Compute agent configuration CID
Computes the JCS CID of an agent configuration snapshot and stores it in the blob store. Returns the CID an individual-agent assessment and its certification pin. The document is control-plane's derivation from an observed Viper state; governance checks that the CID returned here equals the one control-plane computed. Only the shape is checked here: a missing or unknown field, or an unknown coverage value, is refused with 422 before the document is read. Only governance registers a configuration, as its governance-worker service account, after control-plane derived it for a caller allowed to see the agent. No user token can, so an agent's owners can start its assessment without being able to store configurations of their own making. The configuration is recorded as one, so an assessment's submission can pin it and nothing else.
https://<host>/gov/v1/cid/agent-configurationcurl --request POST \
--url 'https://<host>/gov/v1/cid/agent-configuration' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '{"app":{"binaryCid":"string","type":"ClaudeCode","version":"string"},"configFiles":{"key":"string"},"coverage":{"app":"captured","configFiles":"captured","definition":"captured","mcpServers":"captured","memory":"captured","model":"captured","permissions":"captured","skills":"captured","systemPrompt":"captured","tools":"captured"},"definition":"string","mcpServers":[{"agent":"string","args":["string"],"command":"string","name":"string","transport":"streamable_http","url":"string"}],"memory":[{"agent":"string","backend":"state","path":"/AGENTS.md","scope":{"kind":"thread"}}],"model":[{"agent":"string","model":"gpt-4.1","provider":"openai"}],"permissions":["string"],"schemaVersion":"1","skills":{"key":"string"},"systemPrompt":[{"agent":"string","cid":"string","role":"system"}],"tools":[{"agent":"string","name":"string","sourceHash":"string"}],"type":"AgentConfigurationV1"}'const response = await fetch("https://<host>/gov/v1/cid/agent-configuration", {
method: "POST",
headers: {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
},
body: JSON.stringify({
"app": {
"binaryCid": "string",
"type": "ClaudeCode",
"version": "string"
},
"configFiles": {
"key": "string"
},
"coverage": {
"app": "captured",
"configFiles": "captured",
"definition": "captured",
"mcpServers": "captured",
"memory": "captured",
"model": "captured",
"permissions": "captured",
"skills": "captured",
"systemPrompt": "captured",
"tools": "captured"
},
"definition": "string",
"mcpServers": [
{
"agent": "string",
"args": [
"string"
],
"command": "string",
"name": "string",
"transport": "streamable_http",
"url": "string"
}
],
"memory": [
{
"agent": "string",
"backend": "state",
"path": "/AGENTS.md",
"scope": {
"kind": "thread"
}
}
],
"model": [
{
"agent": "string",
"model": "gpt-4.1",
"provider": "openai"
}
],
"permissions": [
"string"
],
"schemaVersion": "1",
"skills": {
"key": "string"
},
"systemPrompt": [
{
"agent": "string",
"cid": "string",
"role": "system"
}
],
"tools": [
{
"agent": "string",
"name": "string",
"sourceHash": "string"
}
],
"type": "AgentConfigurationV1"
})
});
const data = await response.json();interface CidAgentConfigurationResponse {
configuration: string;
}
const response = await fetch("https://<host>/gov/v1/cid/agent-configuration", {
method: "POST",
headers: {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
},
body: JSON.stringify({
"app": {
"binaryCid": "string",
"type": "ClaudeCode",
"version": "string"
},
"configFiles": {
"key": "string"
},
"coverage": {
"app": "captured",
"configFiles": "captured",
"definition": "captured",
"mcpServers": "captured",
"memory": "captured",
"model": "captured",
"permissions": "captured",
"skills": "captured",
"systemPrompt": "captured",
"tools": "captured"
},
"definition": "string",
"mcpServers": [
{
"agent": "string",
"args": [
"string"
],
"command": "string",
"name": "string",
"transport": "streamable_http",
"url": "string"
}
],
"memory": [
{
"agent": "string",
"backend": "state",
"path": "/AGENTS.md",
"scope": {
"kind": "thread"
}
}
],
"model": [
{
"agent": "string",
