AgentOS API Overview

The AgentOS API is a REST API for your running AgentOS instance. Use it to run agents, teams, and workflows, and to manage sessions, memory, knowledge, and evals from your own applications.

Authentication

AgentOS can validate a shared security key, JWTs, and service-account bearer tokens. Configure authentication on the server before relying on these credentials to protect routes.

When OS_SECURITY_KEY is set and no JWT source is configured, send:

Authorization: Bearer <OS_SECURITY_KEY>

JWT configuration takes precedence over the security key. JWT validation authenticates the caller; set authorization=True with a verification key to enforce the configured per-endpoint JWT scopes. Merely setting a JWT key does not enable that scope policy.

Service-account tokens use the same bearer header and require a configured verifier, normally backed by the AgentOS database. Their scopes are enforced when tokens are validated. A database alone supplies token-verification capability and does not require requests to authenticate. With no base authentication configured, the instance is open unless a separate middleware or public-surface policy restricts it.

See Security & Auth for setup, public routes, and deployment-specific policy.

Core Resources

The API is organized around these core resources: