> ## Documentation Index > Fetch the complete documentation index at: https://developers.nexspace365.com/llms.txt > Use this file to discover all available pages before exploring further. # Create an automation trigger > Create a `schedule` (cron) or `event` trigger. Schedule triggers require a valid `cronExpression`; event triggers require an `eventType`. The run acts as `runAsUserId` (defaults to the caller); binding another user requires internal-operator privileges (privilege-escalation guard). Consequential — writes an audit entry. ## OpenAPI ````yaml https://api.nexspace365.com/api/openapi.json post /api/agent-builder/{id}/triggers openapi: 3.0.3 info: title: NexSpace 365 API description: > Multi-industry enterprise workforce management platform — scheduling, HR, payroll, CRM, AI, and messaging suites. ## Authentication Three schemes: session cookie, JWT bearer, or API key (`nex_live_…` / `nex_test_…` / `nex_pat_…`). AI agents should use API keys with appropriate scopes. ## Authorization Endpoints require specific permissions via the RBAC system: - **Internal team**: Full platform access - **Facility users**: Scoped to their org/facilities - **Staff**: Limited to own data ## Error Contract All errors return `{ error: { message, code?, suggestion?, retryable? }, requestId? }`. The `suggestion` field hints at how to fix the request; `retryable` signals whether retry-with-backoff is appropriate. ## Versioning Pin your integration to a specific API version via the `NexSpace-Version` header (date-based, e.g. `2026-05-10`). When absent, the latest version is assumed. Deprecated versions include `Sunset` and `Deprecation` headers. Discovery at `GET /.well-known/api-versions`. ## Idempotency Write operations (POST/PUT/PATCH) accept an `Idempotency-Key` header. If the same key + body combination is sent again within 24 hours, the original response is replayed. Different body with the same key returns 409 Conflict. ## MCP (Model Context Protocol) AI agents interact via `POST /mcp` using JSON-RPC 2.0. Call `tools/list` to discover available verbs, then `tools/call` to invoke them. version: 1.0.0 contact: name: NexSpace API Support email: support@nexspace365.com license: name: MIT url: https://opensource.org/licenses/MIT servers: - url: https://api.nexspace365.com description: Production server security: - bearerAuth: [] - apiKeyAuth: [] tags: - name: Authentication description: User authentication and session management - name: Facilities description: Facility management - name: Staff description: Staff member management and profiles - name: Credentials description: Staff credential tracking — licenses, certifications, and training - name: Shifts description: Shift scheduling and management - name: Dashboard description: Dashboard statistics and widgets - name: API Keys description: API key lifecycle — create, list, revoke, rotate - name: MCP description: Model Context Protocol endpoint for AI agent tool calling - name: OAuth description: OAuth 2.1 authorization server — DCR, authorize, token - name: Webhooks description: Outbound webhook subscription management - name: Analytics description: API usage analytics and observability paths: /api/agent-builder/{id}/triggers: post: tags: - Agents summary: Create an automation trigger description: | Create a `schedule` (cron) or `event` trigger. Schedule triggers require a valid `cronExpression`; event triggers require an `eventType`. The run acts as `runAsUserId` (defaults to the caller); binding another user requires internal-operator privileges (privilege-escalation guard). Consequential — writes an audit entry. operationId: createAgentTrigger parameters: - name: id in: path required: true schema: type: integer requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AgentTriggerInput' responses: '201': description: Trigger created content: application/json: schema: $ref: '#/components/schemas/AgentTrigger' '400': description: Invalid cron/eventType or validation failure '403': description: >- Missing permission/suite, or run-as binding forbidden (RUN_AS_FORBIDDEN) security: - apiKeyAuth: [] components: schemas: AgentTriggerInput: type: object description: Create/update payload for an automation trigger. properties: triggerType: type: string enum: - schedule - event - manual - webhook cronExpression: type: string description: Required + validated for schedule triggers. timezone: type: string eventType: type: string description: Required for event triggers. eventFilters: type: object additionalProperties: true runAsUserId: type: integer description: >- Defaults to the caller; binding another user needs internal-operator rights. facilityId: type: integer nullable: true seedMessage: type: string isActive: type: boolean required: - triggerType AgentTrigger: type: object description: An automation trigger that fires an agent on a schedule or event. properties: id: type: integer agentDefinitionId: type: integer triggerType: type: string enum: - schedule - event - manual - webhook cronExpression: type: string nullable: true description: 5-field cron; required for schedule triggers. timezone: type: string nullable: true description: IANA timezone for cron evaluation (defaults to UTC). eventType: type: string nullable: true description: Business event name; required for event triggers (e.g. shift.ncns). eventFilters: type: object additionalProperties: true description: Equality filters (dot-path) the event payload must satisfy. runAsUserId: type: integer nullable: true description: Identity the run acts as (drives tool scope + RBAC). facilityId: type: integer nullable: true seedMessage: type: string nullable: true isActive: type: boolean lastRunAt: type: string format: date-time nullable: true nextRunAt: type: string format: date-time nullable: true consecutiveFailures: type: integer description: Auto-disabled after 5 consecutive schedule-dispatch failures. required: - id - agentDefinitionId - triggerType securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: JWT token authentication apiKeyAuth: type: http scheme: bearer bearerFormat: NexSpaceApiKey description: | API key or personal access token (NEX-1042). Send as `Authorization: Bearer `. Token format: - `nex_live_…` — live API key (server-to-server) - `nex_test_…` — sandbox API key - `nex_pat_…` — personal access token (acts as the issuing user) Authorization is decided by the key's `scopes` array, not the owning user's RBAC role. See `POST /api/api-keys` to mint a key. ````