Agents operator API
Agents v0.10 · Early access · Updated 23 October 2026
The API is for trusted operators in one workspace, version-coupled to its console. It is not an anonymous customer SDK or a stable separately versioned OpenAPI contract.
Authentication
POST /api/auth/login accepts JSON username/password and returns session information including a CSRF token. Retain the cookie privately and send X-CreekX-CSRF on mutations with Content-Type: application/json. POST /api/auth/logout ends access. Never place passwords in URLs, public widgets or committed scripts. Host/Origin and role checks still apply; unauthenticated evidence state returns 401 when authentication is configured.
Evidence route map
| Route | Method and purpose |
|---|---|
| /api/evidence/state | GET: administrator profiles, recent runs, defaults and source metadata |
| /api/evidence/published | GET: runtime published profile catalog |
| /api/evidence/create | POST: create, optionally clone settings |
| /api/evidence/save | POST: id, revision, name/config and optional suite; atomic save |
| /api/evidence/search | POST: preview question/config without a session |
| /api/evidence/inventory | POST: corpus/chunk/duplicate metadata |
| /api/evidence/suite-save | POST: revision-checked benchmark save |
| /api/evidence/test | POST: run current saved benchmark |
| /api/evidence/publish-preview | POST: actor-bound, expiring preview |
| /api/evidence/publish | POST: confirm the unchanged preview |
| /api/evidence/rollback-draft | POST: stage historical settings |
| /api/evidence/compare | POST: compare compatible runs |
| /api/evidence/archive | POST: reversible archive/restore |
| /api/evidence/export | POST: private local corpus/config/suite export |
| /api/evidence/import-preview | POST: settings validation only |
| /api/evidence/runtime | GET: filtered response/citation metadata, up to 100 rows |
Publication sequence
- Create a profile and retain id/revision.
- Save config and cases including a positive case.
- POST test with id/revision; require the returned gate to pass.
- POST publish-preview with id, revision and runId.
- Review the preview and submit its returned fields with confirmed: true.
Do not manufacture a signature or passing run. Changes to config, corpus or suite invalidate old evidence. Treat 409 as a state conflict: reload and review rather than overwriting. Preview validity is actor-specific and ten minutes.
Runtime selection
POST /api/sessions with evidenceId selects a published evidence profile. flowId selects a guided flow. Sending both is rejected. The server captures the published snapshot for the session. Use the bundled console as the reference for message streaming/cancellation. Copying an operator credential into a customer page exposes workspace-level access.
Exact schemas and upgrade testing
The package includes lib/evidence.mjs for route validation, lib/evidence-engine.mjs for retrieval, test/evidence.test.mjs for lifecycle checks and test/production.test.mjs for authenticated HTTP examples. Pin the package version and test your integration against it. Export files can contain confidential source text; metadata-only runtime reports do not replace transcript retention controls.