---
title: "Ensure Proxy"
method: POST
path: "/api/agency-org-proxies"
tags: ["agency-org-proxies"]
---

# Ensure Proxy

`POST /api/agency-org-proxies`

## Request

- Base URL: `https://app.thinqos.com` (the document declares no server; this is the origin it was published from)
- URL: `https://app.thinqos.com/api/agency-org-proxies`
- Auth: none declared

Find-or-create the single proxy agent for an Agency org.

TOS-6492 review r2 (P3): the org triple is validated against a REGISTERED
capture connection before anything is created. The ticket's "whoever
connects first creates it" applies to whoever connects - i.e. someone
whose identity already holds a capture connection for this
(source, instance, org) - not to any caller naming an arbitrary triple.
Without that check any user could mint a permanent, owner-less, globally
listed persona named like a real org, and the link-first prompt would echo
the attacker's chosen label as first-party consent text. A typo'd org
triple is NOT self-service recoverable: the unique index plus ``ON DELETE
RESTRICT`` make the row permanent by design, so recovery is an admin
action (a platform admin deletes the stray ``agency_org_proxy_agents`` row
and its unowned proxy Identity directly), matching how other
unowned-identity mistakes are corrected today.

## Headers

- `x-ingest-key` string, nullable
- `authorization` string, nullable
- `x-impersonate-identity-id` string, nullable

## Request body

- ProxyEnsureRequest
  - `source` string, required
  - `instance_id` string, required
  - `external_org_id` string, required
  - `org_label` string, required

## Response `201`

Successful Response

- ProxyResponse
  - `id` string, uuid, required
  - `source` string, required
  - `instance_id` string, required
  - `external_org_id` string, required
  - `org_label` string, required
  - `agent_identity_id` string, uuid, required
  - `agent_display_name` string, nullable, required
  - `agent_avatar_url` string, nullable, required
  - `created_at` string, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/thinqos/apis/thinqos-api.md) · [All operations](https://skmtc.dev/thinqos/apis/thinqos-api/llms.txt) · [OpenAPI document](https://skmtc.dev/thinqos/apis/thinqos-api/revisions/ce2c2ce318b1?raw)