PUT /v1/agents/{agent_id}/security
PUT
/v1/agents/{agent_id}/securityAuthorization
AuthorizationBearer token · headerrequiredPath parameters
agent_idstring<uuid>requiredAgent id
Request body
requiredapplication/jsonReplaces the whole document. An omitted field takes its default.
allowed_originsstring[]Defaults to empty, which answers no browser.
max items 32
Responses
200The document the agent now holds.
allowed_originsstring[]requiredThe browser origins the agent's sessions answer a cross-origin request
from. Each entry is exactly what a browser puts in `Origin`: a scheme,
a host, and an optional port, with no trailing slash and no path.
Empty answers no browser.
max items 32
400Malformed body, path parameter, or an entry no `Origin` header could equal.
errorErrorDetailrequiredShow propertiesHide properties
codeErrorCoderequiredThe machine-readable half of an error response, and the field a client
branches on. Closed: every error carries exactly one of these.
Allowed:
unauthorizedforbiddennot_foundinvalid_requestconflictclient_outdatedprecondition_failedtoo_many_requestsinternalmessagestringrequired401Missing, malformed, or invalid bearer token.
errorErrorDetailrequiredShow propertiesHide properties
codeErrorCoderequiredThe machine-readable half of an error response, and the field a client
branches on. Closed: every error carries exactly one of these.
Allowed:
unauthorizedforbiddennot_foundinvalid_requestconflictclient_outdatedprecondition_failedtoo_many_requestsinternalmessagestringrequired403Caller lacks agent.publish.
errorErrorDetailrequiredShow propertiesHide properties
codeErrorCoderequiredThe machine-readable half of an error response, and the field a client
branches on. Closed: every error carries exactly one of these.
Allowed:
unauthorizedforbiddennot_foundinvalid_requestconflictclient_outdatedprecondition_failedtoo_many_requestsinternalmessagestringrequired404No such agent, or the caller cannot see it.
errorErrorDetailrequiredShow propertiesHide properties
codeErrorCoderequiredThe machine-readable half of an error response, and the field a client
branches on. Closed: every error carries exactly one of these.
Allowed:
unauthorizedforbiddennot_foundinvalid_requestconflictclient_outdatedprecondition_failedtoo_many_requestsinternalmessagestringrequired