curl --request POST \
--url https://{host}/v2/workspaces/slug:agent-factory/webhooks/v1/agents/{agentId}/access \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"principal_id": "<string>"
}
'const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({principal_id: '<string>'})
};
fetch('https://{host}/v2/workspaces/slug:agent-factory/webhooks/v1/agents/{agentId}/access', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://{host}/v2/workspaces/slug:agent-factory/webhooks/v1/agents/{agentId}/access"
payload = { "principal_id": "<string>" }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"created": true,
"binding": {
"agent_id": "<string>",
"principal_type": "user",
"principal_id": "<string>",
"email": "<string>",
"orgSlug": "<string>",
"granted_by": "<string>",
"role_slug": "<string>"
}
}{
"error": "<string>",
"message": "<string>",
"details": {}
}{
"error": "<string>",
"message": "<string>",
"details": {}
}{
"error": "<string>",
"message": "<string>",
"details": {}
}{
"error": "<string>",
"message": "<string>",
"details": {}
}{
"error": "<string>",
"message": "<string>",
"details": {}
}{
"error": "<string>",
"message": "<string>",
"details": {}
}Share an agent with a principal (create binding)
Create a binding granting a user, group, or org access to this
agent. User and group principals are validated against the
agent’s organization via ai-governance-v2.
An org target may be the agent’s own org (no extra requirement),
another organization, or the literal wildcard * meaning every
authenticated member of at least one org. Any target beyond the
agent’s own org requires the agent-factory:sharing:cross-org
permission (403 without it), and a specific foreign org is only
accepted when the sharer is an active member of it (uniform 400
otherwise; platform admins bypass).
Default role when role_slug is omitted: admin for same-org
shares (historical default), user for any org target beyond the
agent’s own org.
curl --request POST \
--url https://{host}/v2/workspaces/slug:agent-factory/webhooks/v1/agents/{agentId}/access \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"principal_id": "<string>"
}
'const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({principal_id: '<string>'})
};
fetch('https://{host}/v2/workspaces/slug:agent-factory/webhooks/v1/agents/{agentId}/access', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://{host}/v2/workspaces/slug:agent-factory/webhooks/v1/agents/{agentId}/access"
payload = { "principal_id": "<string>" }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"created": true,
"binding": {
"agent_id": "<string>",
"principal_type": "user",
"principal_id": "<string>",
"email": "<string>",
"orgSlug": "<string>",
"granted_by": "<string>",
"role_slug": "<string>"
}
}{
"error": "<string>",
"message": "<string>",
"details": {}
}{
"error": "<string>",
"message": "<string>",
"details": {}
}{
"error": "<string>",
"message": "<string>",
"details": {}
}{
"error": "<string>",
"message": "<string>",
"details": {}
}{
"error": "<string>",
"message": "<string>",
"details": {}
}{
"error": "<string>",
"message": "<string>",
"details": {}
}Authorizations
User-bound credential carrying an identity: either a session JWT
or a user access token (at:*) generated from the user settings UI.
Send as Authorization: Bearer <token>.
Org API keys (iak_*) are not accepted here - they carry
no user identity. Use the x-prismeai-api-key header instead
(see OrgApiKeyAuth).
Path Parameters
64Body
user, group, org 32User id (or email for user type, resolved server-side), group id, or org slug. For org, the target may be the agent's own org, another org (sharer must be a member), or the literal * for all authenticated users belonging to at least one org - both beyond-own-org forms require agent-factory:sharing:cross-org.
128Role to grant, admin or user (owner is refused). Defaults to admin for same-org shares, user for any org target beyond the agent's own org.
64Response
Binding created.
true
Was this page helpful?