Skip to main content
POST
Provision an Internal Credential

Path Parameters

agent_id
string
required

Body

application/json

Callers choose only whether to replace; the key value is always server-generated.

replace
boolean
default:false

Issue a new credential and revoke every existing internal credential of the agent in the same transaction. Pods still holding a revoked credential stop authenticating immediately, so plan a restart with the new value. Without this, an existing credential yields 409 unless it was issued within the replay window.

replacement_idempotency_key
string | null

Requires replace. Binds this replacement to a caller-chosen key that is unique across all agents, such as a UUID. The first request with the key replaces the credential. A later request with the same agent and key returns that same credential with 200 and does not rotate again, while the credential has not been revoked and is within the replacement replay window. Otherwise, and when the key was used for a different agent, it yields 409.

Required string length: 1 - 64
Pattern: ^[A-Za-z0-9._:-]+$

Response

Replay of a recently issued internal credential, or of the credential a replacement with the same replacement_idempotency_key issued

First-issuance result, separate from ordinary agent metadata.

agent_id
string
required
agent_api_key_id
string
required
agent_api_key
string
required

Newly issued credential. Persist it before starting the agent.