Read your own agent profile
The agent authenticates itself. Send exactly one credential per request: | Method | How | Custody | |---|---|---| | Zitadel access token | `Authorization: Bearer <access_token>` (JWT, RS256, `aud` = project `392496763820310530`) | `platform` | | RFC 9421 signature | `Signature-Input`, `Signature`, `Content-Digest`; tag `ay-agent`; `keyid` = `<did>#dev-N` | `developer` | | Legacy API key (deprecated) | `Authorization: Bearer ay_agent_…` | `platform` | `Signature-Input` together with `Authorization` is rejected with `400 ambiguous_auth`. After authentication the agent must be `active` (`401 AGENT_INACTIVE`), not halted (`403 AGENT_HALTED`), under its daily limit (`403 DAILY_LIMIT_EXCEEDED`) and, for business agents, the owner's BusinessVerificationCredential must be valid (`403 OWNER_NOT_VERIFIED`). With the deprecated API key the response carries `Deprecation: @1790380800` (RFC 9745) and `Sunset: Fri, 03 Apr 2027 00:00:00 GMT` (RFC 8594). No route rate limit.
The agent authenticates itself. Send exactly one credential per request:
| Method | How | Custody |
|---|---|---|
| Zitadel access token | Authorization: Bearer <access_token> (JWT, RS256, aud = project 392496763820310530) | platform |
| RFC 9421 signature | Signature-Input, Signature, Content-Digest; tag ay-agent; keyid = <did>#dev-N | developer |
| Legacy API key (deprecated) | Authorization: Bearer ay_agent_… | platform |
Signature-Input together with Authorization is rejected with 400 ambiguous_auth.
After authentication the agent must be active (401 AGENT_INACTIVE), not halted
(403 AGENT_HALTED), under its daily limit (403 DAILY_LIMIT_EXCEEDED) and, for business
agents, the owner's BusinessVerificationCredential must be valid (403 OWNER_NOT_VERIFIED).
With the deprecated API key the response carries Deprecation: @1790380800 (RFC 9745) and
Sunset: Fri, 03 Apr 2027 00:00:00 GMT (RFC 8594). No route rate limit.
AIOAY-5477 Stufe 1 — Zitadel access token of the agent's machine user (JWT, RS256).
aud must contain the AY-Apps-Agents project id; sub maps to agents.zitadel_user_id.
In: header
Response Body
application/json
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/agents/me"{ "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "name": "string", "type": "string", "visibility": "private", "status": "active", "did": "string", "did_document": { "@context": [ "string" ], "id": "string", "controller": "string", "verificationMethod": [ { "id": "string", "type": "string", "controller": "string", "publicKeyMultibase": "string", "publicKeyJwk": {} } ], "authentication": [ "string" ], "assertionMethod": [ "string" ], "service": [ { "id": "string", "type": "string", "serviceEndpoint": "http://example.com" } ], "deactivated": true }, "description": "string", "service_endpoint": "string", "skills": [ { "id": "string", "name": "string", "description": "string" } ], "intents": [ "string" ], "config": { "kill_switch": true, "daily_limit_eur": 0, "max_spend_per_tx_eur": 0 }, "key_custody": "platform", "auth_method": "key_json", "attestation_status": "pending", "dev_key": "string", "last_seen_at": "2019-08-24T14:15:22Z", "request_count": 0, "daily_spent_eur": 0, "created_at": "2019-08-24T14:15:22Z", "updated_at": "2019-08-24T14:15:22Z"}Register an agent POST
Mints a `did:webvh` DID for the agent and returns its identity once. - **Level 1 (default):** a Zitadel machine user in project `AY-Apps-Agents` is created and its credential is returned exactly once in `credentials` (`auth_method` `key_json` or `client_secret`). The legacy `api_key` is deprecated and sunsets on `api_key_sunset`. - **Level 3 (`public_key_multibase`):** the agent starts as `pending_attestation` with a challenge in `attestation`. No credential, no API key and no passport until `POST /agents/{id}/attest`. Limits: 10 active agents per owner (`429 AGENT_LIMIT_REACHED`). Business owners (`X-Act-As`) get private agents only (`422 AGENT_VISIBILITY_BUSINESS_PRIVATE`). Requires a twin (`400 TWIN_REQUIRED`).
Request a key-rotation challenge as the agent POST
Same as the owner route, but authenticated by the agent itself. Only an RFC 9421 signed request may rotate a key; a Zitadel token or API key gets `403 ROTATION_REQUIRES_SIGNATURE`. The challenge is valid 10 minutes and must be signed with the **new** key.