Agent Users

GET /api/v1/brands/{brand_id}/agent-users

List Agent Users

Parameters

brand_id integer path required

include_inactive boolean query

Responses

200Successful Response
422Validation Error

GET /api/v1/brands/{brand_id}/agent-users

curl -X GET 'https://api.example.com/api/v1/brands/{brand_id}/agent-users' \
  -H 'Authorization: Bearer '

import httpx

resp = httpx.get(
    "https://api.example.com/api/v1/brands/{brand_id}/agent-users",
    headers={"Authorization": "Bearer "},
)
resp.raise_for_status()
print(resp.json())

const resp = await fetch("https://api.example.com/api/v1/brands/{brand_id}/agent-users", {
  method: "GET",
  headers: { "Authorization": "Bearer " }
});
const data = await resp.json();
console.log(data);

package main

import (
	"net/http"
)

func main() {
	req, _ := http.NewRequest("GET", "https://api.example.com/api/v1/brands/{brand_id}/agent-users", nil)
	req.Header.Set("Authorization", "Bearer ")
	resp, _ := http.DefaultClient.Do(req)
	defer resp.Body.Close()
}

DELETE /api/v1/brands/{brand_id}/agent-users/{agent_user_id}

Revoke Agent User

Revoke the agent's token *for this brand only*. Cross-brand isolation: the agent keeps working in every other brand where it still has a live token. The underlying ``agent_users`` row persists — if the agent re-auths later, we'll refresh its tokens again with the same OPVS identity.

Parameters

brand_id integer path required

agent_user_id string path required

Responses

200Successful Response
422Validation Error

DELETE /api/v1/brands/{brand_id}/agent-users/{agent_user_id}

curl -X DELETE 'https://api.example.com/api/v1/brands/{brand_id}/agent-users/{agent_user_id}' \
  -H 'Authorization: Bearer '

import httpx

resp = httpx.delete(
    "https://api.example.com/api/v1/brands/{brand_id}/agent-users/{agent_user_id}",
    headers={"Authorization": "Bearer "},
)
resp.raise_for_status()
print(resp.json())

const resp = await fetch("https://api.example.com/api/v1/brands/{brand_id}/agent-users/{agent_user_id}", {
  method: "DELETE",
  headers: { "Authorization": "Bearer " }
});
const data = await resp.json();
console.log(data);

package main

import (
	"net/http"
)

func main() {
	req, _ := http.NewRequest("DELETE", "https://api.example.com/api/v1/brands/{brand_id}/agent-users/{agent_user_id}", nil)
	req.Header.Set("Authorization", "Bearer ")
	resp, _ := http.DefaultClient.Do(req)
	defer resp.Body.Close()
}

POST /api/v1/brands/{brand_id}/agent-users/{agent_user_id}/regenerate

Regenerate Agent Token

Rotate the PAT for this agent in this brand. The plaintext is returned in the response — this is a dashboard-initiated rotation and the caller is an authenticated admin, so there's no Redis hand-off dance (that exists for the email-approval flow where the agent and the approver are different entities). Agent must update its stored token manually, same as any API-key rotation.

Parameters

brand_id integer path required

agent_user_id string path required

Responses

200Successful Response
422Validation Error

POST /api/v1/brands/{brand_id}/agent-users/{agent_user_id}/regenerate

curl -X POST 'https://api.example.com/api/v1/brands/{brand_id}/agent-users/{agent_user_id}/regenerate' \
  -H 'Authorization: Bearer '

import httpx

resp = httpx.post(
    "https://api.example.com/api/v1/brands/{brand_id}/agent-users/{agent_user_id}/regenerate",
    headers={"Authorization": "Bearer "},
)
resp.raise_for_status()
print(resp.json())

const resp = await fetch("https://api.example.com/api/v1/brands/{brand_id}/agent-users/{agent_user_id}/regenerate", {
  method: "POST",
  headers: { "Authorization": "Bearer " }
});
const data = await resp.json();
console.log(data);

package main

import (
	"net/http"
)

func main() {
	req, _ := http.NewRequest("POST", "https://api.example.com/api/v1/brands/{brand_id}/agent-users/{agent_user_id}/regenerate", nil)
	req.Header.Set("Authorization", "Bearer ")
	resp, _ := http.DefaultClient.Do(req)
	defer resp.Body.Close()
}