Repository navigation
feat(agents): redeem device codes from the body; agent sign-in and management errors - #1180
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. 3 Skipped Deployments
|
 [Critical impact] Changes the public API contract for agent device code redemption. The specific rate limits must be documented before merging to satisfy the repository requirement; the stale skill reference should also be updated. FindingsFix with agent prompt### Issue 1
mintlify/openapi.yaml:8453
The new redemption description names who is rate limited but gives no request counts or time windows. The documentation rule requires “Include rate limiting information with specific limits.” Add the actual limits to the source description and regenerate the bundles so callers know how often they can redeem codes. This repository requirement must be satisfied before merging.
### Issue 2
openapi/openapi.yaml:353-354
Moving redemption leaves `.claude/skills/grid-api/references/endpoints.md:271` pointing to `POST /agents/device-codes/{code}/redeem`. The Grid API skill tells assistants to read that reference when answering API questions, so they can still recommend the removed route. Update the reference to `POST /agents/device-codes/redeem` and explain that `code` belongs in the JSON body.
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.SummaryMoves device-code redemption to
kphurley7 explicitly acknowledges the breaking route change in the PR description. That intentional change is not reported as a defect; the stale internal reference is reported separately. Reviews (1) · Last reviewed commit: "feat(agents): redeem device codes from t..." · Reviewed by Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| Redeem a device code to obtain agent credentials. This endpoint is called by the agent software during installation. On success, returns a Bearer access token that the agent uses for all subsequent API calls. The token is returned only once and must be stored securely. | ||
| This endpoint does not require platform authentication — the device code itself serves as proof of authorization. | ||
| This endpoint does not require platform authentication — the device code itself serves as proof of authorization. A code can be redeemed only once and only before its `expiresAt`. | ||
| Redemption is rate limited per client IP address and across all callers, and calls made with platform credentials are limited per platform instead. A caller over a limit receives `429` and should back off before retrying. |
There was a problem hiding this comment.
The new redemption description names who is rate limited but gives no request counts or time windows. The documentation rule requires “Include rate limiting information with specific limits.” Add the actual limits to the source description and regenerate the bundles so callers know how often they can redeem codes. This repository requirement must be satisfied before merging.
Context Used: mintlify/AGENTS.md (source)
Prompt To Fix With AI
This is a comment left during a code review.
Path: mintlify/openapi.yaml
Line: 8453
Comment:
**Rate limits lack specific values**
The new redemption description names who is rate limited but gives no request counts or time windows. The documentation rule requires “Include rate limiting information with specific limits.” Add the actual limits to the source description and regenerate the bundles so callers know how often they can redeem codes. This repository requirement must be satisfied before merging.
**Context Used:** mintlify/AGENTS.md ([source](https://github.com/lightsparkdev/grid-api/blob/main/mintlify/AGENTS.md))
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.There was a problem hiding this comment.
Fixed in fe23a22. The redeem description now states the enforced limits: fixed 60-second windows, 10 per client IP and 1,000 in total for callers without platform credentials, or 600 per platform for calls with platform credentials. Over the limit returns 429 RATE_LIMITED, and the call is also rejected with 429 if the limit cannot be checked. Both bundles are regenerated.
| /agents/device-codes/redeem: | ||
| $ref: paths/agents/agents_device-codes_redeem.yaml |
There was a problem hiding this comment.
Moving redemption leaves .claude/skills/grid-api/references/endpoints.md:271 pointing to POST /agents/device-codes/{code}/redeem. The Grid API skill tells assistants to read that reference when answering API questions, so they can still recommend the removed route. Update the reference to POST /agents/device-codes/redeem and explain that code belongs in the JSON body.
Prompt To Fix With AI
This is a comment left during a code review.
Path: openapi/openapi.yaml
Line: 353-354
Comment:
**Skill lists the removed route**
Moving redemption leaves `.claude/skills/grid-api/references/endpoints.md:271` pointing to `POST /agents/device-codes/{code}/redeem`. The Grid API skill tells assistants to read that reference when answering API questions, so they can still recommend the removed route. Update the reference to `POST /agents/device-codes/redeem` and explain that `code` belongs in the JSON body.
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.There was a problem hiding this comment.
Already fixed in 9732499: the reference now lists POST /agents/device-codes/redeem with the code in the JSON body.
a6310a8 to
9732499
Compare
|
Preview deployment for your docs. Learn more about Mintlify Previews.
|
…nagement errors
POST /agents/device-codes/{code}/redeem moves to POST /agents/device-codes/redeem
with the code in the body, so the secret never appears in a URL or access log
(breaking for that path); redeem documents its 403 and 429. GET /agents,
PATCH/DELETE /agents/{agentId}, PATCH /agents/{agentId}/policy and
GET /agents/me answer 403 when the Agents API is not enabled for the
platform, and GET /agents answers 404 for an unknown customer filter. Policy
spending-limit updates must keep the agent's original currency.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TeBuC5ym3AR1ZJ6eocSFGT
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TeBuC5ym3AR1ZJ6eocSFGT
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TeBuC5ym3AR1ZJ6eocSFGT
9732499 to
fe23a22
Compare
github-actions
Bot
added
the
breaking-change
|
This branch was successfully deployed
2 participants
Agent sign-in and management errors; redeem takes the code in the body.
POST /agents/device-codes/{code}/redeemmoves toPOST /agents/device-codes/redeemwith the code in the body; it documents its 403 and 429.GET /agents,PATCH/DELETE /agents/{agentId},PATCH /agents/{agentId}/policyandGET /agents/medocument a 403 when the Agents API is not enabled;GET /agentsdocuments a 404 for an unknown customer filter.Needs the breaking-change label and API-reviewer approval.