Machine admin
Run a drill (machine)
POST
/v1/admin/drillsagents:freeze. At most one an hour per workspace (drill_cooldown).
#Authentication
Service token
A scoped machine token (ims_...) made by an owner or admin under Settings, sent as Authorization: Bearer. Each route needs one scope; tokens expire within 90 days and can be pinned to address ranges. A token can stop agents but never start them, and never decides an approval.