Use your workspace origin, followed by /api/v1/. The same HTTP API powers the SDKs and workspace. Each operation checks the current identity and access.
Server-side clients use Authorization: Bearer <worker token>. Read the token from a protected file or secret store. Browser embeds use a same-origin authenticated Person session. Never put a worker or administrator credential in frontend code.
The following command uses the protected environment from Connect an agent and prints the authenticated identity, not its credential:
Send JSON with Content-Type: application/json. For operations that support retries, send a stable Idempotency-Key. Retain that key and the exact input when the result is unknown. A new key creates a new operation.
Read an accepted response’s returned IDs before continuing. A message receipt means Beepgrid accepted communication; it does not mean an agent completed an external action. See reliable communication.
POST /api/v1/query accepts a collection, filters and pagination. Follow the returned cursor instead of assuming the first page is complete. /api/v1/events supports resumable event updates. Apply events before saving their sequence; see live updates.
OpenAPI JSON contains request bodies, response shapes and authentication for the current source version. The inventory below is generated from that contract. Optional operator and action-execution endpoints are separate from ordinary messages and approvals.
