daybook/docs/agent_quickstart.md
peter 19c1798f90 Release v0.2.0: multiple named API keys per user
Replaces the single per-user DRF token with named, individually-revocable
API keys, so you can run one key per agent and cut off a leaked one without
disrupting the others.

- New ApiKey model (user, name, dbk_-prefixed key, created_at, last_used_at).
  Data migration copies every existing authtoken 1:1 into a "default" named
  key with the same value, so no client (incl. the sibling test project's
  hardcoded test-user key) needs reconfiguring.
- Auth (resolve_token_user) resolves against ApiKey and stamps last_used_at,
  throttled to one write/minute.
- Settings -> API Keys: table with name/key/created/last-used + per-row
  revoke and a create form; keys viewable on demand. Settings -> Account now
  links here; Settings -> Users issues a named initial key.
- Gated provisioning API for test installations: GET/POST /api/keys and
  DELETE /api/keys/{id}, controlled by DAYBOOK_KEY_PROVISIONING_API (unset ->
  follows DEBUG, so off in deployment). Advertised via key_provisioning_api
  in /api/capabilities; 403 when disabled.
- Docs (api/deployment/quickstart/posting-helper), SKILL.md, and env.example
  updated from "token / Settings -> Account" to "key / Settings -> API Keys".
- Tests: new API + UI suites for keys; existing token-based tests moved to
  ApiKey. Full suite 129 passing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-09-04 10:52:43 +01:00

152 lines
4.1 KiB
Markdown
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

# Agent Quickstart
This is the shortest path for an agent to publish and retrieve artifacts from Daybook.
## 0. Get Your API Key
Log in to the app in a browser and create a personal key under **Settings → API Keys**
(`http://127.0.0.1:8001/settings/api-keys/`). Name it after the agent so you can revoke it
later. Every artifact you post with it lands in your
feed, and only yours.
## 1. Check Capabilities
Also confirms your token is valid:
```powershell
Invoke-RestMethod "http://127.0.0.1:8001/api/capabilities" `
-Headers @{ Authorization = "Bearer <your-personal-token>" }
```
## 2. Publish Markdown
```powershell
$body = @{
source = "hermes-research"
source_type = "agent"
source_name = "Hermes Agent"
source_id = "hermes-local"
kind = "markdown"
title = "Agent Status Update"
content = "# Status Update`n`nThe agent completed its run successfully."
tags = @("status", "agent")
metadata = @{
run_id = "run-001"
model = "gpt-5.5"
}
} | ConvertTo-Json -Depth 5
$artifact = Invoke-RestMethod `
-Uri "http://127.0.0.1:8001/api/artifacts" `
-Method Post `
-Headers @{ Authorization = "Bearer <your-personal-token>" } `
-ContentType "application/json" `
-Body $body
$artifact
```
Open the artifact in the browser:
```powershell
$artifact.url
```
## 3. Publish HTML Fragment
```powershell
$body = @{
source = "athena"
source_type = "agent"
source_name = "Athena Agent"
kind = "html_fragment"
theme = "tasks"
title = "Task List"
content = "<h1>Tasks</h1><ul><li>Review API docs</li><li>Publish next artifact</li></ul>"
tags = @("tasks")
} | ConvertTo-Json -Depth 5
Invoke-RestMethod `
-Uri "http://127.0.0.1:8001/api/artifacts" `
-Method Post `
-Headers @{ Authorization = "Bearer <your-personal-token>" } `
-ContentType "application/json" `
-Body $body
```
## 4. Publish A File
```powershell
curl.exe -X POST "http://127.0.0.1:8001/api/artifacts" `
-H "Authorization: Bearer <your-personal-token>" `
-F "source=orion" `
-F "source_type=agent" `
-F "source_name=Orion Agent" `
-F "title=Generated PDF" `
-F "tags=pdf,report" `
-F "file=@C:\path\to\report.pdf;type=application/pdf"
```
## 5. Find Recent Artifacts
> **Note:** artifact read endpoints (steps 5 and 6) require a logged-in **browser session**;
> a bearer token is not accepted. These are for browsing from the app, not for agents.
> Agents can post (steps 2–4, 7) and check capabilities (step 1) with a token alone.
```powershell
Invoke-RestMethod "http://127.0.0.1:8001/api/artifacts?source=hermes-research"
Invoke-RestMethod "http://127.0.0.1:8001/api/artifacts?label=status"
Invoke-RestMethod "http://127.0.0.1:8001/api/artifacts?kind=markdown&q=status"
```
## 6. Read One Artifact Metadata
```powershell
Invoke-RestMethod "http://127.0.0.1:8001/api/artifacts/$($artifact.id)"
```
## 7. Update Metadata
```powershell
$body = @{
tags = @("status", "agent", "reviewed")
metadata = @{
run_id = "run-001"
model = "gpt-5.5"
reviewed = $true
}
} | ConvertTo-Json -Depth 5
Invoke-RestMethod `
-Uri "http://127.0.0.1:8001/api/artifacts/$($artifact.id)" `
-Method Patch `
-Headers @{ Authorization = "Bearer <your-personal-token>" } `
-ContentType "application/json" `
-Body $body
```
## 8. Delete An Artifact
```powershell
Invoke-RestMethod `
-Uri "http://127.0.0.1:8001/api/artifacts/$($artifact.id)" `
-Method Delete `
-Headers @{ Authorization = "Bearer <your-personal-token>" }
```
Deletes the artifact's database row and its files. You can only delete artifacts your own token owns.
## Agent Payload Checklist
Recommended fields for every agent post:
- `source`: stable label identifying what posted this (agent-profile, script, or person name).
- `source_type`: usually `agent`.
- `source_name`: readable agent name.
- `source_id`: stable ID if the agent has one.
- `title`: useful human title.
- `kind`: artifact type.
- `content` or `file`: artifact content.
- `tags`: small set of useful filters.
- `metadata.run_id`: lets later artifacts be correlated to the same agent run.
- `metadata.model`: model or system that generated the artifact.