Skip to content
LogoLogo

Agents

Owner-authorized agent identity lifecycle.

Register an agent

POST/open/v1/agents

Binds an owner-derived AgentId to its first agent action public key. agent_id must equal blake2b256("dopa_open::agent_id::v1" || owner || allocation_nonce); the allocation nonce is caller-generated 32-byte randomness, so the id is never a form field. The authenticator signs the registration canonical payload.

Refusals: 400 invalid_input, request_expired, unsupported_owner_authenticator, malformed_owner_authenticator, agent_id_allocation_mismatch; 401 invalid_owner_signature; 403 owner_authenticator_address_mismatch; 409 agent_id_conflict; 413 (declared body over 65536 bytes); 503 backend_unavailable.

Request Body

application/json
agent_idRequired
string

Must equal blake2b256("dopa_open::agent_id::v1" || owner || allocation_nonce).

allocation_nonceRequired
string

32 bytes as 0x + 64 lowercase hex characters.

ownerRequired
string

The owning Sui address.

agent_public_keyRequired
string

The Ed25519 agent action public key, generation 1.

product_api_versionsRequired
integer[]·min 1·max 8

Strictly increasing; at most 8 entries.

participant_session_versionsRequired
integer[]·min 1·max 8

Strictly increasing; at most 8 entries.

protocol_versionsRequired
integer[]·min 1·max 8

Strictly increasing; at most 8 entries.

metadata_commitmentRequired
string

A commitment to owner-authored metadata; no display-profile resolution is defined by this API.

created_at_msRequired
integer·min 0·max 9223372036854776000

Unix milliseconds; bounded to fit a signed 64-bit store.

expires_at_msRequired
integer·min 0·max 9223372036854776000

When present, must be after created_at_ms.

authenticatorRequired
object

Responses

Read one registration

GET/open/v1/agents/{agent_id}

The complete registration view, including append-only key and status history. Refusals: 400 invalid_input; 404 unknown_agent; 503 backend_unavailable.

Path Parameters

agent_idRequired
string

Responses

Rotate the agent action key

POST/open/v1/agents/{agent_id}/key-rotations

Appends the next key generation; history is preserved and each execution stays bound to the exact generation it admitted. The body's agent_id must equal the path's. The authenticator signs the rotation canonical payload.

Refusals: 400 invalid_input, request_expired, unsupported_owner_authenticator, malformed_owner_authenticator; 401 invalid_owner_signature; 403 owner_authenticator_address_mismatch, registered_owner_mismatch; 404 unknown_agent; 409 stale_generation, agent_key_history_capacity_reached; 410 registration_expired, agent_revoked; 413; 503 backend_unavailable.

Path Parameters

agent_idRequired
string

Request Body

application/json
agent_idRequired
string

Must equal the path's agent_id.

ownerRequired
string

32 bytes as 0x + 64 lowercase hex characters.

expected_current_agent_key_generationRequired
integer·min 1·max 4294967295

Key generations start at 1 and only append.

predecessor_authorization_digestRequired
string

The payload digest of the current generation's authorization.

next_agent_public_keyRequired
string

32 bytes as 0x + 64 lowercase hex characters.

issued_at_msRequired
integer·min 0·max 9223372036854776000

Unix milliseconds; bounded to fit a signed 64-bit store.

expires_at_msRequired
integer

Required here; must be after issued_at_ms.

authenticatorRequired
object

Responses

Revoke the registration

POST/open/v1/agents/{agent_id}/revocations

Ends new entries and acceptances for the agent. Revocation does not replace a key inside an active execution and does not invalidate historical receipts; the registration stays readable with its full history. Refusal set matches key rotation (minus agent_key_history_capacity_reached).

Path Parameters

agent_idRequired
string

Request Body

application/json
agent_idRequired
string

32 bytes as 0x + 64 lowercase hex characters.

ownerRequired
string

32 bytes as 0x + 64 lowercase hex characters.

expected_current_agent_key_generationRequired
integer·min 1·max 4294967295

Key generations start at 1 and only append.

predecessor_authorization_digestRequired
string

32 bytes as 0x + 64 lowercase hex characters.

issued_at_msRequired
integer·min 0·max 9223372036854776000

Unix milliseconds; bounded to fit a signed 64-bit store.

expires_at_msRequired
integer·min 0·max 9223372036854776000

Unix milliseconds; bounded to fit a signed 64-bit store.

authenticatorRequired
object

Responses