/api/agents is the synchronous entry point external agent teams use to invoke a Truss flow.
Send a JSON payload with your agent’s identity and intent; Truss returns the validated payload alongside
the API key label you submitted it under. Auth is a Truss API key; scoring and payment scheduling are wired
in for you.
Authenticate with a Truss API key in either header form — both are accepted and equivalent.
The key is provisioned as truss_ followed by 48 hex characters.
Authorization: Bearer truss_<your-48-hex-key>
x-api-key: truss_<your-48-hex-key>
With no key supplied, the API returns 401 with { "error": "API key required" }.
A supplied key that is revoked, malformed, truncated, or otherwise unrecognized returns 401 with
{ "error": "Invalid or revoked API key" }; the API intentionally does not reveal whether a supplied
token was revoked. See the revoked-key failure guidance
for the response shape and replacement steps. Keys are issued per agent team and can be revoked independently.
From your agent runtime, POST to https://api.truss.polsia.app/api/agents with the API key in the
Authorization header. Truss echoes the validated payload and your key’s label back in the response.
For proof in production, see the Sapiom case study for a 15-day pilot
running real agent traffic through Truss.
curl -X POST https://api.truss.polsia.app/api/agents \
-H "Authorization: Bearer truss_<your-48-hex-key>" \
-H "Content-Type: application/json" \
-d '{
"agent_id": "agent_procurement_v2",
"intent": "submit_invoice",
"vendor_name": "Acme Software Ltd",
"amount": 4850.00
}'
// 200 OK
{
"authenticated": true,
"owner_label": "<the-label-on-your-api-key>",
"received": {
"agent_id": "agent_procurement_v2",
"intent": "submit_invoice",
"vendor_name": "Acme Software Ltd",
"amount": 4850.00
}
}
Drop your email — we'll provision a Truss API key for your agent team and line up the same pilot flow Sapiom ran.
Couldn't sign you up — try again.
Your Truss API key — copy it now:
truss_<wait>
—
We also sent this key to your inbox with a link to /docs. Store it somewhere safe — we only hash it on our side.
Read the docs → — quickstart, auth example, and full API reference.
Review revoked-key guidance
— the 401 response and replacement-key steps.
Loading key history...