Create an Agent Knowledge MCP session

Issues a five-minute, read-only Streamable HTTP MCP capability for an active Agent in the verified Organization. Requires agents:read and knowledge:read. Use the returned token as Authorization: Bearer when calling the returned URL from an MCP client. It searches only the Agent’s current assigned documents; it cannot access business tools. Treat the token as a secret. Retrying issues another temporary capability; no persistent session is created.

POST

agents

{agentId}

knowledge-sessions

Create an Agent Knowledge MCP session

curl --request POST \
  --url https://api.getarbol.com/v1/agents/{agentId}/knowledge-sessions \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{}'

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({})
};

fetch('https://api.getarbol.com/v1/agents/{agentId}/knowledge-sessions', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.getarbol.com/v1/agents/{agentId}/knowledge-sessions"

payload = {}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

{
  "agentId": "agt_018f47a2-4f4d-7d61-9e2c-1d7b8e9a0c31",
  "expiresAt": "2026-08-29T14:30:00Z",
  "token": "<string>",
  "transport": "streamable-http",
  "url": "<string>"
}

{
  "defined": true,
  "inferable": true,
  "code": "BAD_REQUEST",
  "status": 400,
  "message": "<string>",
  "data": {
    "issues": [
      {
        "code": "custom",
        "message": "<string>",
        "path": [
          "<string>"
        ]
      }
    ],
    "truncated": true
  }
}

{
  "defined": true,
  "inferable": true,
  "code": "UNAUTHORIZED",
  "status": 401,
  "message": "<string>",
  "data": "<unknown>"
}

{
  "defined": true,
  "inferable": true,
  "code": "FORBIDDEN",
  "status": 403,
  "message": "<string>",
  "data": {
    "missingPermissions": [
      "agents:read"
    ]
  }
}

{
  "defined": true,
  "inferable": true,
  "code": "NOT_FOUND",
  "status": 404,
  "message": "<string>",
  "data": "<unknown>"
}

{
  "code": "PAYLOAD_TOO_LARGE",
  "defined": false,
  "inferable": false,
  "message": "<string>",
  "data": "<unknown>"
}

{
  "code": "UNSUPPORTED_MEDIA_TYPE",
  "defined": false,
  "inferable": false,
  "message": "<string>",
  "data": "<unknown>"
}

{
  "defined": true,
  "inferable": true,
  "code": "TOO_MANY_REQUESTS",
  "status": 429,
  "message": "<string>",
  "data": {
    "retryAfterSeconds": 123
  }
}

{
  "defined": true,
  "inferable": true,
  "code": "SERVICE_UNAVAILABLE",
  "status": 503,
  "message": "<string>",
  "data": "<unknown>"
}

Authorizations

Authorization

string

header

required

Organization-scoped Auth0 user access token issued to an approved first-party client or exchanged by a trusted OBO resource server.

Path Parameters

agentId

string

required

Opaque Arbol resource identifier; the endpoint and tenant-scoped lookup determine its resource type.

Maximum string length: 64

Pattern: ^[a-z][a-z0-9]{1,15}_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$

Example:

"agt_018f47a2-4f4d-7d61-9e2c-1d7b8e9a0c31"

Body

application/json

The body is of type object.

Response

Five-minute read-only MCP bearer capability. Send token in the Authorization: Bearer header to url. Keep it secret; it grants only this active Agent's current document allowlist, never business tools. Mint a new session after expiry.

agentId

string

required

Opaque Arbol resource identifier; the endpoint and tenant-scoped lookup determine its resource type.

Maximum string length: 64

Pattern: ^[a-z][a-z0-9]{1,15}_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$

Example:

"agt_018f47a2-4f4d-7d61-9e2c-1d7b8e9a0c31"

expiresAt

string<date-time>

required

ISO 8601 timestamp with an explicit UTC offset.

Pattern:

^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$

Example:

"2026-08-29T14:30:00Z"

token

string

required

Required string length: 1 - 4096

transport

string

required

Allowed value: "streamable-http"

url

string<uri>

required

Maximum string length: 2048

⌘I

Create an Agent Knowledge MCP session

curl --request POST \
  --url https://api.getarbol.com/v1/agents/{agentId}/knowledge-sessions \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{}'

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({})
};

fetch('https://api.getarbol.com/v1/agents/{agentId}/knowledge-sessions', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.getarbol.com/v1/agents/{agentId}/knowledge-sessions"

payload = {}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

{
  "agentId": "agt_018f47a2-4f4d-7d61-9e2c-1d7b8e9a0c31",
  "expiresAt": "2026-08-29T14:30:00Z",
  "token": "<string>",
  "transport": "streamable-http",
  "url": "<string>"
}

{
  "defined": true,
  "inferable": true,
  "code": "BAD_REQUEST",
  "status": 400,
  "message": "<string>",
  "data": {
    "issues": [
      {
        "code": "custom",
        "message": "<string>",
        "path": [
          "<string>"
        ]
      }
    ],
    "truncated": true
  }
}

{
  "defined": true,
  "inferable": true,
  "code": "UNAUTHORIZED",
  "status": 401,
  "message": "<string>",
  "data": "<unknown>"
}

{
  "defined": true,
  "inferable": true,
  "code": "FORBIDDEN",
  "status": 403,
  "message": "<string>",
  "data": {
    "missingPermissions": [
      "agents:read"
    ]
  }
}

{
  "defined": true,
  "inferable": true,
  "code": "NOT_FOUND",
  "status": 404,
  "message": "<string>",
  "data": "<unknown>"
}

{
  "code": "PAYLOAD_TOO_LARGE",
  "defined": false,
  "inferable": false,
  "message": "<string>",
  "data": "<unknown>"
}

{
  "code": "UNSUPPORTED_MEDIA_TYPE",
  "defined": false,
  "inferable": false,
  "message": "<string>",
  "data": "<unknown>"
}

{
  "defined": true,
  "inferable": true,
  "code": "TOO_MANY_REQUESTS",
  "status": 429,
  "message": "<string>",
  "data": {
    "retryAfterSeconds": 123
  }
}

{
  "defined": true,
  "inferable": true,
  "code": "SERVICE_UNAVAILABLE",
  "status": 503,
  "message": "<string>",
  "data": "<unknown>"
}

Overview

Endpoints

Create an Agent Knowledge MCP session

Authorizations

Path Parameters

Body

Response