Agency Operations API · v1 preview

A small contract
with a hard boundary.

Every documented operation is read-only, versioned, correlated, and authorized by Kernel. The unversioned internal API is not part of this developer contract.

The deployed API origin has not been configured for this build.

Authentication

Use CROWN Auth authorization code with PKCE. Send the resulting user access token as Authorization: Bearer …. The OAuth client must be explicitly approved, and the token subject must map to an active Kernel Actor.

Authentication does not grant access to every client. Kernel evaluates Account and Engagement permissions independently.

curl --fail-with-body \
  -H "Authorization: Bearer ${AGENCY_OS_ACCESS_TOKEN}" \
  -H "Accept: application/json" \
  "${AGENCY_OS_API_ORIGIN}/api/v1/me"

Resources

IdentityGET/me

Resolve the current authenticated Actor.

AuthorizationGET/permissions

Discover effective Kernel permissions.

ClientsGET/clients

List readable Client Accounts.

ClientsGET/clients/{ref}

Read a durable Client Account profile.

WorkGET/engagements

List Engagements for a Client Account.

WorkGET/projects

List Projects for an Engagement.

WorkGET/tasks

List Tasks for a Project.

CommitmentsGET/obligations

List Engagement obligations.

Conventions

Errors

Stable code, message, retryability, details, and request ID.

Pagination

Opaque cursor, 25-row default, and 100-row maximum.

Correlation

Send and retain X-Request-Id.

Caching

Actor-scoped responses are private and no-store.

← Back to the developer center