"model": "gpt-4.1",
"provider": "openai"
}
],
"permissions": [
"string"
],
"schemaVersion": "1",
"skills": {
"key": "string"
},
"systemPrompt": [
{
"agent": "string",
"cid": "string",
"role": "system"
}
],
"tools": [
{
"agent": "string",
"name": "string",
"sourceHash": "string"
}
],
"type": "AgentConfigurationV1"
})
});
if (!response.ok) throw new Error(`${response.status} ${response.statusText}`);
const data: CidAgentConfigurationResponse = await response.json();import requests
response = requests.post(
"https://<host>/gov/v1/cid/agent-configuration",
headers={
"Authorization": "Bearer <token>",
"Content-Type": "application/json",
},
json={
"app": {
"binaryCid": "string",
"type": "ClaudeCode",
"version": "string",
},
"configFiles": {
"key": "string",
},
"coverage": {
"app": "captured",
"configFiles": "captured",
"definition": "captured",
"mcpServers": "captured",
"memory": "captured",
"model": "captured",
"permissions": "captured",
"skills": "captured",
"systemPrompt": "captured",
"tools": "captured",
},
"definition": "string",
"mcpServers": [
{
"agent": "string",
"args": [
"string",
],
"command": "string",
"name": "string",
"transport": "streamable_http",
"url": "string",
},
],
"memory": [
{
"agent": "string",
"backend": "state",
"path": "/AGENTS.md",
"scope": {
"kind": "thread",
},
},
],
"model": [
{
"agent": "string",
"model": "gpt-4.1",
"provider": "openai",
},
],
"permissions": [
"string",
],
"schemaVersion": "1",
"skills": {
"key": "string",
},
"systemPrompt": [
{
"agent": "string",
"cid": "string",
"role": "system",
},
],
"tools": [
{
"agent": "string",
"name": "string",
"sourceHash": "string",
},
],
"type": "AgentConfigurationV1",
},
)
response.raise_for_status()
print(response.json())package main
import (
"fmt"
"io"
"net/http"
"strings"
)
func main() {
body := strings.NewReader(`{
"app": {
"binaryCid": "string",
"type": "ClaudeCode",
"version": "string"
},
"configFiles": {
"key": "string"
},
"coverage": {
"app": "captured",
"configFiles": "captured",
"definition": "captured",
"mcpServers": "captured",
"memory": "captured",
"model": "captured",
"permissions": "captured",
"skills": "captured",
"systemPrompt": "captured",
"tools": "captured"
},
"definition": "string",
"mcpServers": [
{
"agent": "string",
"args": [
"string"
],
"command": "string",
"name": "string",
"transport": "streamable_http",
"url": "string"
}
],
"memory": [
{
"agent": "string",
"backend": "state",
"path": "/AGENTS.md",
"scope": {
"kind": "thread"
}
}
],
"model": [
{
"agent": "string",
"model": "gpt-4.1",
"provider": "openai"
}
],
"permissions": [
"string"
],
"schemaVersion": "1",
"skills": {
"key": "string"
},
"systemPrompt": [
{
"agent": "string",
"cid": "string",
"role": "system"
}
],
"tools": [
{
"agent": "string",
"name": "string",
"sourceHash": "string"
}
],
"type": "AgentConfigurationV1"
}`)
req, err := http.NewRequest(http.MethodPost, "https://<host>/gov/v1/cid/agent-configuration", body)
if err != nil {
panic(err)
}
req.Header.Set("Authorization", "Bearer <token>")
req.Header.Set("Content-Type", "application/json")
res, err := http.DefaultClient.Do(req)
if err != nil {
panic(err)
}
defer res.Body.Close()
data, err := io.ReadAll(res.Body)
if err != nil {
panic(err)
}
fmt.Println(res.Status, string(data))
}import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
public class Example {
public static void main(String[] args) throws Exception {
HttpRequest request = HttpRequest.newBuilder()
.uri(URI.create("https://<host>/gov/v1/cid/agent-configuration"))
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.method("POST", HttpRequest.BodyPublishers.ofString("""
{
"app": {
"binaryCid": "string",
"type": "ClaudeCode",
"version": "string"
},
"configFiles": {
"key": "string"
},
"coverage": {
"app": "captured",
"configFiles": "captured",
"definition": "captured",
"mcpServers": "captured",
"memory": "captured",
"model": "captured",
"permissions": "captured",
"skills": "captured",
"systemPrompt": "captured",
"tools": "captured"
},
"definition": "string",
"mcpServers": [
{
"agent": "string",
"args": [
"string"
],
"command": "string",
