Agents

Agents is governed machine access for Craft CMS and Craft Commerce. It gives agencies and delivery teams a safe API and operator layer for external runtimes such as agents, orchestrators, workers, and scripts, with scoped machine accounts, bounded write lanes, approvals, review diffs, status visibility, and reliable webhook handoff.

You set the boundary. External runtimes work inside it.

Agents is vendor- and model-agnostic. If a system can call HTTP APIs, it can work with Agents.

Example workflows

Governed draft updates
Let an external runtime prepare draft updates for existing entries, route them through human approval, and review the requested content changes in a field-aware diff before anything is applied.

Bounded client-site automation
Limit write-capable accounts to approved entry and site targets with Target Sets so automation stays inside defined client content lanes.

Weekly site reporting
Generate recurring summaries of content changes, site activity, and operational signals for internal teams or client reporting.

Legal and consent checks
Compare legal text and consent-related content against visible site behavior such as cookies, trackers, disclosures, and policy pages.

Core capabilities

• scoped machine accounts with one-time token reveal
• managed account lifecycle in the Craft control panel
• account templates for common agency workflows
• read APIs for Craft and Craft Commerce resources
• governed write flows for draft-oriented actions
• Target Sets for bounded write access by entry and site
• approval routing for higher-risk operations
• field-aware approval diffs with focused review modes
• runtime status, diagnostics, and observability
• operator notifications for approvals and execution issues
• webhook delivery, dead-letter visibility, replay, and production-safe probing
• change feeds and sync-state endpoints for external runtimes
• OpenAPI and capabilities endpoints for machine-readable contracts
• external plugin adapter support for extending the API surface

Secure by default

• token-based auth
• scope-based access control
• rate limiting
• sensitive data redaction where appropriate
• production fail-closed behavior for missing credentials
• optional IP allowlists, expiry policies, and approval requirements

Built for teams that need

• one governed API surface instead of custom one-off endpoints
• safer handoff to AI runtimes and automations
• approval controls for sensitive actions
• bounded client-site automation instead of broad write access
• better operator visibility inside Craft
• a cleaner boundary between what automation can do and what humans still control

Connect external runtimes to /agents/v1/*, manage machine accounts in the control panel, define bounded write lanes with Target Sets, and use Accounts, Approvals, Status, and Settings as the operator surface.