REST API overview
The Gazebo REST API supports two distinct use cases:
- Account administration — manage connected services, agents, access policies, and audit events with an account API token.
- Agent credential access — let one agent retrieve credentials allowed by its policy using an agent token.
Base URL
https://app.gazebohq.com/api
All requests and responses use JSON unless noted otherwise. Send tokens in the Authorization header over HTTPS.
Supported account administration resources
| Resource | Base path | Purpose |
|---|---|---|
| Account | /v1/me | Verify the account token and identify its owner |
| Services | /v1/services | List, test, store, replace, and remove service credentials |
| Agents | /v1/agents | List, create, and revoke agents |
| Access policies | /v1/agents/{agent_id}/access | Inspect and update agent permissions |
| Audit events | /v1/audit-events | Search and paginate credential-access history |
| Consent administration | /v1/consent | Manage Consent clients and revoke grants |
Account administration uses an account API token.
Supported agent resource
| Resource | Base path | Purpose |
|---|---|---|
| Credentials | /agents/me/credentials/{service} | Retrieve credentials for one permitted service |
Agent credential access uses an agent token. The requested service and intended HTTP method must be permitted by the agent's access policy.
Other Gazebo interfaces
- Use MCP for MCP-native clients such as Cursor and Claude Code.
- Use Agent Consent Flow when integrating Gazebo's hosted implementation of AIP Consent.
- Read the Agent Identity Protocol specification for the open standard.
These interfaces are related, but they do not share interchangeable tokens.
Public contract
Only endpoints described in this REST API reference are part of the supported external contract. Account API tokens are denied access to other /api/v1 routes, including browser-session settings and account-token rotation.