# Operations and allowlist

> Which API operations the model can call, and the x-agent hints you can add to your spec.

Source: https://sideagent.dev/docs/operations

Every operation in your spec with an `operationId` can become a tool. Only the ones you allow are exposed to the model. List IDs, or use `tag:reports` to allow a whole tag. New operations are never allowed by default.

## The x-agent extension

Add hints to the spec with the `x-agent` extension on an operation:

```json
"x-agent": {
  "approval": "required",
  "description": "Better text for the model than the summary",
  "invalidates": ["invoices"],
  "responseFields": ["id", "total"]
}
```

- `approval`: force or skip the approval step. See [Approvals](https://sideagent.dev/docs/approvals.md).
- `description`: what the model sees, in place of the spec's summary.
- `invalidates`: tags the UI should refetch after the call succeeds (`hooks.onInvalidate` in the chat component).
- `responseFields`: only these fields of the response reach the model and the browser.

## Limits on calls

Calls use the pinned `baseUrl` and never follow redirects. Request and response sizes, the number of steps per turn and the time per turn are capped.