---
title: "Issue short-lived Public Agent Preview access"
method: POST
path: "/v0/public-access/grants"
---

# Issue short-lived Public Agent Preview access

`POST /v0/public-access/grants`

## Request

- Base URL: `https://exactlane.dev` (the document declares no server; this is the origin it was published from)
- URL: `https://exactlane.dev/v0/public-access/grants`
- Auth: none required

Unauthenticated. Body is {} or an optional display_label. Idempotency-Key is optional on this grant route only. Subsequent Public Preview writes (POST /v0/capabilities, POST /v0/checks, POST /v0/usage-events) require Idempotency-Key. When EXACTLANE_PUBLIC_ACCESS_ENABLED is unset or false, the route still exists and returns 403 PUBLIC_ACCESS_DISABLED. When Public Agent Preview is enabled, grant issuance requires trusted-proxy process status CONFIGURED and a verified per-request client identity through that trusted proxy. CONFIGURED means the settings parse; it does not guarantee every request has a usable identity. Untrusted peers, missing headers, malformed values, and multi-hop lists return HTTP 503 PUBLIC_ACCESS_IDENTITY_UNAVAILABLE on this REST route and do not hash a shared loopback proxy peer. MCP check_mcp_capability uses the same grant path but returns HTTP 200 with result.isError and structuredContent.error.code PUBLIC_ACCESS_IDENTITY_UNAVAILABLE; it does not expose HTTP 503. The documented Cloudflare path prefers CF-Connecting-IP. X-Forwarded-For remains supported only for a trusted ingress that overwrites it with one single valid IP; multi-hop X-Forwarded-For fails closed because Exactlane cannot choose a hop. Issued credentials last 30 minutes, use Phase 0A agent scopes only, and never classify traffic as EXTERNAL_REVIEWED. The bearer token is disclosed only on the original 201; exact Idempotency-Key replay for the same hashed client identity returns 200 without the token and cannot recover another caller's credential. Different hashed client identities use independent idempotency namespaces. Callers who share a hashed identity (NAT, VPN, or shared network egress) share that namespace. Issuance 429 responses include Retry-After. Per-client limits are the normal bottleneck; global hour/day values are emergency ceilings. After grant expiry, snapshot_digest cannot be used to fetch snapshot bytes; keep inline bytes or re-submit. A capability snapshot is a cached caller-provided claim, not live truth. Caller owns CONTINUE/UPDATE/HOLD. Live probing remains off. Self-revoke with DELETE /v0/agents/{agent_id}.

## Headers

- `Idempotency-Key` string

## Request body

- PublicAccessGrantCreate
  - `display_label` string

## Response `200`

Exact Idempotency-Key replay without the bearer token

- PublicAccessGrantResponse
  - `access` PublicAccessDescriptor, required
    - `expires_at` string, date-time, required
    - `kind` 'public_preview', required
    - `lifetime_seconds` 1800, required
    - `notes` string, required
    - `quotas` object, required
      - `capabilities` 2, required
      - `checks` 3, required
      - `usage_events` 2, required
    - `scopes` string[], required
  - `agent` Principal, required
    - `access_kind` 'bootstrap' | 'public_preview', required
    - `created_at` string, date-time, required
    - `display_label` string, required
    - `expires_at` string, date-time, nullable, required
    - `id` string, required
    - `operator_group_ref` string, nullable
    - `revoked_at` string, date-time, nullable, required
    - `scopes` string[], required
    - `traffic_class` 'CONTROLLED' | 'EXTERNAL_REVIEWED' | 'UNKNOWN', required
  - `credential` BearerCredential
    - `token` string, required: Returned in this response; only a digest is stored
    - `type` 'Bearer', required
  - `credential_disclosure` 'once', required

## Other responses

- `201`: Preview credential returned once; only a digest is stored
- `400`: Malformed request or idempotency key
- `401`: Missing or invalid credential
- `403`: Public Agent Preview is disabled (PUBLIC_ACCESS_DISABLED)
- `404`: Resource absent or not owned
- `409`: Idempotency or unique-event conflict
- `411`: Content-Length is required
- `413`: Request exceeds a hard bound
- `415`: Media type or content encoding is unsupported
- `422`: Request shape or fixed profile is unsupported
- `429`: Public Agent Preview issuance limited. Per-client limits are the normal bottleneck; global hour/day values are emergency ceilings.
- `500`: Bounded internal failure
- `503`: Public Agent Preview identity is not ready (PUBLIC_ACCESS_IDENTITY_UNAVAILABLE)

---

[API](https://skmtc.dev/exactlane/apis/exactlane-preflight-phase-0a.md) · [All operations](https://skmtc.dev/exactlane/apis/exactlane-preflight-phase-0a/llms.txt) · [OpenAPI document](https://skmtc.dev/exactlane/apis/exactlane-preflight-phase-0a/revisions/544a503598aa?raw)