Skip to main content
Authenticated API

ACP (AI Cost & Performance) endpoints require a valid JWT Bearer token. Accessible via the API gateway.

ACP Integration API

Complete API reference for the Anthropic Claude Platform (ACP) integration, providing agent management, capability control, HITL approval workflows, and comprehensive audit logging.

Overview​

The ACP Integration API enables centralized management of AI agents within the Olympus Cloud platform. It provides:

FeatureDescription
Agent RegistryRegister, configure, and manage AI agent lifecycle
Capability ManagementDefine and organize agent capabilities
Tool PermissionsControl which tools agents can access
HITL ApprovalsHuman-in-the-loop approval workflows for sensitive actions
Audit LoggingComplete audit trail of agent actions
Security EventsTrack and respond to security-relevant events

Base URL​

https://api.olympuscloud.ai/v1/acp

Authentication​

All endpoints require Bearer token authentication:

Authorization: Bearer YOUR_ACCESS_TOKEN

Error Responses​

All endpoints return consistent error responses:

{
  "error": {
    "code": "AGENT_NOT_FOUND",
    "message": "Agent with ID 'agent_xyz' not found",
    "request_id": "req_abc123",
    "timestamp": "2026-01-19T14:30:00Z"
  }
}

Error Codes​

CodeHTTP StatusDescription
AGENT_NOT_FOUND404Agent does not exist
CAPABILITY_NOT_FOUND404Capability does not exist
TOOL_NOT_FOUND404Tool does not exist
PERMISSION_DENIED403Insufficient permissions
APPROVAL_EXPIRED410Approval request has expired
APPROVAL_ALREADY_PROCESSED409Approval already approved/denied
INVALID_STATUS_TRANSITION400Invalid agent status change
RATE_LIMIT_EXCEEDED429Too many requests
VALIDATION_ERROR400Invalid request body

Webhooks​

Configure webhooks to receive real-time notifications about ACP events.

Webhook Events​

EventTrigger
acp.agent.status_changedAgent status updated
acp.approval.requestedNew approval request
acp.approval.processedApproval approved/denied
acp.approval.expiredApproval timed out
acp.security.eventSecurity event triggered
acp.tool.executionAgent executed a tool

Webhook Payload​

{
  "event": "acp.approval.requested",
  "timestamp": "2026-01-19T14:30:00Z",
  "data": {
    "approval_id": "appr_ghi789",
    "agent_id": "agent_abc123",
    "action": "bulk_inventory_adjustment",
    "risk_level": "high"
  },
  "signature": "sha256=abc123..."
}

Signature Verification​

Verify webhook signatures using HMAC-SHA256:

const crypto = require('crypto');

function verifyWebhook(payload, signature, secret) {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

Rate Limits​

Endpoint CategoryLimit
Agent management100 req/min
Approval operations200 req/min
Audit log queries50 req/min
Permission evaluation500 req/min

Rate limit headers included in all responses:

X-RateLimit-Limit: 100
X-RateLimit-Remaining: 95
X-RateLimit-Reset: 1737296460

Best Practices​

  1. Use capability-based permissions - Grant capabilities, not individual tools
  2. Set appropriate risk levels - High-risk actions should require HITL approval
  3. Monitor security events - Review and acknowledge events promptly
  4. Audit regularly - Review audit logs for anomalies
  5. Scope permissions narrowly - Limit agent access by tenant and location
  6. Set expiration dates - Time-limit sensitive permissions

Sub-Pages​