Register an agent on the caller's organization member profile.

Idempotent on url: re-posting the same url updates the entry in place rather than creating a duplicate. New entries return 201; updates return 200.

The organization must already exist. Human credentials select it explicitly with ?org=; an API key uses the exact organization scope returned by WorkOS. The endpoint never creates an organization. If the existing organization has no member profile, the server creates a private profile and includes profile_auto_created: true.

type is required and declared by the caller — the server does not infer it. Server-side smuggle protection still cross-checks the declared type against the agent's capability snapshot when one exists; if the snapshot contradicts the declaration without classifying it, the stored value is unknown and the dashboard surfaces the conflict for the owner to resolve.

visibility: "public" requires a paid AAO tier (Professional, Builder, Member, or Leader) and a verified primary domain on the organization (set via the Linked Domains UI). Non-API-tier callers (Explorer or no tier) who request public will have the entry stored as members_only instead, and the response will include a visibility_downgraded warning describing the coercion.

{
  "url": "https://agent.example.com/mcp"
}

{
  "agent": {
    "url": "https://agent.example.com/mcp"
  }
}