API clients and agents
Organisation administrators open Settings → Agents & API, or Agents & API in the sidebar. Ordinary members and viewers cannot administer clients or credentials.
An API client identifies a piece of software allowed to use CYJ. An automated agent can be associated with an existing team resource so CYJ knows which tasks it owns. An integration may have no resource association; it can then inspect its API identity but cannot use task operations.
Create a client
Choose Create API client. Enter its name, purpose and Agent or Integration type. Select an active agent resource in your organisation. Existing resources with seven full-day working patterns are also eligible: explicitly confirm using the resource as a continuous 24-hour agent. This does not create a duplicate person or reassign existing tasks. A 24-hour agent does not inherit human breaks, holidays or organisation closures.
Select the required permissions. Read own tasks lets the client discover work and obtain concurrency values. The other scopes allow updating owned tasks, recording actual work, adding notes and creating/reading human assistance requests. Permissions belong to the client and apply to every one of its credentials. CYJ enforces both these scopes and the associated resource's task ownership.
Create and save a credential
Open the client, choose Create credential, and label it, for example Production or Test. CYJ generates a secure random credential and shows its full secret once only. Use Copy credential and save it in the client machine's secret store. Do not put it in a URL, source control, shared notes or committed configuration.
CYJ stores only a hash and cannot show the secret again. The one-time screen is not cached; leaving or dismissing it clears its secret from the page. If it was not saved, generate a replacement. Credential identifiers such as cyj-key-000123 are safe record identifiers, not recoverable portions of the secret.
Rotate without downtime
Next to an active credential, choose Rotate…. Give the replacement a new label, generate it, and copy its one-time secret. Both credentials remain valid while you deploy and test the replacement. Then choose Revoke… on the previous credential and confirm. Rotation does not recreate the client or change its task ownership, scopes or history.
Revoke access
Revoking one credential immediately prevents new authentication with that credential; other active credentials remain valid. Revoke all access stops the entire client and every credential. Both actions require confirmation. Revoked records, existing tasks, human requests and Activity history are retained. Client-wide revocation cannot be undone through this screen.
Change resource or permissions
Choose Edit client. Name and description changes can be saved directly. Resource, type or scope changes show a separate confirmation. Review which resource and permissions will apply to every active credential before confirming. Changes apply to the next API request; in-flight writes recheck the credential and configuration inside their transaction. Creating administrators must retain an active, non-viewer membership, and mapped resources must remain active.
Status and human assistance
The detail page shows access status, resource availability, credentials and recent Activity. Last-used timestamps are recorded at most once per credential every five minutes; they are not a real-time monitor. Historical credentials migrated from the first API implementation have no last-used timestamp until they next authenticate.
Agents can create explicitly linked human assistance requests for work they own. CYJ schedules these as ordinary human work, using the human's normal capacity. Blocking requests pause the agent task until humans supply responses and complete all outstanding blockers. Administration and credential changes do not delete that work. See Agent API and human assistance.
OpenAPI specification
The OpenAPI specification link in Agents & API opens /api/v1/openapi.json. It describes authentication, endpoints, request bodies and concurrency. No interactive documentation dependency is required.