Information
- License: Apache-2.0
- OpenAPI version:
3.1.1
Overview
The execution and accountability layer for AI agents.
Deedglass API 2026-10-01
Section titled “Deedglass API 2026-10-01”Deedglass sits between your AI agents and the tools they use, deciding what each agent may do, running it under control, and recording what actually happened as a signed deed.
Every response carries Deedglass-Request-Id and the resolved Deedglass-Version. Errors use one envelope with a doc_url for every code. This document is written by hand; tests in internal/httpx fail when it and the mounted routes drift apart.
Authentication
Section titled “Authentication”bearerAuth
Section titled “bearerAuth”An API key: dg_live_ or dg_test_, an 8-character prefix, _, and a 32-character secret, all base62 (49 characters, like dg_live_jJbEEMWk_o0Erxxf1kgtP2QjiJ79vzW31AjZqIch8). Agent keys hold actions:execute, actions:read and deeds:read (the default) and may add actions:undo; org admin keys hold exactly admin. Create agent keys in Console › Agents and admin keys in Console › Settings. A 401 carries WWW-Authenticate: Bearer realm="deedglass", error="invalid_token", error_description="…"; a missing scope is 403 insufficient_scope with WWW-Authenticate: Bearer realm="deedglass", error="insufficient_scope", scope="…".
Security scheme type: http
Bearer format: dg_<mode>_<prefix>_<secret>
sessionCookie
Section titled “sessionCookie”A Console session. Requests that change state also send the Deedglass-CSRF header, matching the __Host-deedglass_csrf cookie.
Security scheme type: apiKey
Cookie parameter name: __Host-deedglass_session