Agentic Access V1 API

Vend ephemeral roles for your agents to access data on-behalf-of of a user.

Private preview: This feature is available to select accounts. Contact your Immuta representative for details.

Rather than connecting as a static service account, the agent harness first calls the Immuta agentic access V1 API to obtain an ephemeral role scoped to the end user's entitlements, and this role is then assumed by the agent when querying the data platform. This process ensures every query executed against the data platform is scoped to exactly what the end user is permitted to access.

Base path and global segment

In order to use the agentic access API, you need to use the correct global segment. The following are the regional API base paths. Choose the global segment for the region you are in.

• Asia Pacific: https://ap.api.immutacloud.com/agents
• European Union: https://eu.api.immutacloud.com/agents
• North America: https://na.api.immutacloud.com/agents

Your agentic access data only exists in the same global segment as your Govern app. If you use the wrong global segment in your API call, you will receive the following response:

{
  "message": "Not authenticated.",
  "error": "Unauthorized",
  "statusCode": 401
}

Authentication

See instructions for generating your agent's personal access token (PAT) on the Manage agents page.

To use your generated agent PAT, insert it as the bearer token for your API calls:

curl -L \
  --url 'https://{globalSegment}.api.immutacloud.com/agents/roles' \
  --header 'Authorization: Bearer <agent-PAT>'

If using "Test it" in the Agent API documentation, include the agent PAT in the bearer token in the authentication section:

Authentication for testing

Download the agentic access OpenAPI YAML

Download the agentic access OpenAPI spec (provided in the left navigation) to import it into Postman or use a client generator tool to parse the OpenAPI definition to automatically produce client-side code.