Agents

Agents is governed machine access for Craft CMS and Craft Commerce. It gives teams a safe API and operator layer for AI agents, automations, and external runtimes, with scoped machine accounts, approvals, status visibility, and reliable webhook handoff.

It is vendor- and model-agnostic. If a system can call HTTP APIs, it can work with Agents.

Example workflows

Content QA before publishing
Scan entries, assets, and taxonomy for broken patterns, missing metadata, outdated content, and structural issues

Draft writing with approval
Let an external agent prepare draft updates for existing entries and route them into human review before anything changes on the site

Weekly site reporting
Generate recurring summaries of content changes, site activity, and operational signals for teams and clients

Legal and consent checks
Compare legal text and consent-related content against visible site behavior such as cookies, trackers, disclosures, and policy pages

Core capabilities

• scoped machine accounts with one-time token reveal
• managed account lifecycle in the Craft control panel
• read APIs for Craft and Craft Commerce resources
• governed write flows for draft-oriented actions
• approval routing for higher-risk operations
• operator notifications and approval visibility
• runtime status, diagnostics, and observability
• webhook delivery, dead-letter visibility, and replay
• change feeds and sync-state endpoints for external workers
• OpenAPI and capabilities endpoints for machine-readable contracts

Secure by default

• token-based auth
• scope-based access control
• rate limiting
• sensitive data redaction where appropriate
• production fail-closed behavior for missing credentials
• optional IP allowlists, expiry policies, and approval requirements

Good fit for teams that need

• one governed API surface instead of custom one-off endpoints
• safer handoff to AI runtimes and automations
• approval controls for sensitive actions
• better operator visibility inside Craft
• a cleaner boundary between “what the agent can do” and “what humans still control”

Connect external runtimes to /agents/v1/*, manage machine accounts in the control panel, and use Status, Accounts, Approvals, and Settings as the operator surface.