The agent's saved engine rules next to the workspace's
settings are the agent's own rules and settings_revision guards them (null while none are saved). workspace repeats the workspace's rules, which also apply, read only here. inherited counts the restrictions the agent took over from its profile (entries, rules); the rules themselves are an operator's and are not shown. reach says what the allow lists do together: agent_allow_without_effect names the agent's allow/environment entries the workspace does not share, which do nothing because a grant needs both sides, and workspace_allow_inactive is true when the workspace allows something the agent's own list leaves empty. writes_open says whether a save is accepted now. Whoever manages the agent reads it, and so do the live members of its managing team, with a console session or with their personal API key; an agent's own key does not.
Scope: sessions:read (API key or cookie session).
AuthorizationBearer <token>For servers and scripts: an API key sent as an HTTP bearer token, Bearer <key>. It holds exactly the scopes it was issued with; a key issued before scopes existed holds none. It never needs the CSRF header, and it cannot manage agents, members, teams or API keys. Issue one in the web console under Settings → API keys; each operation names the scope it needs.
Scope: sessions:read
id*stringThe agent's id.
^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$uuidThe agent's rules, the workspace's and how they combine.
application/json- response
settings*settings_revision*|nullworkspace*inherited*reach*writes_open*booleancurl -X GET 'https://example.com/v1/agents/497f6eca-6276-4993-bfeb-53cbbbba6f08/engine-settings'{ "settings": { "permissions": { "ask": [ "WebFetch" ] }, "auto_mode": {} }, "settings_revision": 1, "workspace": { "settings": { "permissions": { "deny": [ "Bash(rm:*)" ] }, "auto_mode": {} }, "settings_revision": 2 }, "inherited": { "entries": 0, "rules": 0 }, "reach": { "agent_allow_without_effect": { "permissions": [], "auto_mode_allow": [], "auto_mode_environment": [] }, "workspace_allow_inactive": false }, "writes_open": true}