---
title: "Create a Shield widget"
method: POST
path: "/agent/shield/widgets"
tags: ["Shield"]
---

# Create a Shield widget

`POST /agent/shield/widgets`

## Request

- Base URL: `https://edge.network`
- URL: `https://edge.network/agent/shield/widgets`
- Auth: HTTP bearer

Create a bot-protection widget for a form or page. Free, unlimited. Returns the sitekey, the secret (shown ONCE — store server-side), and a ready-to-paste embed snippet.

## Headers

- `X-Dry-Run` 'true' | 'false'
- `Idempotency-Key` string

## Request body

- object
  - `name` string, required: Friendly name, e.g. "Contact form".
  - `hostnames` string[]: Hostnames allowed to use this widget. Empty = any.
  - `mode` 'managed' | 'non-interactive' | 'invisible': managed: invisible for humans, one-click check when suspicious. non-interactive: never asks for input. invisible: verify via JS API only.
  - `agent_policy` 'allow' | 'challenge' | 'block': Treatment of cryptographically verified AI agents (Web Bot Auth).

## Response `201`

Success.

- object
  - `widget` ShieldWidget, required
    - `id` string, required
    - `name` string, required
    - `sitekey` string, required: Public sitekey used in the embed snippet.
    - `hostnames` string[]
    - `mode` 'managed' | 'non-interactive' | 'invisible'
    - `agent_policy` 'allow' | 'challenge' | 'block'
  - `tell_user` string: Human-readable summary of what happened, for the agent to relay to its operator.

## Other responses

- `400`: Validation error — the response body explains what to fix.
- `401`: Missing or invalid agent access code. The body includes self-signup pointers.
- `429`: Rate limited. Honour Retry-After and the RateLimit-* headers before retrying.

---

[API](https://skmtc.dev/edge/apis/edge-network-agent-api.md) · [All operations](https://skmtc.dev/edge/apis/edge-network-agent-api/llms.txt) · [OpenAPI document](https://skmtc.dev/edge/apis/edge-network-agent-api/revisions/49b5f2adf020?raw)