"name": "string",
"transport": "streamable_http",
"url": "string"
}
],
"memory": [
{
"agent": "string",
"backend": "state",
"path": "/AGENTS.md",
"scope": {
"kind": "thread"
}
}
],
"model": [
{
"agent": "string",
"model": "gpt-4.1",
"provider": "openai"
}
],
"permissions": [
"string"
],
"schemaVersion": "1",
"skills": {
"key": "string"
},
"systemPrompt": [
{
"agent": "string",
"cid": "string",
"role": "system"
}
],
"tools": [
{
"agent": "string",
"name": "string",
"sourceHash": "string"
}
],
"type": "AgentConfigurationV1"
}
"""))
.build();
HttpResponse<String> response = HttpClient.newHttpClient()
.send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.statusCode() + " " + response.body());
}
}using System.Net.Http.Headers;
using System.Text;
using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Post, "https://<host>/gov/v1/cid/agent-configuration");
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", "<token>");
request.Content = new StringContent("""
{
"app": {
"binaryCid": "string",
"type": "ClaudeCode",
"version": "string"
},
"configFiles": {
"key": "string"
},
"coverage": {
"app": "captured",
"configFiles": "captured",
"definition": "captured",
"mcpServers": "captured",
"memory": "captured",
"model": "captured",
"permissions": "captured",
"skills": "captured",
"systemPrompt": "captured",
"tools": "captured"
},
"definition": "string",
"mcpServers": [
{
"agent": "string",
"args": [
"string"
],
"command": "string",
"name": "string",
"transport": "streamable_http",
"url": "string"
}
],
"memory": [
{
"agent": "string",
"backend": "state",
"path": "/AGENTS.md",
"scope": {
"kind": "thread"
}
}
],
"model": [
{
"agent": "string",
"model": "gpt-4.1",
"provider": "openai"
}
],
"permissions": [
"string"
],
"schemaVersion": "1",
"skills": {
"key": "string"
},
"systemPrompt": [
{
"agent": "string",
"cid": "string",
"role": "system"
}
],
"tools": [
{
"agent": "string",
"name": "string",
"sourceHash": "string"
}
],
"type": "AgentConfigurationV1"
}
""", Encoding.UTF8, "application/json");
using var response = await client.SendAsync(request);
Console.WriteLine($"{(int)response.StatusCode} {await response.Content.ReadAsStringAsync()}");<?php
$ch = curl_init('https://<host>/gov/v1/cid/agent-configuration');
curl_setopt_array($ch, [
CURLOPT_CUSTOMREQUEST => 'POST',
CURLOPT_HTTPHEADER => [
'Authorization: Bearer <token>',
'Content-Type: application/json',
],
CURLOPT_POSTFIELDS => <<<'JSON'
{
"app": {
"binaryCid": "string",
"type": "ClaudeCode",
"version": "string"
},
"configFiles": {
"key": "string"
},
"coverage": {
"app": "captured",
"configFiles": "captured",
"definition": "captured",
"mcpServers": "captured",
"memory": "captured",
"model": "captured",
"permissions": "captured",
"skills": "captured",
"systemPrompt": "captured",
"tools": "captured"
},
"definition": "string",
"mcpServers": [
{
"agent": "string",
"args": [
"string"
],
"command": "string",
"name": "string",
"transport": "streamable_http",
"url": "string"
}
],
"memory": [
{
"agent": "string",
"backend": "state",
"path": "/AGENTS.md",
"scope": {
"kind": "thread"
}
}
],
"model": [
{
"agent": "string",
"model": "gpt-4.1",
"provider": "openai"
}
],
"permissions": [
"string"
],
"schemaVersion": "1",
"skills": {
"key": "string"
},
"systemPrompt": [
{
"agent": "string",
"cid": "string",
"role": "system"
}
],
"tools": [
{
"agent": "string",
"name": "string",
"sourceHash": "string"
}
],
"type": "AgentConfigurationV1"
}
JSON,
CURLOPT_RETURNTRANSFER => true,
]);
$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
echo $status . " " . $response . PHP_EOL;require "net/http"
uri = URI("https://<host>/gov/v1/cid/agent-configuration")
request = Net::HTTP::Post.new(uri)
request["Authorization"] = "Bearer <token>"
request["Content-Type"] = "application/json"
request.body = <<~'JSON'
{
"app": {
"binaryCid": "string",
"type": "ClaudeCode",
"version": "string"
},
"configFiles": {
"key": "string"
},
"coverage": {
"app": "captured",
"configFiles": "captured",
"definition": "captured",
"mcpServers": "captured",
"memory": "captured",
"model": "captured",
