Session→PR attribution: which agent sessions produced which pull requests, and what each attributed PR cost. name: PRs - description: Service health checks. name: Health - description: >- Org member and role administration, authenticated with an org-scoped management API key (`olk_…`) minted in the dashboard's settings. name: Org Management - description: OAuth 2.1 discovery metadata for MCP connector clients. name: OAuth paths: /v1/apps/{appId}/build-variables/{name}: put: tags: - Apps summary: Save or replace a build variable of the factory description: >- Stores the value in Supabase Vault under the name, in place of any value the factory saved under it, and deletes the old secret. A name that is not a variable name, or that the runner sets itself (`OUTERLAYER_API_KEY`, the model credential and the commit identity, for some), is refused with `invalid_managed_build_setting` (422) and nothing is saved. So is a value with fewer than 3 characters other than spaces at either end, which the runner could not remove from logs and transcripts. A factory holds at most 100 variables. Answers the name, who saved it and when, never the value. The body can also name a `service`. A managed build then holds a stand-in for the variable, and the runner sets the value in the service's header on each request the build sends to the service's own host. The runner matches on the host and the start of the path of the address, so the build needs no tool variables and no change to a repository's registry settings. A service that breaks a rule (an address that is not HTTPS, holds a login or names a private host, a header with no `${VALUE}`, or the same host and path as another variable) is refused with `invalid_managed_build_setting` (422) and nothing is saved. A factory sends at most 16 variables to a service. A save with a service and no value changes only the service of a variable that exists, and only while the service keeps its host. A save that sends the stored value to another host, or removes the service, needs the value in the body, so a caller who cannot read the value cannot redirect it. Answers 404 unless the `managed_runners` flag is on for the organization. operationId: put-app-build-variable parameters: - in: path name: appId required: true schema: format: uuid type: string - in: path name: name required: true schema: maxLength: 1000 minLength: 1 type: string requestBody: content: application/json: schema: properties: service: additionalProperties: false description: >- Send the variable to this service through the runner. `null` removes the service. Leave it out to keep the service the variable has. nullable: true properties: header: additionalProperties: false properties: name: description: >- The header the runner sets on each request it forwards to the service. maxLength: 200 type: string value: description: >- The header value. `${VALUE}` is where the variable's value goes, for example `Bearer ${VALUE}`. maxLength: 2000 type: string required: - name - value type: object upstream: description: >- The service's HTTPS address. It carries no login, query or fragment and names a public host. maxLength: 2000 type: string required: - upstream - header type: object value: description: >- The variable's value. The gateway stores it in Vault and never returns it. Leave it out to change only the header of a service at the same host. A save that changes the host, adds a service or removes it needs the value. maxLength: 32768 minLength: 1 type: string type: object responses: '200': content: application/json: schema: properties: data: properties: name: type: string service: additionalProperties: false properties: header: additionalProperties: false properties: name: description: >- The header the runner sets on each request it forwards to the service. maxLength: 200 type: string value: description: >- The header value. `${VALUE}` is where the variable's value goes, for example `Bearer ${VALUE}`. maxLength: 2000 type: string required: - name - value type: object host: description: >- The upstream's host, with its port when it is not 443. type: string upstream: description: >- The service's HTTPS address. It carries no login, query or fragment and names a public host. maxLength: 2000 type: string required: - upstream - header - host type: object setAt: type: string setBy: type: string required: - name - setBy - setAt type: object required: - data type: object description: The value was saved. '400': content: application/json: schema: properties: error: properties: code: type: string message: type: string required: - code - message type: object required: - error type: object description: >- The body names neither a value nor a service, or a field has the wrong type. '401': content: application/json: schema: properties: error: properties: code: type: string message: type: string required: - code - message type: object required: - error type: object description: Missing or invalid API key. '403': content: application/json: schema: properties: error: properties: code: type: string message: type: string required: - code - message type: object required: - error type: object description: Caller lacks 'factory.update' permission. '404': content: application/json: schema: properties: error: properties: code: type: string message: type: string required: - code - message type: object required: - error type: object description: >- No such factory, or managed builds are not turned on for the organization. '422': content: application/json: schema: properties: error: properties: code: type: string message: type: string required: - code - message type: object required: - error type: object description: >- The name is refused, the value has fewer than 3 characters other than spaces at either end, the service breaks a rule, or the factory holds the most variables (`invalid_managed_build_setting`). Nothing was saved. components: securitySchemes: AppId: description: Factory id the request is scoped to. in: header name: X-Outerlayer-App-Id type: apiKey BearerAuth: description: API key (sk_outerlayer_*) scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.