Create a new immutable agent version
Creates a new immutable agent version from a full definition and moves the agent’s latest pointer to it, in one atomic operation. base_agent_version_id must be the agent’s current latest_agent_version_id or the request is rejected with 409 revision_conflict, so the caller can re-read and retry rather than silently racing another writer. Every field is full content, there is no partial-update or omit-to-inherit semantics, so an omitted field is cleared rather than carried over from the base version. Tags are changed only through the dedicated agent tag routes. Invalid promptCacheTTL or promptCacheSharedTTL settings in model_config.provider_params return 400 when prompt caching is enabled. Invalid model_config and unsupported reasoning_effort values return 400, including when the model catalog lists no exact options for the selected model; a model catalog that cannot be read to verify them returns 503. The response’s execution definition and latest_agent_version_id are the exact values this call committed; created_at and updated_at are the authoritative persisted timestamps; tags are mutable catalog metadata and are not changed by this route. Do not automatically retry an ambiguous transport failure: re-read the agent’s latest version first, because this operation does not replay a prior response.
Authorizations
A Recursion API key, created in the console under API keys.
Headers
Optional tenant consistency check. When present, it must name the tenant bound to the API key, including when x-organization-id is default.
1Organization in which to act. Required for a tenant-scoped API key. Optional for an organization-scoped key, where it must name that same organization. The value may be an organization id or default.
1Path Parameters
Agent id (UUID) as returned by managedAgentsCreateAgent or managedAgentsListAgents.
Body
Request body for creating a new immutable standalone Managed Agent version. Send every field you want to keep: omitted fields are cleared, except that web search turns on and the template stays. base_agent_version_id must name the current version or the request is rejected with revision_conflict.
The agent's current latest_agent_version_id, as returned by managedAgentsGetAgent. Rejected with 409 revision_conflict if it is not the agent's current version, whether stale or unknown.
Public model id copied from GET /managed-agents/v1/models (for example anthropic/claude-sonnet-5-5). Agent reads return the same public id. An id the catalog does not list is rejected with a list of available public ids.
Human-readable label for the agent. Required, and not blank; surrounding whitespace is trimmed.
Built-in integrations this agent may use, each naming an active organization connection an admin added on the Integrations page. A non-empty tools list narrows this agent below the connection's organization allow-list; omission inherits it. Sessions receive short-lived access restricted to the effective tools; nothing is granted through a vault. Omit or send [] for no connections. Carried in full on every version write.
25Individual default items within default_vault_ids. The list is a whitelist across every default vault, not a filter within one, so it must name every item the agent should receive. Omit to select every item the default vaults hold when the agent is saved. The selection is stored with the agent version, so a credential added to one of those vaults later is not included until the agent is saved again with it selected. [] alongside a non-empty default_vault_ids is rejected because it would select none.
The agent's default criteria, in order. Send [] to clear them. With defaultEvaluatorAgentId they define a default outcome for this agent's sessions; without one they are the criteria this agent checks when it evaluates another session. Send these or default_rubric; both are accepted only when the rubric parses to exactly these criteria, as in a read-back body, and the rubric is then kept as written. Criteria render to at most 256 KiB. An explicit session outcome overrides the default.
200Billing project copied into sessions started from this agent when their create request omits project_id. A non-empty session project_id overrides it. Accepted only on a model that GET /managed-agents/v1/models marks requiresProject; refused with 400 for an organization whose model list has no such model.
Deprecated: send default_criteria. Markdown rubric, read into the agent's default criteria when saved. With defaultEvaluatorAgentId it defines a default outcome for this agent's sessions; without one it supplies fallback criteria when this agent evaluates another session. Must contain at least one gradeable markdown list item. An explicit session outcome overrides the default.
Vaults granted by default when a session create request omits vault_ids. default_credential_refs may narrow their items.
Default evaluator for inherited outcomes and explicit outcomes that omit evaluatorAgentId. Without it, default_rubric supplies fallback criteria when this agent evaluates another session.
Optional free-text note about what the agent is for. Not sent to the model.
Native integration providers whose MCP tools sessions of this agent do not receive even though the grant is present; the agent's own mcp_servers are never affected. github is accepted but ignored, because a GitHub grant always keeps its MCP tools alongside git and gh in the sandbox. Omitting the field means none, on managedAgentsCreateAgent as on managedAgentsCreateAgentVersion.
Whether sessions started from this agent may search and read the session outputs its earlier sessions saved, with search_agent_files and read_agent_file. Omit to leave it off. Checked again on every search and read, so turning it off takes effect at once.
Maximum number of this agent's root sessions that may run or wait on compute at once. Omit for unlimited. Sessions beyond the cap are accepted with execution_state=queued and wait until a slot frees; child/subagent sessions and outcome evaluation passes do not count.
1 <= x <= 10000Remote MCP servers whose tools are added to the agent's tool surface. Each entry is an object with name and url, e.g. {"name": "docs", "url": "https://example.com/mcp"}. Credentials come from the vaults granted to the session, and the discovered tool list is snapshotted at session start, so a later edit here does not change a running session.
Free-form caller-owned JSON stored with the agent and returned on reads. Not interpreted by the service and never sent to the model.
Default inference config applied to sessions started from this agent. Omit model_config or send {} to use provider defaults; null is invalid. reasoning_effort is normalized and validated for direct providers, and must exactly match the selected catalog model's supportedReasoningEfforts. An unsupported reasoning_effort, including any value for a catalog model that lists no exact options, returns 400. Authored provider_params.thinking objects are validated. When prompt caching is enabled, invalid provider_params.promptCacheTTL or provider_params.promptCacheSharedTTL values, incompatible models, and shared retention shorter than promptCacheTTL return 400. These checks run on agent and version writes and again at session start; a model catalog that cannot be read to verify settings returns 503.
