Poweruser API

The Poweruser API gives you programmatic access to everything you can do in the Autessa Builder — create and publish agents, configure tools, manage AutessaDB tables and triggers, provision phone numbers, send e-signature envelopes, and more. It is the management surface of the platform, as opposed to the Client API, which executes published resources.

---

Base URL

https://api.autessa.com/autessa_poweruser

Every endpoint is POST and takes a JSON request body. Endpoints with no parameters still expect a body — send an empty object {}.

---

Authentication

Pass a poweruser key in the Authorization header. Two formats are accepted:

Permanent keys

Authorization: pwrusr:{key_id}:{secret}

Temporary keys (JWT-based, expiring credentials — issued for scoped integrations):

Authorization: pwrusr_temp:{jwt}

Both formats are validated by the same filter and behave identically once authenticated; the only difference is lifetime and how the credential is issued.

Creating a key

Poweruser keys are created in the Builder under API management. See Poweruser Keys for a step-by-step walkthrough, including how to create endpoint-scoped keys.

cURL

curl https://api.autessa.com/autessa_poweruser/user/me \
  -X POST \
  -H "Authorization: $POWERUSER_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'

JavaScript

const response = await fetch(
  'https://api.autessa.com/autessa_poweruser/user/me',
  {
    method: 'POST',
    headers: {
      'Authorization': process.env.POWERUSER_KEY,
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({})
  }
);

const data = await response.json();

Python

import os
import requests

response = requests.post(
    'https://api.autessa.com/autessa_poweruser/user/me',
    headers={'Authorization': os.environ['POWERUSER_KEY']},
    json={}
)

data = response.json()

Response

{
  "email": "jane@acme.com",
  "name": "Jane Doe",
  "companyName": "Acme Corp"
}

---

The acts-as-user model

Every poweruser key is linked to a user and a company. When a request authenticates, the platform builds the exact same session context that user would have in the Builder for that company, and the request executes as that user:

• Resource visibility follows the linked user's ownership and sharing — "list all" endpoints return the same owned / company-shared / shared-with-me groupings the user sees in the Builder.
• Access-level checks (READ / WRITE / PUBLISH / ADMIN on agents, tools, managers, and so on) are evaluated against the linked user.
• Anything the key creates is owned by the linked user in the linked company.
• All activity is logged to the transaction log as the linked user.

If you need the API to own resources on behalf of a team, link the key to a service user with the right memberships rather than a personal account.

---

Scoped keys and endpoint discovery

A poweruser key can be scoped to an explicit allow-list of endpoints when it is created. A scoped key that calls any endpoint outside its allow-list is rejected with HTTP 403 before the request reaches the endpoint:

{
  "error": "Endpoint not permitted for this API key"
}

Scopes are defined in terms of endpoint keys (for example AGENTS_ALL, TOOLS_CREATE). To discover every endpoint key, its path, and its group, call /user/available-endpoints — it returns the full endpoint registry, which is also the set of values you can select when creating a scoped key.

cURL

curl https://api.autessa.com/autessa_poweruser/user/available-endpoints \
  -X POST \
  -H "Authorization: $POWERUSER_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'

Response (truncated)

{
  "endpoints": [
    {
      "key": "AGENTS_ALL",
      "path": "/autessa_poweruser/agents/all",
      "group": "Agents"
    },
    {
      "key": "TOOLS_CREATE",
      "path": "/autessa_poweruser/tools/create",
      "group": "Tools"
    }
  ],
  "errors": []
}

---

Conventions

IDs are opaque strings

Every resource ID that appears in a request or response — agentId, toolId, managerId, newOwnerId, mcpServerId, and so on — is a short opaque string like "V1StGXR8Z5". Treat IDs as stable identifiers: pass them back exactly as you received them, and never construct or increment them.

Requests

• Method is always POST, body is always JSON (Content-Type: application/json).
• Endpoints without parameters take an empty object {}.
• Timestamps are ISO-8601 date-times without a zone suffix (for example "2026-06-28T17:42:10"), interpreted as UTC.

Error shape

Every response body extends a common envelope. On success the HTTP status is 200 and errors is empty or absent. On failure the body carries human-readable messages:

{
  "errors": ["User does not have permission to delete agent."]
}

HTTP status codes:

Status	Meaning
200	Success.
401	Authentication or authorization failed (bad key, or the linked user lacks access to the resource).
403	A scoped key called an endpoint outside its allow-list (body is {"error": "..."}, sent by the auth filter).
408	A server-side error was caught while executing the request; errors contains the message.

Responses may also include a deprecationWarnings array of strings when you call something slated for change — treat entries as a prompt to migrate.

---

Endpoint directory

Group	Page	What it covers
User	User	Key introspection: linked user, company, endpoint registry.
Agents	Agents	Create, configure, version, publish, and analyze agents.
Tools	Tools	Create and configure tools of any tool type, including from MCP servers.
Managers	Managers	Multi-agent managers: configuration, versioning, conversations.
AutessaDB Tables	AutessaDB Tables	Table and schema management, knowledge bases, sharing.
AutessaDB Queries	AutessaDB Query	Row-level insert, update, delete, query, search, and uploads.
AutessaDB Triggers	AutessaDB Triggers	Trigger creation, enable/disable, and execution history.
AutessaDB Analytics	AutessaDB Analytics	Analytics table creation, columns, semantic layer, loads, and SQL query jobs.
Connectors	Connectors	Connect, manage, share, and operate external connectors, including per-family actions.
Scheduled Events	Scheduled Events	Cron and one-off scheduled event management.
Custom Webhooks	Custom Webhooks	Inbound webhook handlers and execution history.
API Keys	API Keys	Provision, scope, rotate and audit client API keys (so a hosted app can mint its own).
MCP Servers	MCP	MCP server registration, connection testing, discovery.
Custom Apps	Custom Apps	Custom app projects, files, builds, and vibecode sessions.
Phone Numbers	Phone Numbers	Phone number purchase, routing, and release.
SMS Consent	SMS Consent	SMS consent record creation and search.
Meeting Recorder	Meeting Recorder	Meeting bots and recordings.
E-Signature	E-Signature Envelopes and E-Signature Templates	Envelope send/track and template management.
Voice Cloning	Voice Cloning	Instant and deep voice clones.
Conversation Sync	Conversation Sync	Conversation data export and sync.
Company	Company	Company settings, team, and limits.

---

Related

• Poweruser Keys guide — creating and scoping keys
• Authentication guide
• API overview