Create agents, run cloud sessions and receive replies as events. All 95 official operations are declared: 41 supported or partially supported, the rest answer 501; see each endpoint's badge for its status.
After agent.message, wait for session.status_idle; list historical events to read previous replies.
Use the base URL above as the SDK base URL. All requests require an API Key, anthropic-version: 2023-06-01 and anthropic-beta: managed-agents-2026-04-01. Try it supplies these protocol headers; replace resource IDs yourself.
All 95 official operations are declared: 41 are supported or partially supported (see the badges in the endpoint list); the other 54 are not implemented yet and answer 501 (not_implemented_error, x-should-retry: false) with no side effects and no charge. See endpoint notes for capability and vault limits.
Create Agent：Supports text prompts, models, metadata and built-in tools. MCP, skills and additional model controls are not supported and return 400. multiagent accepts null or a coordinator roster of 1–20 agent IDs, {type:"agent",id,version?} references or at most one {type:"self"}. Versions are pinned on create/update. Members must be distinct, exist, be unarchived and have no multiagent topology. The compatibility API provides only the eight official tools: bash, edit, glob, grep, read, write, web_search and web_fetch. configs rejects other tool names. Sessions created here do not provide background tasks, Monitor or subagents. Use /agent/v1 for all native tools. Each coordinator permits at most one advisor whose model must be available and differ from the agent model; only the primary session can consult it, each consultation uses a separate advisor thread, and advice returns via agent.thread_message_received.
Get Agent：Replace example resource IDs with IDs from resources you created.
Update Agent：Use version for optimistic concurrency; conflicts return 409 and unchanged updates preserve the version. MCP and skills are not supported. multiagent accepts null or a coordinator roster of 1–20 agent IDs, {type:"agent",id,version?} references or at most one {type:"self"}. Versions are pinned on create/update. Members must be distinct, exist, be unarchived and have no multiagent topology. The compatibility API provides only the eight official tools: bash, edit, glob, grep, read, write, web_search and web_fetch. configs rejects other tool names. Sessions created here do not provide background tasks, Monitor or subagents. Use /agent/v1 for all native tools. Each coordinator permits at most one advisor whose model must be available and differ from the agent model; only the primary session can consult it, each consultation uses a separate advisor thread, and advice returns via agent.thread_message_received.
List Agent Versions：Replace example resource IDs with IDs from resources you created.
Archive Agent：Archived agents remain readable, including versions, but cannot be updated. Only archive your own test agent.
Create Session：Create an agent first and replace agent_123 with its returned id. environment_id is required on this compatibility surface: use node22 or a tenant-owned cloud environment. The native /agent/v1 surface allows omission to select a light machine. Inline agent overrides, budgets and vaults are not supported. Supports persistence, retrieval and removal of file resource references, up to 500 per session. Files must be live and owned by the current tenant. Paths default to /mnt/session/uploads/<file_id>; custom paths are rooted there and parent traversal is rejected. File content is immutable through this API. Sandbox synchronization is not implemented in this batch.
List Sessions：Supports limit, page and agent_id. agent_version, time ranges, deployment_id, memory_store_id, include_archived, order and statuses are not supported and return 400.
Get Session：Replace example resource IDs with IDs from resources you created.
Send Events：Each user.message accepts exactly one nonempty text block. Replace sesn_123 with your session id. Text user.message, user.interrupt and tool confirmation are supported; other input variants are not. The response acknowledges inputs; read replies from event history or the stream. A user.message sent while the session waits for tool approval is queued: the returned event has processed_at null and runs in order once the approval is resolved.
List Events：Send a message before reading history. Until processing finishes, only admitted input may be visible. Pagination, event type and time filters are supported. A session waiting for tool approval pauses on session.status_idle with stop_reason requires_action, whose event_ids list the agent.tool_use events to confirm. A failed run emits session.error before session.status_terminated. As in the official API, agent.thinking is a progress signal without content.
Stream Events：Keep the SSE connection open and send a message in another request after replacing sesn_123. Stopping the stream disconnects the subscription, not the agent. SDK 0.124.0 filters session.usage; read history for full usage. Pass event_deltas[]=agent.message to receive incremental text previews before the final event; as in the official API, agent.thinking previews are start-only.
List Environments：Supports tenant-owned cloud environments, configuration updates and soft archival; built-ins are read-only. Lists accept limit, page and include_archived. Limited networking applies at sandbox creation; package installation failure terminates the session with ENVIRONMENT_PACKAGE_INSTALL_FAILED. self_hosted, scope and cross-session package caching are not supported.
Create Environment：Supports tenant-owned cloud environments, configuration updates and soft archival; built-ins are read-only. Lists accept limit, page and include_archived. Limited networking applies at sandbox creation; package installation failure terminates the session with ENVIRONMENT_PACKAGE_INSTALL_FAILED. self_hosted, scope and cross-session package caching are not supported.
