Skip to main content

​
API introduction

​
What it is

The agentsfleet API lets your software create, inspect, and control fleets. Send requests to https://api.agentsfleet.net. The linked OpenAPI file describes every path, request body, response, and status code.

​
Why it exists

Use the API when a script or service needs direct access. Use the command-line client for interactive terminal work.

​
How it behaves

Most paths accept a bearer token in the Authorization header. Tenant API keys start with agt_t and are shown once when created. Interactive users sign in with agentsfleet login. Login saves a durable command-line credential that starts with afc_. The credential resolves to the person who signed in. The credential stays valid until a logout, a newer login from the same computer, or a dashboard revoke ends it. Browser session tokens use the identity provider’s published signing keys. Keys refresh after six hours. If the provider is unavailable, previously confirmed keys remain usable for at most fifteen more minutes. After that ceiling, session verification returns HTTP 503 with UZ-AUTH-004 until a refresh succeeds. Token expiry still applies throughout. Webhook and connector paths use provider signatures instead of bearer tokens. The OpenAPI security section on each operation states the required method. <WORKSPACE_ID> comes from agentsfleet workspace list. Use an obviously fake key in copied examples.
Errors use the HTTP problem details format. Each product error includes an error_code, a request_id, and a documentation URL. Identifiers use version 7 Universally Unique Identifiers (UUIDs). Timestamps use Unix milliseconds unless an operation states another unit.

​
Limits

The request line and headers can use up to 16 KiB. The server refuses larger header blocks before API routing. Clients may receive HTTP 431 or a closed connection. Reduce credentials, cookies, or forwarding headers before retrying. Rate limits apply per workspace. A limited request includes Retry-After; wait for that delay before retrying. Streaming activity uses Server-Sent Events (SSE). A stream can return UZ-API-002 when the service cannot accept another subscriber.