Auth API · printAgents

Enrol a print agent — the program at a site that sends labels to its printers

POST /api/auth/print-agents/{organizationId}

Enrol a print agent — the program at a site that sends labels to its printers, such as the desktop app's agent mode — at one locationId, under the agentId the enroller minted.

The answer carries the agent's credential, shown once and hashed at rest, which the agent keeps and exchanges for its device token. 403 PrintAgentsNotManaged for a member whose roles do not configure locations, 403 NotAMember for anyone outside the organization, 400 InvalidPrintAgent for a malformed id, location or name. Appends auth.print-agent-enrolled. Idempotent on agentId: a retry by the same person with the same body within a day answers the original agent and credential and appends nothing; any other use of the id is 409 PrintAgentIdTaken.

Access

Requires a signed-in session: An owner or admin of the organization, or a member whose roles hold locations:write, checked against its membership by the route (the BetterAuth session)

How scopes come from roles: Scopes and roles. Getting a token: Authentication and app tokens.

Retries

Idempotent on agentId: a retry by the same person with the same body within a day answers the original agent and credential and appends nothing; any other use of the id is 409 PrintAgentIdTaken.

A retry with the same key answers 200, with what the first call recorded.

Why every write carries a key: Idempotency and retries.

Facts appended

auth.print-agent-enrolled

What a fact is: Facts and the journal.

AI agent tool

No agent tool. Enrolling a print agent hands the program at a site a credential that keeps it signed in to the organization: a person's decision at that machine, and a credential is never handed to an agent.

Connecting an agent: AI agents.

Example

curl

curl -X POST 'https://auth.getmanifold.io/api/auth/print-agents/org_01a1586e-f9f6-7a8b-9c7d-6e5f4a3b2c1d' \
  -H "Authorization: Bearer $MANIFOLD_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{
  "agentId": "pag_01a1a3c2-5d6e-7f80-9a1b-2c3d4e5f6a7b",
  "locationId": "loc_01a15852-46d1-7a3b-9c0d-1e2f3a4b5c6d",
  "name": "Dispatch PC"
}'

JavaScript (fetch)

const response = await fetch("https://auth.getmanifold.io/api/auth/print-agents/org_01a1586e-f9f6-7a8b-9c7d-6e5f4a3b2c1d", {
  method: "POST",
  headers: { Authorization: `Bearer ${process.env.MANIFOLD_TOKEN}`, "Content-Type": "application/json" },
  body: JSON.stringify({
    "agentId": "pag_01a1a3c2-5d6e-7f80-9a1b-2c3d4e5f6a7b",
    "locationId": "loc_01a15852-46d1-7a3b-9c0d-1e2f3a4b5c6d",
    "name": "Dispatch PC"
  }),
});
if (!response.ok) throw new Error(`${response.status}: ${await response.text()}`);
const answer = await response.json();

Request body · application/json

{
  "agentId": "pag_01a1a3c2-5d6e-7f80-9a1b-2c3d4e5f6a7b",
  "locationId": "loc_01a15852-46d1-7a3b-9c0d-1e2f3a4b5c6d",
  "name": "Dispatch PC"
}

Response · 200 · application/json

{
  "agent": {
    "agentId": "pag_01a1a3c2-5d6e-7f80-9a1b-2c3d4e5f6a7b",
    "locationId": "loc_01a15852-46d1-7a3b-9c0d-1e2f3a4b5c6d",
    "name": "Dispatch PC",
    "enrolledAt": "2026-10-30T02:00:00.000Z",
    "enrolledBy": "usr_01a15869-1d2e-7f3a-8b4c-5d6e7f8a9b0c"
  },
  "credential": "pag_01a1a3c2-5d6e-7f80-9a1b-2c3d4e5f6a7b.Rm9yLXRoZS1kaXNwYXRjaC16ZWJyYS1vbmx5"
}

The panel writes this call in other languages. It does not send it: Manifold's APIs do not take calls from a web page on another site, so run the call from your own code or terminal. The whole API as OpenAPI: auth-service.openapi.json. Base URL https://auth.getmanifold.io.

Errors

Every refusal is a status and a JSON body whose _tag names it. A refused call changes nothing.

`400`

Refusal	What it means	What to do
`InvalidPrintAgent` reason	A print agent needs a `pag_` id, a location and a name of 1–80 characters.	Fix the body and send it again.

`401`

Refusal	What it means	What to do
`Unauthorized` reason	The token is missing, expired or not one Manifold issued.	Get a fresh token and send the call again.
`TokenAlreadyUsed` tokenId	A single-use app token was already spent.	Mint a new token for this call.

`402`

Refusal	What it means	What to do
`SubscriptionRequired` status	The organization's subscription has lapsed, so writes are refused.	An owner settles billing. Reads still work meanwhile.

`403`

Refusal	What it means	What to do
`NotAMember`	The person is not a member of this organization.	Check the organization, or invite them first.
`PrintAgentsNotManaged` reason	Print agents are enrolled and revoked by whoever configures the organization's locations.	Ask an owner or admin, or for a role that grants `locations:write`.
`TenantRequired` userId	The token names no organization.	Choose the organization, then get a new token.
`ScopeRequired` required	The token's roles do not grant the scope this call needs.	Ask an owner or admin for a role that grants it.

`409`

Refusal	What it means	What to do
`PrintAgentIdTaken` agentId, reason	The print agent id is already another enrolment, or was revoked.	Mint a fresh `pag_` id and enrol again.
`MirroredFromSource` source	This area is fed by your source system until the organization goes live.	Make the change in the source system, or go live first.

`503`

Refusal	What it means	What to do
`RequestLogUnavailable` tokenId, reason	The service could not record the request, so it did nothing.	Send the same request again, with the same key.

How refusals work everywhere: Errors.

Used in

Print labels at a site, step 2: Enrol the site's print agent