List agents

View as Markdown
Returns the workspace's agents, newest first (`created_at` descending). Soft-deleted agents are never returned. Pagination is keyset on `created_at`: to fetch the next page, pass the `created_at` of the last agent you received as `cursor`. The response carries no pagination metadata — a page shorter than `limit` is the last one. Two agents created in the same millisecond straddling a page boundary can be skipped, because the cursor comparison is strict. See [Pagination](/pagination). List items carry a projection of the agent: `chat_system_prompt`, `tool_profile`, `base_prompt_version`, `workflow`, `tool_surface_version`, `high_risk`, `paused_by`, `paused_reason`, `action_limits` and `deleted_at` are only returned by `GET /api/agents/{agentId}`. **Consistency.** Each page is cached for up to 120 seconds per workspace and query. Creates, updates and deletes made through this API clear the cache immediately; changes made by background processes (provider provisioning, tool-surface sync, pausing) can take up to 120 seconds to show. **Access** - **Required scope:** `read`. Any workspace role can call it. - **Rate limit:** General API — 120 (Starter), 200 (Growth), 300 (Business) or 600 (Enterprise) requests/min per workspace. See [Rate limits](/rate-limits). - **Plan:** Available on every plan.

Authentication

AuthorizationBearer
Workspace API key: `jl_` followed by 64 lowercase hex characters, created by the workspace owner in the dashboard (**Settings → API Keys**) and sent as `Authorization: Bearer jl_...`. The plaintext is shown once, at creation; Jelliu stores only a SHA-256 hash. A workspace can hold up to 25 active keys. | Scope | GET / HEAD | POST / PUT / PATCH / DELETE | Admin-only routes | | --- | --- | --- | --- | | `read` | Yes | No | No | | `write` | Yes | Yes | No | | `full` | Yes | Yes | Yes | Operations restricted to admins or owners reject keys without the `full` scope with `403`, and say so in their description. No key, whatever its scope, can mint or revoke API keys or rotate a webhook secret — that requires a signed-in owner session. A revoked key stops authenticating within about 10 seconds. See [Authentication](/authentication).

Query parameters

limitintegerOptional1-200Defaults to 50

Maximum agents to return, 1-200. Defaults to 50. A value outside the range or not an integer is rejected with 400 (not clamped).

cursordatetimeOptional

Return agents created strictly before this instant: the created_at of the last agent of the previous page. ISO 8601 in UTC with a Z suffix; an offset such as -05:00 or a date without time is rejected with 400.

searchstringOptional1-200 characters

Case-insensitive substring match on the agent name. Trimmed; 1-200 characters after trimming (a whitespace-only value is rejected with 400). % and _ match literally.

Response

A page of agents (list projection).

datalist of objects
Agents, newest first. Empty array when there are none.

Errors

400
Bad Request Error
401
Unauthorized Error
403
Forbidden Error
429
Too Many Requests Error