Get Environment：Supports tenant-owned cloud environments, configuration updates and soft archival; built-ins are read-only. Lists accept limit, page and include_archived. Limited networking applies at sandbox creation; package installation failure terminates the session with ENVIRONMENT_PACKAGE_INSTALL_FAILED. self_hosted, scope and cross-session package caching are not supported.
Update Environment：Supports tenant-owned cloud environments, configuration updates and soft archival; built-ins are read-only. Lists accept limit, page and include_archived. Limited networking applies at sandbox creation; package installation failure terminates the session with ENVIRONMENT_PACKAGE_INSTALL_FAILED. self_hosted, scope and cross-session package caching are not supported.
Archive Environment：Supports tenant-owned cloud environments, configuration updates and soft archival; built-ins are read-only. Lists accept limit, page and include_archived. Limited networking applies at sandbox creation; package installation failure terminates the session with ENVIRONMENT_PACKAGE_INSTALL_FAILED. self_hosted, scope and cross-session package caching are not supported.
Update Session：Supports title and metadata with the official patch semantics: a string value upserts the key, null deletes it, a whole-null object clears the bag, and untouched keys are preserved. The official agent override (tools/mcp_servers), budget and vault_ids are not supported and return 400 naming the field. Updating an archived session returns 409.
Archive Session：Archived sessions refuse new messages with 400 invalid_request_error naming the archived session; retrieval and event history stay readable. Re-archiving is idempotent and archived_at keeps the first archive time.
List Session Resources：Supports persistence, retrieval and removal of file resource references, up to 500 per session. Files must be live and owned by the current tenant. Paths default to /mnt/session/uploads/<file_id>; custom paths are rooted there and parent traversal is rejected. File content is immutable through this API. Sandbox synchronization is not implemented in this batch.
Add Session Resource：Supports persistence, retrieval and removal of file resource references, up to 500 per session. Files must be live and owned by the current tenant. Paths default to /mnt/session/uploads/<file_id>; custom paths are rooted there and parent traversal is rejected. File content is immutable through this API. Sandbox synchronization is not implemented in this batch.
Delete Session Resource：Supports persistence, retrieval and removal of file resource references, up to 500 per session. Files must be live and owned by the current tenant. Paths default to /mnt/session/uploads/<file_id>; custom paths are rooted there and parent traversal is rejected. File content is immutable through this API. Sandbox synchronization is not implemented in this batch.
Get Session Resource：Supports persistence, retrieval and removal of file resource references, up to 500 per session. Files must be live and owned by the current tenant. Paths default to /mnt/session/uploads/<file_id>; custom paths are rooted there and parent traversal is rejected. File content is immutable through this API. Sandbox synchronization is not implemented in this batch.
List Threads：Returns the primary thread and every child thread in created_at order. Thread ids use sthr_ plus the owning session suffix; children reference the primary parent_thread_id and retain the parent session_id. agent describes the actual running definition; built-in types use their type name and null for unregistered id/version. Archived children have status terminated and archived_at. stats/usage remain null without thread-level tracking.
Get Thread：Returns a primary or child thread belonging to this session, field-for-field identical to its list item. Foreign, unknown and malformed thread ids uniformly return 404 without revealing existence.
Archive Thread：Archiving the primary thread uses session archival. Archiving a child archives only that child session, leaving the parent and siblings intact. Archived children have status terminated and archived_at; their history remains readable.
List Thread Events：Reads the selected thread ledger: the primary session for the primary thread, or the child session for a child thread. Uses the session event query parameters, public event types and data + next_page envelope. Web tools return search_result blocks on both APIs; answer citations are an /agent/v1 extension, rendered as [n] on /anthropic.
Stream Thread Events：Subscribes to the selected thread live ledger using the session SSE implementation; the /agent API also supports a read-only WebSocket. The parent stream includes child creation, status and message events. Child approvals carry session_thread_id; confirmations and interrupts targeting that id are routed to the owned child.
List Vaults：Supports create, list, retrieve, update, archive and delete. Lists accept limit, page and include_archived. Archiving a vault archives every credential in it and clears their values; deleting it removes every credential and cannot be undone. Metadata keys starting with anthropic. are reserved and cannot be written. The same vaults are also available through the native /vault/v1 API.
Create Vault：Supports create, list, retrieve, update, archive and delete. Lists accept limit, page and include_archived. Archiving a vault archives every credential in it and clears their values; deleting it removes every credential and cannot be undone. Metadata keys starting with anthropic. are reserved and cannot be written. The same vaults are also available through the native /vault/v1 API.
