Scalekix API Reference

Authentication

Use a Scalekix API key as a bearer token for authentication. Create and manage API keys from your dashboard at Account → API Keys.

Authorization: Bearer skx_live_your_api_key_here

Agents

POST /agents

Create an agent and issue its credential. When an agent with the requested name already exists in the account, the existing agent record is returned and no duplicate is created.

Request body

{
  "name": "my-agent",
  "scopes": ["db:read", "api:call"],
  "ttl_hours": 720,
  "tags": {
    "env": "production",
    "team": "platform"
  }
}

Response

{
  "id": "skx://agent/my-agent/a1b2c3d4",
  "name": "my-agent",
  "scopes": ["db:read", "api:call"],
  "ttl_hours": 720,
  "credential": "skx_cred_...",
  "expires_at": "2026-09-15T12:00:00Z",
  "tags": { "env": "production", "team": "platform" },
  "created_at": "2026-06-17T12:00:00Z"
}

Note: The credential field appears only in the initial registration response. Store it securely because it cannot be retrieved later. Rotate a credential through the credential rotation endpoint.

GET /agents

Return every agent in the account. Use the cursor parameter for pagination.

Query parameters

Parameter	Type	Description
`limit`	integer	Results to return per page. Default 20, max 100.
`cursor`	string	Pagination cursor from previous response.
`tag`	string	Restrict results to a tag value using the `key:value` format.

DELETE /agents/:id

Immediately revoke an agent's credential. The agent's skx:// ID stays in the audit log for historical reference, while the credential becomes invalid within 5 seconds of the call.

Invoke

POST /invoke

Send a gated request through the Scalekix gateway for an agent. The gateway validates the credential, checks its scope, forwards the request to the target, and records an audit event.

Request headers

Header	Required	Description
`X-Skx-Credential`	Yes	The agent's credential string.
`X-Skx-Run-Id`	No	Optional run ID used to correlate pipeline activity in the audit log.

Request body

{
  "target": "https://your-api.example.com/data",
  "method": "GET",
  "headers": { "Accept": "application/json" }
}

Audit log

GET /audit

Fetch audit events with filters for agent, time range, scope, status, and run ID. Results are ordered newest first.

Query parameters

Parameter	Type	Description
`agent_id`	string	Filter by agent `skx://` ID.
`agent_name`	string	Limit results to an exact agent name match.
`scope`	string	Limit results by the scope used, such as `db:read`.
`status`	string	`allowed` or `denied`.
`run_id`	string	Filter by pipeline run ID.
`since`	ISO 8601	Start of time range.
`until`	ISO 8601	End of time range.
`limit`	integer	Page size, max 500.
`cursor`	string	Pagination cursor from previous response.

Error codes

HTTP Status	Error code	Meaning
400	`invalid_request`	A required field is missing or the JSON is malformed.
401	`unauthorized`	Invalid or missing API key.
403	`scope_violation`	The agent tried to perform an action beyond its declared scopes.
403	`credential_revoked`	The agent's credential was revoked.
404	`agent_not_found`	No agent matches the supplied ID or name.
429	`rate_limited`	Request volume is too high. Retry after the interval specified by the `Retry-After` header.
500	`internal_error`	A server error occurred. Contact support if the issue continues.