Agents
The AI agents you test: a name and a model configuration (provider, endpoint and a ${VARIABLE} reference to the secret holding its key). Campaigns and runs target an agent.
List agents
Returns the agents of the caller's organization, ordered by name, 10 per page (`page`). Staff users see every organization's agents; a user without an organization sees the agents they own. Accepts an API key or a login token.
Create an agent
Registers an agent to test in the caller's organization, owned by the caller. `config` is a hackagent model configuration: the model `name` and its `connection`. `agent_type` and `endpoint` are copied from `config.connection` and cannot be set directly. Credentials are never stored with the agent: `config.connection.api_key` must be a `${VARIABLE}` reference to an organization secret (see `POST /secret`), and a literal credential anywhere in `config` is refused with 400. Names are unique within an organization. 403 when the caller has no organization.
Retrieve an agent
Returns one agent of the caller's organization. A cloud run's token may read its run's agent only.
Replace an agent
Replaces the agent's `name`, `description` and `config` (send them all). `agent_type` and `endpoint` are copied from `config.connection` and cannot be set directly. Credentials are never stored with the agent: `config.connection.api_key` must be a `${VARIABLE}` reference to an organization secret (see `POST /secret`), and a literal credential anywhere in `config` is refused with 400. Runs already launched keep the configuration they were launched with.
Update an agent
Changes only the fields sent, with the same rules for `config` as `PUT`. A cloud run's token may update its run's agent only.
Delete an agent
Deletes the agent with its attack configurations, campaigns and runs, including their results and traces. This cannot be undone.