Delete Vault：Supports create, list, retrieve, update, archive and delete. Lists accept limit, page and include_archived. Archiving a vault archives every credential in it and clears their values; deleting it removes every credential and cannot be undone. Metadata keys starting with anthropic. are reserved and cannot be written. The same vaults are also available through the native /vault/v1 API.
Get Vault：Supports create, list, retrieve, update, archive and delete. Lists accept limit, page and include_archived. Archiving a vault archives every credential in it and clears their values; deleting it removes every credential and cannot be undone. Metadata keys starting with anthropic. are reserved and cannot be written. The same vaults are also available through the native /vault/v1 API.
Update Vault：Supports create, list, retrieve, update, archive and delete. Lists accept limit, page and include_archived. Archiving a vault archives every credential in it and clears their values; deleting it removes every credential and cannot be undone. Metadata keys starting with anthropic. are reserved and cannot be written. The same vaults are also available through the native /vault/v1 API.
Archive Vault：Supports create, list, retrieve, update, archive and delete. Lists accept limit, page and include_archived. Archiving a vault archives every credential in it and clears their values; deleting it removes every credential and cannot be undone. Metadata keys starting with anthropic. are reserved and cannot be written. The same vaults are also available through the native /vault/v1 API.
List Credentials：Supports environment_variable and static_bearer. environment_variable networking supports limited only; unrestricted returns 400. secret_name may contain only uppercase letters, digits and underscores and cannot start with a digit. injection_location defaults match the official API. A static_bearer token is usable only on the host of its mcp_server_url. Creating or updating mcp_oauth returns 501 (not_implemented_error), produces no side effects, and the official SDK does not retry; use one-click authorization at /vault/v1/authorizations for OAuth tokens. A vault holds at most 20 active credentials. Metadata keys starting with anthropic. are reserved and cannot be written.
Create Credential：Supports environment_variable and static_bearer. environment_variable networking supports limited only; unrestricted returns 400. secret_name may contain only uppercase letters, digits and underscores and cannot start with a digit. injection_location defaults match the official API. A static_bearer token is usable only on the host of its mcp_server_url. Creating or updating mcp_oauth returns 501 (not_implemented_error), produces no side effects, and the official SDK does not retry; use one-click authorization at /vault/v1/authorizations for OAuth tokens. A vault holds at most 20 active credentials. Metadata keys starting with anthropic. are reserved and cannot be written.
Delete Credential：Supports environment_variable and static_bearer. environment_variable networking supports limited only; unrestricted returns 400. secret_name may contain only uppercase letters, digits and underscores and cannot start with a digit. injection_location defaults match the official API. A static_bearer token is usable only on the host of its mcp_server_url. Creating or updating mcp_oauth returns 501 (not_implemented_error), produces no side effects, and the official SDK does not retry; use one-click authorization at /vault/v1/authorizations for OAuth tokens. A vault holds at most 20 active credentials. Metadata keys starting with anthropic. are reserved and cannot be written.
Get Credential：Supports environment_variable and static_bearer. environment_variable networking supports limited only; unrestricted returns 400. secret_name may contain only uppercase letters, digits and underscores and cannot start with a digit. injection_location defaults match the official API. A static_bearer token is usable only on the host of its mcp_server_url. Creating or updating mcp_oauth returns 501 (not_implemented_error), produces no side effects, and the official SDK does not retry; use one-click authorization at /vault/v1/authorizations for OAuth tokens. A vault holds at most 20 active credentials. Metadata keys starting with anthropic. are reserved and cannot be written.
Update Credential：Supports environment_variable and static_bearer. environment_variable networking supports limited only; unrestricted returns 400. secret_name may contain only uppercase letters, digits and underscores and cannot start with a digit. injection_location defaults match the official API. A static_bearer token is usable only on the host of its mcp_server_url. Creating or updating mcp_oauth returns 501 (not_implemented_error), produces no side effects, and the official SDK does not retry; use one-click authorization at /vault/v1/authorizations for OAuth tokens. A vault holds at most 20 active credentials. Metadata keys starting with anthropic. are reserved and cannot be written.
Archive Credential：Supports environment_variable and static_bearer. environment_variable networking supports limited only; unrestricted returns 400. secret_name may contain only uppercase letters, digits and underscores and cannot start with a digit. injection_location defaults match the official API. A static_bearer token is usable only on the host of its mcp_server_url. Creating or updating mcp_oauth returns 501 (not_implemented_error), produces no side effects, and the official SDK does not retry; use one-click authorization at /vault/v1/authorizations for OAuth tokens. A vault holds at most 20 active credentials. Metadata keys starting with anthropic. are reserved and cannot be written.
Validate Credential MCP OAuth：Applies to OAuth credentials only; other types return 400. The result is always HTTP 200 with status valid, invalid or unknown; mcp_probe describes the failing step only when the check does not pass, and refresh appears only when a refresh was attempted.