Get one agent
Returns one agent resolved to its latest immutable version, including its system prompt and default credential grants. A soft-deleted or unknown id is a 404.
Authorizations
A Recursion API key, created in the console under API keys.
Headers
Optional tenant consistency check. When present, it must name the tenant bound to the API key, including when x-organization-id is default.
1Organization in which to act. Required for a tenant-scoped API key. Optional for an organization-scoped key, where it must name that same organization. The value may be an organization id or default.
1Path Parameters
Agent id (UUID) as returned by managedAgentsCreateAgent or managedAgentsListAgents.
Response
A configured standalone Managed Agent: its versioned execution definition plus current mutable classification tags. Publishing the execution definition mints a new immutable version; applying tags does not.
A configured standalone Managed Agent: its versioned execution definition plus current mutable classification tags. Publishing the execution definition mints a new immutable version; applying tags does not.
Server-assigned id of the agent, used in the agent, agent-version, and session routes.
Server-assigned RFC 3339 timestamp of when the agent was created.
Narrows the default vaults to individual credentials. Every credential is selected when a vault is first added, and may then be unchecked.
Vaults whose credentials are copied into a new session when its create request omits vault_ids. Sending an explicit empty list on the session still overrides these.
Native integration providers whose MCP tools new sessions of this agent do not receive, even though the grant is present. Suppresses integration-derived servers only, never the agent's own mcp_servers. github is ignored, because a GitHub grant always keeps its MCP tools alongside git and gh in the sandbox.
Remote MCP servers to attach. Each entry is an object with name (the label the server's tools are grouped under) and url (its http/https endpoint); any further keys are passed to the runtime unchanged. Credentials come from the vaults granted to the session, not from this entry. Tools are discovered and snapshotted at session start.
Public model id from GET /managed-agents/v1/models, for example anthropic/claude-sonnet-5-5. Agent reads return the same public id. An id the catalog does not list is rejected here, before the session starts.
Default inference settings applied to every turn unless a session overrides them.
Human-readable label shown wherever agents are listed. Not required to be unique.
Organization that owns the agent. Server-assigned from the authenticated principal; never accepted from the caller.
Skill packages loaded into the agent's runtime, each an entry with the skill reference and its metadata.
System prompt prepended to every conversation this agent runs.
Current organization-scoped classification tags applied to this agent. Always an array. Tags are mutable catalog metadata and are deliberately absent from AgentVersion and session runtime snapshots.
Server-assigned RFC 3339 timestamp of the most recent update to the agent.
Built-in integrations this agent may use, each naming an active organization connection an admin added on the Integrations page. A non-empty tools list narrows this agent below the connection's organization allow-list; omission inherits it. Sessions receive short-lived access restricted to the effective tools. Not a vault grant: nothing about these appears under credential access. A version write carries the list in full: omitting it publishes a version with none.
Billing project copied into new sessions when their create request omits project_id. A non-empty session project_id overrides it. Carried in full on every version write: omitting it publishes a version with no default.
Markdown rubric that sessions of this agent are graded against by default when they start with a message. A session that supplies its own outcome ignores this entirely. Carried in full on every version write: omitting it publishes a version with no rubric.
Free-text note about what this agent is for.
Whether this exact agent definition is compatible with the standalone execution context. Omitted by deployments that do not compute it; a client must treat any present value other than compatible as incompatible.
compatible, incompatible Whether new sessions may search and read the session outputs this agent's earlier sessions saved. Omitted means off.
Server-maintained id of the newest version of this agent; sessions started without an explicit version use it.
Maximum number of this agent's ordinary root sessions that may run or wait on compute at once. Omit for unlimited. Sessions beyond the cap are accepted with execution_state=queued and wait until a slot frees; child/subagent sessions and outcome evaluation passes do not take a slot. Carried in full on every version write: omitting it publishes a version with no cap.
1 <= x <= 10000Caller-owned key/value data stored with the agent and returned unchanged.
Multi-agent orchestration settings, such as subagent definitions and delegation limits.
Native connections this agent may use, with provider-enforced permission and resource restrictions. Omit or send [] for none. Stored in full on each agent version; secrets remain on the connection.
25Whether this agent type supports new sessions here. Other start requirements still apply. Existing sessions and agent editing remain available when false.
Reviewed template revision this agent's current version started from.
Whether new sessions may use the native web_search tool. Omitted on legacy agents and interpreted as enabled.