---
title: "Grant an exemption to an agent"
method: POST
path: "/agents/{agent_id}/exemptions"
tags: ["Agents"]
---

# Grant an exemption to an agent

`POST /agents/{agent_id}/exemptions`

## Request

- Base URL: `https://api.mnemom.ai/v1`
- URL: `https://api.mnemom.ai/v1/agents/{agent_id}/exemptions`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-Mnemom-Api-Key`
  - API key in cookie `mnemom_session`

Requires org `owner` or `admin` of the agent's org. Personal agents (no org) cannot have exemptions and receive 400. Reason is required (20–500 chars). `expires_at` defaults to +90 days if omitted; pass `null` for permanent (opt-in only). Requires `Idempotency-Key`. Emits a `agent.exemption.granted` webhook and writes a governance audit row. Triggers a recompose of the agent's canonical cards. See ADR-008.

## Path parameters

- `agent_id` string, required

## Headers

- `Idempotency-Key` string, required

## Request body

- object
  - `exempt_section` 'autonomy.forbidden_actions' | 'enforcement.forbidden_tools' | 'autonomy.max_autonomous_value', required: Template section this exemption relaxes.
  - `exempt_patterns` string[], nullable: Specific patterns to exempt within the section. `null` exempts the entire section.
  - `reason` string, required: Business justification for the exemption (required, ≥20 chars).
  - `expires_at` string, date-time, nullable: Expiry. Omit for default +90 days. `null` = permanent (explicit opt-in).

## Response `201`

Exemption granted; canonical cards recomposed.

- object
  - `exemption` AgentExemption, required: A single exemption row relaxing an org-template floor for one agent (ADR-008).
    - `id` string, required
    - `agent_id` string, required
    - `exempt_section` 'autonomy.forbidden_actions' | 'enforcement.forbidden_tools' | 'autonomy.max_autonomous_value', required
    - `exempt_patterns` string[], nullable
    - `reason` string, required
    - `granted_by` string, required
    - `granted_at` string, date-time, required
    - `expires_at` string, date-time, nullable
    - `status` 'active', required: Always `active` today (forward-compat stub for future dual-control approval workflow).
  - `agent_id` string, required
  - `recomposed` boolean, required

## Other responses

- `400`: Bad request
- `401`: Authentication required
- `403`: Forbidden
- `404`: Resource not found
- `413`: Request body exceeded the per-endpoint size cap. Cards-as-primitive sub-resource verbs cap each primitive body at 64 KiB; full-card PUTs cap at 128 KiB (alignment) / 64 KiB (protection).
- `429`: Rate-limit exceeded. The global per-IP limiter (100 requests/minute, applied to every `/v1/*` route) rejected this request. Back off until the window resets — `Retry-After` carries the cooldown in seconds and `X-RateLimit-Reset` the absolute reset time.
- `500`: Server error — request was well-formed but the server failed to fulfill it. Typically a downstream dependency (DB / RPC / external API) returned an unexpected error.

---

[API](https://skmtc.dev/mnemom/apis/mnemom-api.md) · [All operations](https://skmtc.dev/mnemom/apis/mnemom-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mnemom/apis/mnemom-api/revisions/274b7a6ea182?raw)