Skip to content

Site search

Type to search Pages

Docs

API

Authentication

View as .md

Authenticate to the Mandavo API with a workspace key, and mint scoped agent credentials from it.

Workspace keys

Administrative calls — creating identities, writing policy, issuing credentials — authenticate with a workspace key. Generate one in Settings and send it as a bearer token in the Authorization header.

Workspace keys are for your backend only. They never travel to an agent; agents act with the short-lived credentials you mint for them.

Authenticated request
curl https://api.mandavo.com/v1/identities \
  -H "Authorization: Bearer $MANDAVO_API_KEY"

Base URL and versioning

All requests go to https://api.mandavo.com and are versioned by path prefix, starting with /v1. Breaking changes ship under a new prefix; additive changes do not.

Requests and responses are JSON. Send Content-Type: application/json on any request with a body.

Agent credentials

To let an agent act, exchange a workspace key for a scoped credential via the Issuance Engine, then hand only that short-lived token to the agent. The token carries the identity, the scope, and an expiry.

Treat agent credentials as single-task and in-memory. Do not persist them; request a new one for the next task.

Errors

The API uses standard HTTP status codes. 401 means the key is missing or invalid, 403 means the action is outside the caller's scope or denied by policy, and 429 means you are rate limited. Error bodies include a machine-readable code and a human-readable message.