---
title: "Add agents to a bootstrapped connection"
method: POST
path: "/v1/platform/connections/{connectionId}/agents"
tags: ["Platform"]
---

# Add agents to a bootstrapped connection

`POST /v1/platform/connections/{connectionId}/agents`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/platform/connections/{connectionId}/agents`
- Auth: HTTP bearer

Provision an additional agent on a connection that has already been
bootstrapped, from a template belonging to the same app. `plt_` auth only.

One agent per call. A template declaring more than one agent is refused
with 400: each agent's API key is returned once and cannot be re-issued
to a platform app, so batching them would put several unrecoverable
credentials in a single response.

Bootstrap refuses a second run (409) because it also creates the vault,
the policies and the plan tier, none of which should happen twice. This
route applies only the agent portion of a template: its `agents`, their
per-agent `signing_keys`, `eoa` and `runtime`. `vault`, `policies`,
`automations` and `entitlements` in the spec are ignored, and new agents
attach to the vault the connection already has.

Configuration comes from a template rather than from fields on the
request so that the agent portion of a spec has exactly one reader,
shared with bootstrap.

Capped per connection by `max_agents_per_connection` on the platform app
(unset means a built-in default, not unlimited: an agent with signing
keys costs a KMS key per chain). The whole batch is checked before
anything is created, so a template that would overshoot is refused
rather than partly applied.

Agents added here always start with `raw_signing_enabled: false`, even if
the template's agent asks for raw signing: no end user consented on this
call. The end user turns it on through
`PATCH /v1/platform/connections/{connectionId}/agents/{agentId}` with
their re-auth token.

## Path parameters

- `connectionId` string, uuid, required

## Request body

- AddConnectionAgentsRequest
  - `template_id` string, uuid, required: A template belonging to the same platform app. Only its `agents` and their per-agent `signing_keys`, `eoa` and `runtime` are applied.
  - `params` object: Substituted into the spec as `{{params.*}}`, same as at bootstrap. Use it to name the agent after the account it signs for.

## Response `201`

Agents provisioned

- AddConnectionAgentsResponse
  - `connection_id` string, uuid
  - `agent_ids` string[]
  - `agent_api_key` string: The first agent's key, kept so existing clients keep parsing. Prefer `agent_api_keys`.
  - `agent_api_keys` object[]: The created agent and its one-time API key. Exactly one entry: provisioning is one agent per call, because a key is returned once and cannot be re-issued to a platform app, so a response carrying several would put several unrecoverable credentials in one payload. A template declaring more than one agent is refused with 400. The singular `agent_api_key` is the same key.
    - `agent_id` string, uuid
    - `api_key` string
  - `agent_evm_address` string
  - `signing_keys` object[]: Provisioned signing key details, same shape as the bootstrap summary.
    - `chain` string
    - `curve` string
    - `public_key` string
    - `address` string
    - `agent_id` string, uuid, nullable
  - `runtime_ids` string[]
  - `agent_count` integer: Agents on this connection after the call.
  - `max_agents_per_connection` integer: The ceiling the call was checked against.

## Other responses

- `400`: Connection not bootstrapped yet, or the template provisions no agents
- `403`: Past the per-connection agent cap
- `404`: Resource not found

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/5fa0918f3b41?raw)