EndpointOS

AI agents

Let Claude Code or Codex build and evolve your APIs from your editor.

DocsAI agents

Last updated

If you work in an AI coding tool like Claude Code or Codex, you can let it build and evolve your APIs directly. You describe what you want, the agent creates the project, defines the resource, issues a key, and hands you a URL you can call. You stay in your editor the whole time.

This is the same platform you use in the dashboard, reached over a documented HTTP API. Nothing is hidden: the agent creates real projects, real resources and real keys, and everything it does shows up in your audit log.

What an agent can and cannot do

An agent token is scoped to one workspace and deliberately cannot do the dangerous things. Nothing here can be widened by the agent itself.

  • Can: create projects, define resources and fields, list what exists, issue new API keys.
  • Cannot: delete anything. Deleting a project or a resource stays in the dashboard, behind a confirmation you type by hand.
  • Cannot: read back an API key that already exists. It can mint a new key, and that key is shown once.
  • Cannot: touch billing, plans, or team members.
  • Cannot: see any workspace other than the one the token belongs to.
  • Cannot: issue a production API key, unless you ticked “Allow production keys” when you created the token.

Keys an agent creates are development keys. If you want an agent to be able to provision live credentials too, tick Allow production keys when you create the token. That is a decision you make once, in the dashboard, rather than one the agent makes in the moment. Without it, asking for a production key is refused outright rather than quietly answered with a development key, so the agent cannot believe it provisioned something it did not.

Every action the agent takes is written to your audit log and marked as coming from a token, so you can always answer "what did the agent change".

Evolving an API you already shipped

Ask for a new field the same way you asked for the resource: "add a shipped_at timestamp to orders". The agent adds it and reports what changed. Two things it deliberately cannot do:

  • It cannot publish. The change lands on your draft contract, and publishing stays a button you press.
  • It cannot rename, retype or remove a field, because each of those breaks existing consumers. Those stay in the dashboard.

Before you publish, ask "is anything about to break?". The agent reads your contract diff and tells you which changes are safe and which are not, so the decision is informed rather than hopeful.

The management API is itself documented

Everything an agent can do is a plain HTTP API, and it publishes its own OpenAPI document at /api/manage/v1/openapi.json. You do not need a token to read it. If you would rather script against it directly than go through an AI tool, that document is the contract.

Getting a token

Go to /settings, find Agent access, and create a token. It is shown once. Store it the way you would any other secret, and revoke it from the same place if it leaks or you stop using it. Revoking takes effect immediately.

Using it

Pass the token as a bearer token. Everything lives under /api/manage/v1.

# Create a project
curl -X POST https://endpointos.dev/api/manage/v1/projects \
  -H "Authorization: Bearer $ENDPOINTOS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"Orders"}'

The response includes the project's base URL and its docs link, so the next step is always in front of you rather than something you have to go and look up.

# Define a resource on it
curl -X POST https://endpointos.dev/api/manage/v1/projects/$PROJECT_ID/resources \
  -H "Authorization: Bearer $ENDPOINTOS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "orders",
    "fields": [
      { "name": "customer_email", "type": "string", "required": true },
      { "name": "total", "type": "number", "required": true },
      { "name": "status", "type": "string" }
    ]
  }'
# Issue a key to call it with
curl -X POST https://endpointos.dev/api/manage/v1/projects/$PROJECT_ID/keys \
  -H "Authorization: Bearer $ENDPOINTOS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"local dev"}'

What to ask your agent for

  • "Create an API for orders with customer email, total and status, then give me a dev key and a curl I can run."
  • "Add a shipped_at timestamp to the orders resource and show me what changed in the contract."
  • "Read the OpenAPI for this project and generate a typed client for my frontend."
  • "List everything in this workspace and tell me which resources have no keys pointing at them."

Publishing stays yours

An agent can change a resource, but it cannot publish a contract version. Publishing is the moment your API makes a promise to whoever consumes it, so it stays an explicit decision you make in the dashboard. The agent's job is to get the work ready for that decision, not to make it for you.

AI agents · EndpointOS docs | EndpointOS