Multiagent roster: the delegation targets this agent may hand work to, team mode and limits. Snapshotted at session start; a child roster may tighten the recursion depth ceiling, never widen it.
Native connections this agent may use, with provider-enforced permission and resource restrictions. Omit or send [] for none. Stored in full on each agent version; secrets remain on the connection.
25Course correction of this agent's running sessions: an advisor it may consult, the interventionist's template steers, and a supervisor that steers or halts when a detector fires. Snapshotted at session start.
Skill declarations made available to the agent, passed through as given and snapshotted into the session at start. Capped at the 100 skills a session can carry.
100Optional system prompt for the agent. Omit it or send an empty string for none: the agent then runs on the platform's short general-purpose instructions, and every session still tells it which tools it has and what its task is.
Reviewed template id and revision used to prefill this definition.
How sessions started from this agent reach their tools: native lists every tool to the model; codemode hides ordinary tools behind one JavaScript tool, keeping tools that need approval and read_file native. Omit for native. Refused when the organization is not enabled for codemode. Snapshotted when a session starts.
native, codemode Optional single-line note saved with this version, for change context. At most 2000 characters and no line breaks. Not part of the definition; it never affects config-equality or restore.
2000Whether sessions started from this agent may use the native web_search tool. Omit to enable it. The setting is snapshotted when a session starts.
Response
A configured standalone Managed Agent: its versioned execution definition plus current mutable classification tags. Publishing the execution definition mints a new immutable version; applying tags does not.
A configured standalone Managed Agent: its versioned execution definition plus current mutable classification tags. Publishing the execution definition mints a new immutable version; applying tags does not.
Server-assigned id of the agent, used in the agent, agent-version, and session routes.
Server-assigned RFC 3339 timestamp of when the agent was created.
Narrows the default vaults to individual credentials. Every credential is selected when a vault is first added, and may then be unchecked.
Vaults whose credentials are copied into a new session when its create request omits vault_ids. Sending an explicit empty list on the session still overrides these.
Native integration providers whose MCP tools new sessions of this agent do not receive, even though the grant is present. Suppresses integration-derived servers only, never the agent's own mcp_servers. github is ignored, because a GitHub grant always keeps its MCP tools alongside git and gh in the sandbox. A version write carries the list in full: omitting it publishes a version with none.
Remote MCP servers to attach. Each entry is an object with name (the label the server's tools are grouped under) and url (its http/https endpoint); any further keys are passed to the runtime unchanged. Credentials come from the vaults granted to the session, not from this entry. Tools are discovered and snapshotted at session start.
Public model id from GET /managed-agents/v1/models, for example anthropic/claude-sonnet-5-5. Agent reads return the same public id. An id the catalog does not list is rejected here, before the session starts.
Default inference settings for every turn. temperature and top_p are stored but not sent to the model.
Human-readable label shown wherever agents are listed. Not required to be unique.
Organization that owns the agent. Server-assigned from the authenticated principal; never accepted from the caller.
Skill packages loaded into the agent's runtime, each an entry with the skill reference and its metadata.
System prompt prepended to every conversation this agent runs.
Current organization-scoped classification tags applied to this agent. Always an array. Tags are mutable catalog metadata and are deliberately absent from AgentVersion and session runtime snapshots.
Server-assigned RFC 3339 timestamp of the most recent update to the agent.
Built-in integrations this agent may use, each naming an active organization connection an admin added on the Integrations page. A non-empty tools list narrows this agent below the connection's organization allow-list; omission inherits it. Sessions receive short-lived access restricted to the effective tools. Not a vault grant: nothing about these appears under credential access. A version write carries the list in full: omitting it publishes a version with none.
The agent's default criteria, in order: the criteria default_rubric renders. Absent when the agent has no default rubric, or one saved before criteria were structured that has no structured form.
Billing project copied into new sessions when their create request omits project_id. A non-empty session project_id overrides it. Carried in full on every version write: omitting it publishes a version with no default.
Markdown rubric that sessions of this agent are graded against by default when they start with a message. A session that supplies its own outcome ignores this entirely. Carried in full on every version write: omitting it publishes a version with no rubric.
Default evaluator for inherited outcomes and explicit outcomes that omit evaluatorAgentId.
Free-text note about what this agent is for.
Whether this exact agent definition is compatible with the standalone execution context. Omitted by deployments that do not compute it; a client must treat any present value other than compatible as incompatible.
compatible, incompatible Whether new sessions may search and read the session outputs this agent's earlier sessions saved. Omitted means off.
Server-maintained id of the newest version of this agent; sessions started without an explicit version use it.
Maximum number of this agent's root sessions that may run or wait on compute at once. Omit for unlimited. Sessions beyond the cap are accepted with execution_state=queued and wait until a slot frees; child/subagent sessions and outcome evaluation passes do not count. Carried in full on every version write: omitting it publishes a version with no cap.
1 <= x <= 10000Caller-owned key/value data stored with the agent and returned unchanged.
Multi-agent orchestration settings, such as subagent definitions and delegation limits.
Native connections this agent may use, with provider-enforced permission and resource restrictions. Omit or send [] for none. Stored in full on each agent version; secrets remain on the connection.
25Course correction of this agent's running sessions: advisor, interventionist and supervisor.
Whether this agent type supports new sessions here. Other start requirements still apply. Existing sessions and agent editing remain available when false.
Reviewed template revision this agent's current version started from.
How sessions started from this agent reach their tools: native lists every tool to the model; codemode hides ordinary tools behind one JavaScript tool, keeping tools that need approval and read_file native. Omit for native. Refused when the organization is not enabled for codemode. Snapshotted when a session starts.
native, codemode Whether new sessions may use the native web_search tool. Omitted on legacy agents and interpreted as enabled.