REST + OpenAPI
Call /agent/v1 with a Bearer API key. /agent/v1/openapi.json provides the interface description so tools can discover the available requests.
Let AI investigate. You decide what runs.
Hand topology, metrics, events and diagnostics to the AI tools you use. Connect via REST or MCP, and you decide the resource scope, configuration permissions and repair pre-authorization.
Learn about tool connectionConnect the tools you already use.
Remote HTTP MCP
Connect via /mcp using an API key or OAuth PKCE authorization. REST and MCP share the same permissions, tasks and audit rules.
One Agent,one identity.
Resources and features, each scoped separately.
Choose specific resources or all account resources, then use capability scopes to determine what can be read, diagnosed or modified. The all-resources scope also covers resources added later.
Read and diagnose by default, write access granted separately.
Creating, modifying, deleting or publishing client configurations, traffic routing rules, node routing and source security requires the corresponding management permission. Generating, running and viewing tasks also requires task query permission.
Validity period and quota, set as needed.
Set a validity period, per-minute call quota and daily task quota for each identity. An API key is shown in full only once, when created or rotated, so save it in your credential manager; you can rotate or revoke it later.
Review the diagnosis first, then decide whether to proceed.
When a node heartbeat is abnormal, grant diagnosis and planning permissions so the tool can read the relevant topology, metrics and events and generate a repair plan. Review the evidence and plan in the task details, then decide which repairs to allow.
Repair pre-authorization separately selects nodes, actions, validity period and a daily repair limit. You can authorize restoring node services, hosting an Agent, installing a bring-your-own node, or handling a failed firmware upgrade; execution also requires the corresponding Scope.
Currently, repair pre-authorization applies only to nodes without an active Relay. At execution, the plan, resources, firmware identity and health conditions are checked. Repairs may briefly interrupt node services; on failure, execution stops and the specific reason is retained.
Diagnostics and repairs, all recorded.
Diagnosis, planning, and execution all have task records. Evidence and plans can be reviewed later, while execution results and node health re-checks are shown separately, making it easy to determine whether service has been restored.
The AI Agent access page records Key management, customer pre-authorization, API calls, task execution, and review, so you can find specific tasks by action, result, and time.
Learn about node health and recovery →Frequently asked questions.
Does OAuth authorization expand the Agent's existing permissions?
No. When authorizing, you select the team account and the Agent identity, and the application can only use the permissions and resource scope already granted to that identity. Access tokens are valid for a maximum of fifteen minutes; rotating or revoking an API Key also invalidates the original OAuth authorization.
If diagnostic permissions are granted, can remediation be executed automatically?
No. Planning, execution, and task queries each require their own permissions, and executing remediation additionally requires separate pre-authorization of the node, action, validity period, and quota, as well as meeting the maintenance conditions in effect at the time of execution.
If an identity is revoked, will operations already issued be canceled?
Revocation stops new access and any remediation not yet executed. Operations already dispatched continue to be tracked to their final result; check task status in the console.