Reference

Glossary

Terms Tether uses in a narrower sense than the industry does. Where a word is legacy and no longer means what it looks like it means, that is said plainly.

Acknowledgement

The acknowledgeHighRisk: true flag on a confirm call. Required for writes registered elevated or high risk, and for a write whose declared value is at or above the configured threshold — or could not be read at all. Intended to represent a second, deliberate gesture in your interface, not a constant in your client. See Actions.

Action

A staged write. Persisted with an id, the tool, its arguments, the tenant it belongs to, the user it is attributed to, and an expiry. An action is a proposal until somebody confirms it.

Block

One typed element of a response — text, kpi, table, ranked_list, stacked_bar, quick_replies, footnote. See Block types.

Breaker

The spend guard that reads the ledger before a turn is allowed to make a model call. Four independent caps: tenant-daily, tenant-monthly, platform-daily, platform-monthly. See Cost and quotas.

Capability mode

Standard or Deep. Deep buys the heavier model, a higher tool-turn ceiling, and any tool registered deep_analysis_only. Requested per turn, clamped to Standard on plans that do not allow it.

Catalog

The complete set of tools a tenant has registered. Versioned rather than updated in place, and the entire universe of what a model can call.

Claim

The compare-and-set that flips a staged action from pending to executing. Exactly one concurrent confirm wins it; the rest never reach your endpoint.

Confirm

POST /v1/actions/{id}/confirm. The only call in the system that causes a write to reach your endpoint.

Degradation

What happens when a model's output cannot be repaired into a valid document: the raw text is wrapped in a single text block and returned as a valid response. You always receive a renderable document.

Domain

A grouping label on a tool — orders, billing — used for routing and telemetry. Unrelated to a DNS domain.

Domain pack

Per-tenant vocabulary and prompt overrides that would make the assistant sound like your product rather than like the engine's origin. The table exists; nothing populates or reads it yet.

Envelope

The signed JSON body Tether posts to your tool endpoint. See Request envelope.

Idempotency key

X-Tether-Idempotency-Key, matching request_id in the body. On a confirmed write it is the action id, stable across retries of the same confirmation — key your own deduplication on it.

Insight

An unprompted analysis over a scope, returned in the same block contract as chat. See Insights.

Ledger

The append-only spend record — one row per model call, with tokens, model, surface and estimated cost. The breaker reads it; billing would too.

Organization id

The tenant identifier, resolved from the API key. Appears on the wire as tenant.organization_id.

Pending action

A staged write that has not yet been confirmed, expired, or executed. Surfaced on the turn that created it, and listable via GET /v1/actions.

Preview

What a write tool returns to the model instead of a result: an envelope saying the action was staged, with its id and expiry. Nothing was called.

Repair

The single pass that runs when a model's output fails validation — recoverable problems like a stray code fence or a block missing its id are corrected. Failure falls through to degradation.

Risk

low, elevated or high, declared per write tool. Anything above low requires an acknowledgement at confirm time. Meaningless on a read, and rejected there.

Route

The deterministic classification a turn receives before any model call — navigation, general conversation, analysis, and so on. Decides whether tools and context are offered at all.

Scope

The optional narrower boundary inside a tenant: a site, ledger, region, workspace. Set with X-Tether-Scope-Id, passed to your endpoint as tenant.scope_id, and gates tools registered requires_scope.

Session

A conversation thread, identified by session_id. History is scoped by tenant, owner (the verified customer, the staff user, or for an unverified visitor the session itself) and session together. A guest's session is continued only by the guest it was opened for.

Signing secret

The per-tenant HMAC key Tether signs outbound tool calls with. Not the API key — that authenticates you to Tether, this authenticates Tether to you.

Staged write

A write that has been proposed and persisted but not executed. The reason a model can be given mutating tools at all.

Surface

Two unrelated meanings, both in use:

Tool surface — chat or agent, controlling which turns may be offered a tool.
Client surface — web, mobile or unknown, from X-Client-Surface, affecting retrieval and telemetry.