"permissions": "captured",
"skills": "captured",
"systemPrompt": "captured",
"tools": "captured"
},
"definition": "string",
"mcpServers": [
{
"agent": "string",
"args": [
"string"
],
"command": "string",
"name": "string",
"transport": "streamable_http",
"url": "string"
}
],
"memory": [
{
"agent": "string",
"backend": "state",
"path": "/AGENTS.md",
"scope": {
"kind": "thread"
}
}
],
"model": [
{
"agent": "string",
"model": "gpt-4.1",
"provider": "openai"
}
],
"permissions": [
"string"
],
"schemaVersion": "1",
"skills": {
"key": "string"
},
"systemPrompt": [
{
"agent": "string",
"cid": "string",
"role": "system"
}
],
"tools": [
{
"agent": "string",
"name": "string",
"sourceHash": "string"
}
],
"type": "AgentConfigurationV1"
}
JSON
response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") do |http|
http.request(request)
end
puts "#{response.code} #{response.body}"// Cargo.toml dependencies: reqwest (features "json"), serde_json, tokio (features "full")
use serde_json::json;
#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
let response = reqwest::Client::new()
.post("https://<host>/gov/v1/cid/agent-configuration")
.header("Authorization", "Bearer <token>")
.json(&json!({
"app": {
"binaryCid": "string",
"type": "ClaudeCode",
"version": "string"
},
"configFiles": {
"key": "string"
},
"coverage": {
"app": "captured",
"configFiles": "captured",
"definition": "captured",
"mcpServers": "captured",
"memory": "captured",
"model": "captured",
"permissions": "captured",
"skills": "captured",
"systemPrompt": "captured",
"tools": "captured"
},
"definition": "string",
"mcpServers": [
{
"agent": "string",
"args": [
"string"
],
"command": "string",
"name": "string",
"transport": "streamable_http",
"url": "string"
}
],
"memory": [
{
"agent": "string",
"backend": "state",
"path": "/AGENTS.md",
"scope": {
"kind": "thread"
}
}
],
"model": [
{
"agent": "string",
"model": "gpt-4.1",
"provider": "openai"
}
],
"permissions": [
"string"
],
"schemaVersion": "1",
"skills": {
"key": "string"
},
"systemPrompt": [
{
"agent": "string",
"cid": "string",
"role": "system"
}
],
"tools": [
{
"agent": "string",
"name": "string",
"sourceHash": "string"
}
],
"type": "AgentConfigurationV1"
}))
.send()
.await?;
println!("{} {}", response.status(), response.text().await?);
Ok(())
}Authorizations
BearerAuth· HTTP bearer (JWT)
Request bodyrequired
appAgentConfigurationApprequiredShow AgentConfigurationApp
binaryCidstring | nulltypestringrequiredViper's app type
versionstring | null
configFilesobject | nullConfig file content CIDs keyed by
project:<path in the working directory>orhost:<absolute path>; present only when coverage.configFiles is capturedShow properties
Map of
stringcoverageAgentConfigurationCoveragerequiredHow each field schema v1 names was captured, including fields no integration captures yet
Show AgentConfigurationCoverage
appConfigurationCoveragerequiredOne of
capturednot_capturedper_requestconfigFilesConfigurationCoveragerequiredOne of
capturednot_capturedper_requestdefinitionConfigurationCoveragerequiredOne of
capturednot_capturedper_requestmcpServersConfigurationCoveragerequiredOne of
capturednot_capturedper_requestmemoryConfigurationCoveragerequiredOne of
capturednot_capturedper_requestmodelConfigurationCoveragerequiredOne of
capturednot_capturedper_requestpermissionsConfigurationCoveragerequiredOne of
capturednot_capturedper_requestskillsConfigurationCoveragerequiredOne of
capturednot_capturedper_requestsystemPromptConfigurationCoveragerequiredOne of
capturednot_capturedper_requesttoolsConfigurationCoveragerequiredOne of
capturednot_capturedper_request
definitionstring | nullA custom agent's agent definition, by content ID; present only when coverage.definition is captured
mcpServersAgentConfigurationMcpServer[] | nullThe MCP servers a custom agent's tools, and its sub-agents', call, by name; present only when coverage.mcpServers is captured
Show properties
Array of
AgentConfigurationMcpServeragentstring | nullThe sub-agent,
/-separated when nested; absent for the agent itselfargsstring[] | nullcommandstring | nullnamestringrequiredtransportstringrequiredurlstring | null
