Access policies

An access policy controls which connected services may release credentials to an agent and which declared HTTP methods permit that release.

Gazebo evaluates this policy before returning a credential. It does not observe or enforce the agent's later request to the service. The service's API key scopes, OAuth scopes, or IAM permissions remain the authority for what the credential can actually do.

These endpoints require an account API token.

Inspect an agent's access

GET /api/v1/agents/{agent_id}/access

curl https://app.gazebohq.com/api/v1/agents/AGENT_ID/access \
  -H "Authorization: Bearer YOUR_ACCOUNT_API_TOKEN"

The response includes every service currently connected to the account:

[
  {
    "service": "stripe",
    "enabled": true,
    "methods": ["GET"]
  },
  {
    "service": "github",
    "enabled": false,
    "methods": ["GET", "POST", "PUT", "PATCH", "DELETE"]
  }
]

Update service access

PUT /api/v1/agents/{agent_id}/access/{service}

curl https://app.gazebohq.com/api/v1/agents/AGENT_ID/access/stripe \
  -X PUT \
  -H "Authorization: Bearer YOUR_ACCOUNT_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"enabled":true,"methods":["GET"]}'

Field	Type	Required	Description
enabled	boolean	yes	Whether the agent may retrieve this service's credentials
methods	array	no	Declared request methods that permit credential release: GET, POST, PUT, PATCH, DELETE; defaults to all methods

Changes take effect on the agent's next credential request.

The agent supplies its intended method when requesting a credential. For example, a GET-only policy denies a credential request declared as POST. Once a permitted request returns the credential, Gazebo cannot guarantee that the agent uses it only for that method. Match this policy with narrowly scoped credentials at the provider.

The response is:

{ "ok": true }