APIZDocs

APIZ guide

Give A Coding Agent Access For One Task

Use this pattern when a coding or release agent needs GitHub for one bounded job. The agent receives a short-lived APIZ credential for one Client Binding; the GitHub token stays inside the shared API Instance.

GitHub API Instance -> task Client -> repo/action Policy -> 1h credential

Web Console

  1. Connect GitHub with a fine-grained token restricted at the provider when possible.
  2. Create a Client named for the responsibility, such as Demo release agent.
  3. Bind GitHub with alias github.
  4. Attach a mandatory Structured Policy that allows only the required repo and actions. For an issue-writing task, allow repo/issue reads plus github:issue:write; deny everything else.
  5. Run allow fixtures for the task and deny fixtures for another repo, delete, Actions secrets, and collaborator management.
  6. Publish, enable, attach, then create a Temporary Credential with a lifetime matching the task—one hour in this example.

The API Instance repository fields are review hints. Policy provides the Client-specific enforced boundary.

CLI

apiz -o json client create --name demo-release-agent > client.json
CLIENT_ID=$(jq -r '.client_id' client.json)

apiz -o json client bind "$CLIENT_ID" \
  --api-instance <github-api-instance-id> --alias github > binding.json

apiz client binding policy add \
  "$(jq -r '.client_binding_id' binding.json)" \
  --policy <task-policy-id> --order 100

umask 077
apiz -o json client credentials create "$CLIENT_ID" \
  --binding github --ttl 1h --format curl > setup.json

Use the GitHub Adapter and Structured Policy tutorial for the exact connection and Policy Project lifecycle.

Agent Request And Proof

Load only the generated APIZ endpoint and credential into the agent. A request to the approved repo and action should reach GitHub. The same credential must be denied for another repo or a destructive action before Secret Broker release.

In Access Logs, verify the Client, Binding, normalized GitHub action/repository, Published Policy Revision, reason, and whether upstream was reached. Credential values must remain redacted.

End Or Revoke The Task

Let the Credential Group expire normally, or end early with:

apiz client credentials revoke <credential-group-id>

Revoke or shorten APIZ access for an agent incident. Rotate the GitHub token only when the upstream credential itself may be compromised.

Safety Boundaries

  • Create separate Clients when tasks need independent evidence or revocation.
  • Keep the Binding Policy mandatory and default-deny.
  • Do not give the agent the operator login session or upstream GitHub token.
  • A one-hour credential limits time, not actions; Policy limits actions and resources.