memoryAgentConfigurationMemory[] | nullWhere the agent's threads write memory for themselves, which lasts only as long as its thread; present only when coverage.memory is captured, which it is only for an agent that keeps no memory across threads
Show properties
Array of
AgentConfigurationMemoryagentstring | nullThe sub-agent writing it,
/-separated when nested; absent for the agent itselfbackendstringrequiredpathstringrequiredscopeAgentConfigurationMemoryScoperequiredWhose memory it is:
thread, the only kind a configuration can captureShow AgentConfigurationMemoryScope
kindstringrequired
modelAgentConfigurationModel[] | nullA custom agent's models, and its sub-agents', in its definition's order: each agent's first model, then its fallbacks; present only when coverage.model is captured
Show properties
Array of
AgentConfigurationModelagentstring | nullThe sub-agent,
/-separated when nested; absent for the agent itselfmodelstringrequiredproviderstringrequired
permissionsstring[] | nullSorted, de-duplicated allow rules; present only when coverage.permissions is captured
schemaVersionstringrequiredskillsobject | nullSkill CIDs by skill name; present only when coverage.skills is captured
Show properties
Map of
stringsystemPromptAgentConfigurationPrompt[] | nullA custom agent's system and developer prompts, and its sub-agents', in its definition's order, each by the CID of its text; present only when coverage.systemPrompt is captured
Show properties
Array of
AgentConfigurationPromptagentstring | nullThe sub-agent,
/-separated when nested; absent for the agent itselfcidstringrequiredrolestringrequired
toolsAgentConfigurationTool[] | nullA custom agent's tools, and its sub-agents', by name; present only when coverage.tools is captured
Show properties
Array of
AgentConfigurationToolagentstring | nullThe sub-agent,
/-separated when nested; absent for the agent itselfnamestringrequiredsourceHashstring | nullsha256:<hex>of the tool's source, when the definition has one
typestringrequired
{
"app": {
"binaryCid": "string",
"type": "ClaudeCode",
"version": "string"
},
"configFiles": {
"key": "string"
},
"coverage": {
"app": "captured",
"configFiles": "captured",
"definition": "captured",
"mcpServers": "captured",
"memory": "captured",
"model": "captured",
"permissions": "captured",
"skills": "captured",
"systemPrompt": "captured",
"tools": "captured"
},
"definition": "string",
"mcpServers": [
{
"agent": "string",
"args": [
"string"
],
"command": "string",
"name": "string",
"transport": "streamable_http",
"url": "string"
}
],
"memory": [
{
"agent": "string",
"backend": "state",
"path": "/AGENTS.md",
"scope": {
"kind": "thread"
}
}
],
"model": [
{
"agent": "string",
"model": "gpt-4.1",
"provider": "openai"
}
],
"permissions": [
"string"
],
"schemaVersion": "1",
"skills": {
"key": "string"
},
"systemPrompt": [
{
"agent": "string",
"cid": "string",
"role": "system"
}
],
"tools": [
{
"agent": "string",
"name": "string",
"sourceHash": "string"
}
],
"type": "AgentConfigurationV1"
}Responses
200The CID of the agent configuration
configurationstringrequired
{
"configuration": "string"
}400The document is not an AgentConfigurationV1 schema 1, or it contradicts its own coverage
callstackobjectShow properties
object | nullerrorstringrequired
{
"callstack": {},
"error": "string"
}401Missing or invalid bearer token
callstackobjectShow properties
object | nullerrorstringrequired
{
"callstack": {},
"error": "string"
}403Caller is not the Governance Service: certify_agents, which no user or API key holds, is required
callstackobjectShow properties
object | nullerrorstringrequired
{
"callstack": {},
"error": "string"
}422The body does not match the schema: a missing or unknown field, or an unknown coverage value
string
500Internal error recording the configuration
callstackobjectShow properties
object | nullerrorstringrequired
{
"callstack": {},
"error": "string"
}503Auth Service or blob storage unavailable
callstackobjectShow properties
object | nullerrorstringrequired
{
"callstack": {},
"error": "string"
}