API integration

Use the generated contract

Open the resource's Integrate panel after deployment. It shows the current endpoint, request shape, version, and scoped-key workflow. Treat the live OpenAPI schema and the generated panel as authoritative. Agent and fleet invocations go through the public API — the /api/v1/agents/<agent-id>/run and /api/v1/workflows/<workflow-id>/run endpoints are internal, session-authenticated routes used by the product UI, not by external callers.

curl -X POST "$SENTINEL_URL/api/v1/public/agents/$AGENT_ID/chat" \
  -H "Authorization: Bearer $SENTINEL_KEY" \
  -H "Content-Type: application/json" \
  -d '{"message":"Summarize the customer request and recommend the next action."}'

Replace $SENTINEL_URL with your deployment host, $AGENT_ID with the deployed agent's id, and $SENTINEL_KEY with the snl_agt_… key from the Integrate panel. The response returns the run id, response text, model, latency, and cited sources. thread_id is optional — pass the same value to continue a conversation.

curl -X POST "$SENTINEL_URL/api/v1/public/workflows/$WORKFLOW_ID/run" \
  -H "Authorization: Bearer $SENTINEL_KEY" \
  -H "Content-Type: application/json" \
  -d '{"input":"Handle this support request."}'

Fleets use the same public surface with an input field (and optional context) and a snl_flt_… key. The response carries the run id, status, final output, and full trace steps.

Authentication

Send the resource-scoped integration key as Authorization: Bearer <key> or the X-API-Key header. Keys are scoped to one agent or fleet: they unlock only that resource's public endpoints, never the internal product API. Store them in a secret manager and rotate or revoke them without changing the agent configuration. Never expose keys in browser code or documentation screenshots.

Operational rules

• Set client timeouts longer than the tested p95 execution time.
• Use idempotency or external request IDs around side-effecting workflows.
• Persist run IDs for support and trace lookup.
• Handle validation, authorization, rate, provider, and timeout failures separately.