---
title: "Mint a provisional anonymous workspace and API key"
method: POST
path: "/v1/public/agents/provision"
---

# Mint a provisional anonymous workspace and API key

`POST /v1/public/agents/provision`

## Request

- Base URL: `https://api.decionis.com`
- URL: `https://api.decionis.com/v1/public/agents/provision`
- Auth: none required

Zero-human onboarding entry point. Mints a provisional workspace, its
org API key, and a seeded shadow-mode default policy — no account, no
email. Hard caps: 10 requests per minute, 5 provisional workspaces per
network per 24 hours, and an exploration allowance of 50 governed
decisions per month. The raw key is returned exactly once. Every
dossier a provisional workspace mints carries a SIGNED issuer_context
tier of "provisional_anonymous" inside the dossier claims, so a
verifier can always distinguish it from an owned org's dossier.
Claiming (POST /v1/orgs/{org_id}/claim/start then /claim/verify)
attaches a human owner; the key and the dossier ledger survive the
claim.
The workspace is stamped with what the caller's User-Agent says about
where it came from and nothing else: the product and version, and
for the open-source runtime's `agent-safe-pipeline/<version>
(repo=<owner/name>; example=<name>; surface=github)` form and
Govern's `govern/<version> (example=govern@<version>;
surface=<runner>; repo=<owner/name>)` form, the repository, example
and surface. The stamp is accounting for the acquisition funnel; it
is never decision input and never verified.

## Request body

- AgentProvisionRequest
  - `agent_name` string: Optional display name for the workspace, shown to the claiming owner.

## Response `201`

Provisional workspace minted; the raw key appears only here

- AgentProvisionResponse
  - `org_id` string, uuid, required
  - `raw_key` string, required: The workspace's org API key. Returned exactly once — store it.
  - `provisional` boolean, required: Always true at mint; the workspace stays provisional until claimed.
  - `limits` AgentProvisionLimits, required: The caps on the anonymous lane, echoed so agents plan around them.
    - `requests_per_minute` integer
    - `workspaces_per_network_per_day` integer
    - `governed_decisions_per_month` integer
    - `workspaces_service_wide_per_day` integer: Service-wide daily ceiling across every network (present only when the deployment enables one). When minting answers 429 with PROVISION_LIMIT_REACHED and Retry-After, claim an existing workspace instead of retrying from a new address.
  - `claim` object, required: How to attach a human owner — the claim/start and claim/verify endpoints prefilled for this org, plus the note to surface to your operator. The key and dossier ledger survive the claim.
  - `next` object, required: Suggested next calls, starting with a shadow-mode evaluate-decision.

## Other responses

- `400`: Structured API error
- `429`: Structured API error
- `503`: Structured API error

---

[API](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api.md) · [All operations](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/llms.txt) · [OpenAPI document](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/revisions/357f5e459d0c?raw)