# ACP API Reference — Govern Agents Programmatically The Agentic Control Plane REST API. Create and run agents, set policy, and read the audit trail — everything the console does, from your own code. # The ACP API Everything you can do in the console, you can do from code. Provision an agent, set the policy that controls it, run it, and read back every tool call it made — over plain HTTP, authenticated with an API key. The console is for managing your workspace. The API is for managing your agents. If you operate agents at any scale — a fleet of scheduled scouts, a CI pipeline that spins up reviewers, a product that runs an agent per customer — you'll live in the API. ```bash curl https://api.agenticcontrolplane.com/api/v1/agents \ -H "Authorization: Bearer $ACP_KEY" ``` ## Base URL ``` https://api.agenticcontrolplane.com ``` All requests are HTTPS. There is no separate sandbox host — scope a key to a test workspace instead. ## The two surfaces ACP controls two things, so the API has two surfaces: | Surface | Path | What it manages | |---------|------|-----------------| | **Agents** | `/api/v1/agents` | Agent profiles — create, configure, run, delete. Tenant is resolved from the key, so no workspace slug in the path. | | **Policy** | `//admin/…` | The policy that controls every agent and the audit trail of what they did. Workspace slug is in the path. | Both authenticate with the same `gsk_` API key. Your workspace slug is embedded in the key itself (`gsk__…`), so the two surfaces are always talking about the same workspace. ## Resources
Agents
Create, configure, run, and delete agent profiles. Set per-agent budget, tool, and delegation limits.
Policies
Read and write the four-layer policy — workspace, role, agent type, and user.
Logs
Query the audit trail — every tool call, its decision, and the identity behind it.
Run triggers
Invoke a controlled agent over HTTP — from n8n, Zapier, cron, or your own backend.
## Machine-readable spec The whole API is described by an [OpenAPI 3.1 spec](/assets/openapi.yaml) — paste it into Postman, generate a client, or browse it as a [rendered reference](/docs/api/reference). The spec is the source of truth; these pages are the guided tour. ## Conventions - **JSON in, JSON out.** Send `Content-Type: application/json` on every request with a body. - **Success.** Agent endpoints return `{ "ok": true, … }`. Read endpoints return the resource directly. - **Errors.** Any non-2xx response carries `{ "error": "" }`. See [Errors](/docs/api/authentication#errors). - **Stable shapes.** New fields may be added to responses; existing fields won't change meaning under `/api/v1`. Don't fail on unknown keys. ## Next
Quickstart → Authentication →