daybook/docs/agent_quickstart.md
peter 19c1798f90 Release v0.2.0: multiple named API keys per user
Replaces the single per-user DRF token with named, individually-revocable
API keys, so you can run one key per agent and cut off a leaked one without
disrupting the others.

- New ApiKey model (user, name, dbk_-prefixed key, created_at, last_used_at).
  Data migration copies every existing authtoken 1:1 into a "default" named
  key with the same value, so no client (incl. the sibling test project's
  hardcoded test-user key) needs reconfiguring.
- Auth (resolve_token_user) resolves against ApiKey and stamps last_used_at,
  throttled to one write/minute.
- Settings -> API Keys: table with name/key/created/last-used + per-row
  revoke and a create form; keys viewable on demand. Settings -> Account now
  links here; Settings -> Users issues a named initial key.
- Gated provisioning API for test installations: GET/POST /api/keys and
  DELETE /api/keys/{id}, controlled by DAYBOOK_KEY_PROVISIONING_API (unset ->
  follows DEBUG, so off in deployment). Advertised via key_provisioning_api
  in /api/capabilities; 403 when disabled.
- Docs (api/deployment/quickstart/posting-helper), SKILL.md, and env.example
  updated from "token / Settings -> Account" to "key / Settings -> API Keys".
- Tests: new API + UI suites for keys; existing token-based tests moved to
  ApiKey. Full suite 129 passing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-09-04 10:52:43 +01:00

4.1 KiB
Raw Blame History

Agent Quickstart

This is the shortest path for an agent to publish and retrieve artifacts from Daybook.

0. Get Your API Key

Log in to the app in a browser and create a personal key under Settings → API Keys (http://127.0.0.1:8001/settings/api-keys/). Name it after the agent so you can revoke it later. Every artifact you post with it lands in your feed, and only yours.

1. Check Capabilities

Also confirms your token is valid:

Invoke-RestMethod "http://127.0.0.1:8001/api/capabilities" `
  -Headers @{ Authorization = "Bearer <your-personal-token>" }

2. Publish Markdown

$body = @{
  source = "hermes-research"
  source_type = "agent"
  source_name = "Hermes Agent"
  source_id = "hermes-local"
  kind = "markdown"
  title = "Agent Status Update"
  content = "# Status Update`n`nThe agent completed its run successfully."
  tags = @("status", "agent")
  metadata = @{
    run_id = "run-001"
    model = "gpt-5.5"
  }
} | ConvertTo-Json -Depth 5

$artifact = Invoke-RestMethod `
  -Uri "http://127.0.0.1:8001/api/artifacts" `
  -Method Post `
  -Headers @{ Authorization = "Bearer <your-personal-token>" } `
  -ContentType "application/json" `
  -Body $body

$artifact

Open the artifact in the browser:

$artifact.url

3. Publish HTML Fragment

$body = @{
  source = "athena"
  source_type = "agent"
  source_name = "Athena Agent"
  kind = "html_fragment"
  theme = "tasks"
  title = "Task List"
  content = "<h1>Tasks</h1><ul><li>Review API docs</li><li>Publish next artifact</li></ul>"
  tags = @("tasks")
} | ConvertTo-Json -Depth 5

Invoke-RestMethod `
  -Uri "http://127.0.0.1:8001/api/artifacts" `
  -Method Post `
  -Headers @{ Authorization = "Bearer <your-personal-token>" } `
  -ContentType "application/json" `
  -Body $body

4. Publish A File

curl.exe -X POST "http://127.0.0.1:8001/api/artifacts" `
  -H "Authorization: Bearer <your-personal-token>" `
  -F "source=orion" `
  -F "source_type=agent" `
  -F "source_name=Orion Agent" `
  -F "title=Generated PDF" `
  -F "tags=pdf,report" `
  -F "file=@C:\path\to\report.pdf;type=application/pdf"

5. Find Recent Artifacts

Note: artifact read endpoints (steps 5 and 6) require a logged-in browser session; a bearer token is not accepted. These are for browsing from the app, not for agents. Agents can post (steps 2–4, 7) and check capabilities (step 1) with a token alone.

Invoke-RestMethod "http://127.0.0.1:8001/api/artifacts?source=hermes-research"
Invoke-RestMethod "http://127.0.0.1:8001/api/artifacts?label=status"
Invoke-RestMethod "http://127.0.0.1:8001/api/artifacts?kind=markdown&q=status"

6. Read One Artifact Metadata

Invoke-RestMethod "http://127.0.0.1:8001/api/artifacts/$($artifact.id)"

7. Update Metadata

$body = @{
  tags = @("status", "agent", "reviewed")
  metadata = @{
    run_id = "run-001"
    model = "gpt-5.5"
    reviewed = $true
  }
} | ConvertTo-Json -Depth 5

Invoke-RestMethod `
  -Uri "http://127.0.0.1:8001/api/artifacts/$($artifact.id)" `
  -Method Patch `
  -Headers @{ Authorization = "Bearer <your-personal-token>" } `
  -ContentType "application/json" `
  -Body $body

8. Delete An Artifact

Invoke-RestMethod `
  -Uri "http://127.0.0.1:8001/api/artifacts/$($artifact.id)" `
  -Method Delete `
  -Headers @{ Authorization = "Bearer <your-personal-token>" }

Deletes the artifact's database row and its files. You can only delete artifacts your own token owns.

Agent Payload Checklist

Recommended fields for every agent post:

  • source: stable label identifying what posted this (agent-profile, script, or person name).
  • source_type: usually agent.
  • source_name: readable agent name.
  • source_id: stable ID if the agent has one.
  • title: useful human title.
  • kind: artifact type.
  • content or file: artifact content.
  • tags: small set of useful filters.
  • metadata.run_id: lets later artifacts be correlated to the same agent run.
  • metadata.model: model or system that generated the artifact.